Issue
How can the size of the core file be predicted based on for example /proc/pid/maps
, /proc/pid/coredump_filter
, values shown by top
like VIRT RES
and so on?
Generally speaking, on what does the size of the core file depend and what exactly does the file contain (which parts of virtual address space?)?
I'm a little confused by a fact that the core file may be smaller than a VIRT
or a sum of all memory ranges in /proc/pid/maps
, so I suspect the file to be incomplete.
Solution
How can the size of the core file be predicted based on for example /proc/pid/maps, /proc/pid/coredump_filter, values shown by top like VIRT RES and so on?
The upper bound is the sum of all mappings in /proc/$$/maps
. However, usually read-only mappings are not saved in the core
(under assumption that you will have the files that are mapped read-only available at the time when you use the core
).
The lower bound is the sum of all writable mappings in /proc/$$/maps
. It's a lower bound because the kernel usually also dumps the first page of executable read-only mappings, as that's where linker BUILD_ID
ELF note is. That note allows GDB to find correct version of the executable or shared libraries used, even if the system has been updated with newer ones. core
also contains a dump of registers for each thread. There is also some overhead to the ELF format itself.
VIRT and RES are usually not a good estimate: VIRT is "too big" -- it contains read-only mappings, as well as pages that are mmap
ed into the process, but haven't actually been paged in. RES may be too small if parts of your memory have been swapped out.
I'm a little confused by a fact that the core file may be smaller than a VIRT or a sum of all memory ranges in /proc/pid/maps, so I suspect the file to be incomplete.
As I explained above, the core
being smaller than VIRT
and the sum of all memory ranges in /proc/pid/maps
is normal and expected.
Finally, if you really wish to find a fairly precise estimate before actually dumping the core, you may wish to study Google user-space coredumper.
Answered By - Employed Russian Answer Checked By - Mary Flores (WPSolving Volunteer)