is it possible to find which process dumped core

[su]

to find which process dumped core at the promt we give

$ file core.28424

core.28424: ELF 32-bit LSB core file of 'soffice.bin' (signal 11),
Intel 80386, version 1 (SYSV), from 'soffice.bin'

from this command we know 'soffice.bin' process dumped core. Now can i
do the same using python i.e. finding which process dumped core? if so
how can i do it?

 

[K.S.Sreeram]

from this command we know 'soffice.bin' process dumped core. Now can i
do the same using python i.e. finding which process dumped core? if so
how can i do it?

You're best bet would be to run the 'file' program using the subprocess
module and parse the output that it generates.

Regards
Sreeram



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFEhDmlrgn0plK5qqURArtFAKCUUzN7dV7TUGNkKLYS7YZt9GUTTACgwHnJ
TwAuGNBjKWiXTZsPbjpOPFI=
=7CU7
-----END PGP SIGNATURE-----

 

[Steve Holden]

to find which process dumped core at the promt we give

$ file core.28424

core.28424: ELF 32-bit LSB core file of 'soffice.bin' (signal 11),
Intel 80386, version 1 (SYSV), from 'soffice.bin'

from this command we know 'soffice.bin' process dumped core. Now can i
do the same using python i.e. finding which process dumped core? if so
how can i do it?

Unfortunately, without some debugging, all you are likely to find is
that /usr/bin/python (or some other interpreter executable) dumped core.

You'd have to poke around inside the core image to find out which file
was being executed when the interpreter failed.

regards
Steve

 

[Serge Orlov]

to find which process dumped core at the promt we give

$ file core.28424

core.28424: ELF 32-bit LSB core file of 'soffice.bin' (signal 11),
Intel 80386, version 1 (SYSV), from 'soffice.bin'

from this command we know 'soffice.bin' process dumped core. Now can i
do the same using python i.e. finding which process dumped core? if so
how can i do it?

Parse a core file like the file command does?

 

[Georg Brandl]

Unfortunately, without some debugging, all you are likely to find is
that /usr/bin/python (or some other interpreter executable) dumped core.

You'd have to poke around inside the core image to find out which file
was being executed when the interpreter failed.

I think he didn't want to analyze a Python core dump.

su: look into /usr/share/file/magic or whatever it's called on your box
to see where "file" looks for the executable name.

Georg

 

[yairchu]

if your core is from a python program you can check what file/function
was running

use this gdb macro:

define pbt
set $i = 0
set $j = 0
while $i < 1000
select $i
if $eip >= &PyEval_EvalFrame
if $eip < &PyEval_EvalCodeEx
echo c frame #
p $i
echo py frame #
p $j
set $j = $j+1
x/s ((PyStringObject*)f->f_code->co_filename)->ob_sval
x/s ((PyStringObject*)f->f_code->co_name)->ob_sval
echo line #
p f->f_lineno
end
end
set $i = $i+1
end
end
document pbt
show python backtrace
macro by yairchu based on pyframe macro by jeremy hylton
end

works on python2.4 here but not 100% sure it will always work. it has
some nasty hack.
you can also see where each of the threads was by choosing the wanted
thread in gdb
I'll post my useful gdb macros to the web sometime soon