Linux高级调试与优化——同时抓取coredump和maps文件

Posted 2020-11-10 者旨於陽

Linux内核源码 Documentation/sysctl/kernel.txt core_pattern:

core_pattern:

core_pattern is used to specify a core dumpfile pattern name.
. max length 128 characters; default value is "core"
. core_pattern is used as a pattern template for the output filename;
  certain string patterns (beginning with ‘%‘) are substituted with
  their actual values.
. backward compatibility with core_uses_pid:
        If core_pattern does not include "%p" (default does not)
        and core_uses_pid is set, then .PID will be appended to
        the filename.
. corename format specifiers:
        %<NUL>  ‘%‘ is dropped
        %%      output one ‘%‘
        %p      pid
        %P      global pid (init PID namespace)
        %i      tid
        %I      global tid (init PID namespace)
        %u      uid
        %g      gid
        %d      dump mode, matches PR_SET_DUMPABLE and
                /proc/sys/fs/suid_dumpable
        %s      signal number
        %t      UNIX time of dump
        %h      hostname
        %e      executable filename (may be shortened)
        %E      executable path
        %<OTHER> both are dropped
. If the first character of the pattern is a ‘|‘, the kernel will treat
  the rest of the pattern as a command to run.  The core dump will be
  written to the standard input of that program instead of to a file.

步骤

1）编写coredump.sh脚本，放到/usr/local/目录

#!bin/bash

#/proc/<pid>/maps
cat /proc/$1/maps > /tmp/maps_of_$1

#coredump
dd > /tmp/core_$1_$2_$3

2）执行以下命令配置coredump

ulimit -c unlimited

echo "|/usr/local/coredump.sh %p %e %s" > /proc/sys/kernel/core_pattern

完成配置，这样发生应用程序异常之后，如果触发coredump，就会抓取/proc/<pid>/maps文件并转储coredump文件。

 

测试

1）触发coredump

root@chgao-virtual-machine:/media/new/linyao/debugging/SIGFPE# ./test 
Floating point exception

2）进入/tmp查看是否抓取到coredump和maps文件

root@chgao-virtual-machine:/tmp# ls
core_8124_test_8  maps_of_8124
root@chgao-virtual-machine:/tmp# file core_8124_test_8 
core_8124_test_8: ELF 64-bit LSB core file x86-64, version 1 (SYSV), SVR4-style, from ‘./test‘
root@chgao-virtual-machine:/tmp# file maps_of_8124 
maps_of_8124: ASCII text

3）查看maps文件

root@chgao-virtual-machine:/tmp# cat maps_of_8124 
00400000-00401000 r-xp 00000000 fc:00 57147397                           /media/new/linyao/debugging/SIGFPE/test
00600000-00601000 r--p 00000000 fc:00 57147397                           /media/new/linyao/debugging/SIGFPE/test
00601000-00602000 rw-p 00001000 fc:00 57147397                           /media/new/linyao/debugging/SIGFPE/test
7fad5d07a000-7fad5d23a000 r-xp 00000000 08:01 268253                     /lib/x86_64-linux-gnu/libc-2.23.so
7fad5d23a000-7fad5d43a000 ---p 001c0000 08:01 268253                     /lib/x86_64-linux-gnu/libc-2.23.so
7fad5d43a000-7fad5d43e000 r--p 001c0000 08:01 268253                     /lib/x86_64-linux-gnu/libc-2.23.so
7fad5d43e000-7fad5d440000 rw-p 001c4000 08:01 268253                     /lib/x86_64-linux-gnu/libc-2.23.so
7fad5d440000-7fad5d444000 rw-p 00000000 00:00 0 
7fad5d444000-7fad5d46a000 r-xp 00000000 08:01 268251                     /lib/x86_64-linux-gnu/ld-2.23.so
7fad5d64b000-7fad5d64e000 rw-p 00000000 00:00 0 
7fad5d669000-7fad5d66a000 r--p 00025000 08:01 268251                     /lib/x86_64-linux-gnu/ld-2.23.so
7fad5d66a000-7fad5d66b000 rw-p 00026000 08:01 268251                     /lib/x86_64-linux-gnu/ld-2.23.so
7fad5d66b000-7fad5d66c000 rw-p 00000000 00:00 0 
7ffc833d2000-7ffc833f3000 rw-p 00000000 00:00 0                          [stack]
7ffc833f5000-7ffc833f8000 r--p 00000000 00:00 0                          [vvar]
7ffc833f8000-7ffc833fa000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]

4）使用gdb调试coredump文件

root@chgao-virtual-machine:/media/new/linyao/debugging/SIGFPE# gdb ./test /tmp/core_8124_test_8 
GNU gdb (Ubuntu 7.11.1-0ubuntu1~16.5) 7.11.1
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./test...done.
[New LWP 8124]

warning: the debug information found in "/lib64/ld-2.23.so" does not match "/lib64/ld-linux-x86-64.so.2" (CRC mismatch).

Core was generated by `./test‘.
Program terminated with signal SIGFPE, Arithmetic exception.
#0  0x00000000004004f3 in main (argc=1, argv=0x7ffc833f1658) at test.c:12
12      result = a / b;
(gdb) info registers 
rax            0x2    2
rbx            0x0    0
rcx            0x0    0
rdx            0x0    0
rsi            0x7ffc833f1658    140722510435928
rdi            0x1    1
rbp            0x7ffc833f1570    0x7ffc833f1570
rsp            0x7ffc833f1570    0x7ffc833f1570
r8             0x400570    4195696
r9             0x7fad5d454ab0    140382570891952
r10            0x846    2118
r11            0x7fad5d09a740    140382566983488
r12            0x4003e0    4195296
r13            0x7ffc833f1650    140722510435920
r14            0x0    0
r15            0x0    0
rip            0x4004f3    0x4004f3 <main+29>
eflags         0x10246    [ PF ZF IF RF ]
cs             0x33    51
ss             0x2b    43
ds             0x0    0
es             0x0    0
fs             0x0    0
gs             0x0    0
(gdb) bt
#0  0x00000000004004f3 in main (argc=1, argv=0x7ffc833f1658) at test.c:12