Re: renaming core dumps

Warner Losh (imp@village.org)
Sun, 25 Feb 1996 12:06:37 -0700


: Anyway, I could live with a config option too, but I do not really see
: the reason for it. The fact that gdb dumped core on somebody is
: unfortunate, but not a catastrophy (you can just re-do the core-file,
: after all, total time loss 1 minute).

Linus,
I do respect your opinion, however, that is not always the
case. It can be hard to recreate core files, which is why having gdb
dump core all over them is a bad idea. I have litterally had core
files that took *DAYS* to reproduce. Having gdb dump core on them
would take me a week to recover from. Granted, I can rename these
core files, but your basic premise here isn't always correct. I know
you don't value core files, but having been in industry several years
has taught me they can be quite valuable sometimes, even if 99% of the
time they are of minimal value.

On my FreeBSD system, the core file renaming has been quite
useful. There have been times that I have had multiple deamons dump
core at the same time. All of the core files were preserved because
they were named differently. Granted, this filled up /, but I was
able to go in and do a post mortum on each one of these files to see
that it was basically the same thing in all of them. Since this
system is a gateway machine, I couldn't just assume this to be the
case. We are quite worried about being hacked, and I had to assure
myself that the cause wasn't some hacker or something like that.

Other times I've been able to figure out why my machine didn't boot by
seeing, say, fsck.core or inetd.core in / when I booted a floppy.
This would have been harder (although not impossible) to do without
it.

My point is that a config option would make sense.

Warner