Learn how to make, find and interpret core dumps so crashes stop being a mystery. 23.01.2026 | reading time: 3 min Core dumps turn a chaotic crash into a frozen problem to inspect; learn to configure where the kernel writes them, how to allow them and how to pull actionable data from a binary plus its core file. Reproduce a crash Execute the commands below to produce a simple core file on a lab machine and see the filename pattern in action: ```bash ulimit -c unlimited sysctl -w kernel.core_pattern="core.%e.%p" cat > segfault.c <<'EOF' #include <stdio.h> int main(){char *p=0;*p=1;return 0;} EOF gcc -g -o segfault segfault.c ./segfault ls -l core.* # then inspect with gdb: gdb ./segfault core.segfault.<pid> ``` Examine and configure kernel behavior Check `cat /proc/sys/kernel/core_pattern` and `ulimit -c` first; set `ulimit -c unlimited` in shells or `LimitCORE` in systemd units to permit dumps; change `kernel.core_pattern` with `sysctl` or echo into proc to control filename, piping or sending to a helper program is possible and useful; consider `kernel.core_uses_pid` to include PIDs and `fs.suid_dumpable` when dealing with suid programs; remember systemd may intercept dumps with systemd-coredump so use `coredumpctl` to list and extract structured cores. Inspecting cores and practical tips Open the core with `gdb /path/to/binary /path/to/core` to get a backtrace and inspect registers and memory; use `file core.*` to confirm architecture; clean up or rotate large cores to save space and add limits to PAM or systemd so a runaway process does not fill disks; when systemd-coredump is active use `coredumpctl info` and `coredumpctl gdb` to simplify the workflow. Related tools in daily use Beyond the kernel settings there are tools to help collect, analyze and symbolicate: `gdb` for deep inspection, `coredumpctl` for systemd-managed dumps and `systemd-coredump` as the capture agent; learn to combine them with `file`, `readelf` and symbol servers for stripped binaries. Finish line Get hands-on: change a pattern, crash a test program, and inspect the result; mastering these settings turns random failures into reproducible debugging sessions and prepares him for professional Linux troubleshooting and certifications like CompTIA Linux+ or LPIC-1 with intensive exam preparation at bitsandbytes.academy. Join Bits & Bytes Academy First class LINUX exam preparation. processes troubleshooting security storage
