core dumped - but core file is not in current directory?

Question

While running a C program , It says "(core dumped)" but I can't see any files under current path.

I have set ulimit -c unlimited and verified it with ulimit -a

I also tried to find file named "core" but didn't get the core dumped file? Any help , where is my core file?

Answer 1

I could think of two following possibilities:

1) As others have already pointed out, the program might chdir(). Is the user running the program allowed to write into the directory it chdir()'ed to? If not, it cannot create the core dump.

2) For some weird reason the core dump isn't named core.* You can check /proc/sys/kernel/core_pattern for that. Also, the find command you named wouldn't find a typical core dump. You should use find / -name "core.", as the typical name of the coredump is core.$PID

Answer 2

Do an ls -lrt in the directory right after the core is dumped. The last file listed is usually the core file.

Answer 3

Read /usr/src/linux/Documentation/sysctl/kernel.txt.

[/proc/sys/kernel/]core_pattern is used to specify a core dumpfile pattern name.

• If the first character of the pattern is a '|', the kernel will treat the rest of the pattern as a command to run. The core dump will be written to the standard input of that program instead of to a file.

Instead of writing the core dump to disk, your system is configured to send it to the abrt program instead. Automated Bug Reporting Tool is possibly not as documented as it should be...

In any case, the quick answer is that you should be able to find your core file in /var/cache/abrt, where abrt stores it after being invoked. Similarly, other systems using Apport may squirrel away cores in /var/crash, and so on.