systemd/man/coredumpctl.xml

<?xml version='1.0'?> <!--*-nxml-*-->
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
  "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
<!-- SPDX-License-Identifier: LGPL-2.1-or-later -->

<refentry id="coredumpctl" conditional='ENABLE_COREDUMP'
    xmlns:xi="http://www.w3.org/2001/XInclude">

  <refentryinfo>
    <title>coredumpctl</title>
    <productname>systemd</productname>
  </refentryinfo>

  <refmeta>
    <refentrytitle>coredumpctl</refentrytitle>
    <manvolnum>1</manvolnum>
  </refmeta>

  <refnamediv>
    <refname>coredumpctl</refname>
    <refpurpose>Retrieve and process saved core dumps and metadata</refpurpose>
  </refnamediv>

  <refsynopsisdiv>
    <cmdsynopsis>
      <command>coredumpctl</command>
      <arg choice="opt" rep="repeat">OPTIONS</arg>
      <arg choice="req">COMMAND</arg>
      <arg choice="opt" rep="repeat">PID|COMM|EXE|MATCH</arg>
    </cmdsynopsis>
  </refsynopsisdiv>

  <refsect1>
    <title>Description</title>

    <para><command>coredumpctl</command> is a tool that can be used to retrieve and process core
    dumps and metadata which were saved by
    <citerefentry><refentrytitle>systemd-coredump</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
    </para>
  </refsect1>

  <refsect1>
    <title>Commands</title>

    <para>The following commands are understood:</para>

    <variablelist>
      <varlistentry>
        <term><command>list</command></term>

        <listitem><para>List core dumps captured in the journal
        matching specified characteristics. If no command is
        specified, this is the implied default.</para>

        <para>The output is designed to be human readable and contains a table with the following
        columns:</para>
        <variablelist>
          <varlistentry>
            <term>TIME</term>
            <listitem><para>The timestamp of the crash, as reported by the kernel.</para>
            </listitem>
          </varlistentry>

          <varlistentry>
            <term>PID</term>
            <listitem><para>The identifier of the process that crashed.</para>
            </listitem>
          </varlistentry>

          <varlistentry>
            <term>UID</term>
            <term>GID</term>
            <listitem><para>The user and group identifiers of the process that crashed.</para>
            </listitem>
          </varlistentry>

          <varlistentry>
            <term>SIGNAL</term>
            <listitem><para>The signal that caused the process to crash, when applicable.
            </para></listitem>
          </varlistentry>

          <varlistentry>
            <term>COREFILE</term>
            <listitem><para>Information whether the coredump was stored, and whether
            it is still accessible: <literal>none</literal> means the core was
            not stored, <literal>-</literal> means that it was not available (for
            example because the process was not terminated by a signal),
            <literal>present</literal> means that the core file is accessible by the
            current user, <literal>journal</literal> means that the core was stored
            in the <literal>journal</literal>, <literal>truncated</literal> is the
            same as one of the previous two, but the core was too large and was not
            stored in its entirety, <literal>error</literal> means that the core file
            cannot be accessed, most likely because of insufficient permissions, and
            <literal>missing</literal> means that the core was stored in a file, but
            this file has since been removed.</para></listitem>
          </varlistentry>

          <varlistentry>
            <term>EXE</term>
            <listitem><para>The full path to the executable. For backtraces of scripts
            this is the name of the interpreter.</para></listitem>
          </varlistentry>
        </variablelist>

        <para>It's worth noting that different restrictions apply to
        data saved in the journal and core dump files saved in
        <filename>/var/lib/systemd/coredump</filename>, see overview in
        <citerefentry><refentrytitle>systemd-coredump</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
        Thus it may very well happen that a particular core dump is still listed
        in the journal while its corresponding core dump file has already been
        removed.</para></listitem>
      </varlistentry>

      <varlistentry>
        <term><command>info</command></term>

        <listitem><para>Show detailed information about the last core dump
        or core dumps matching specified characteristics
        captured in the journal.</para></listitem>
      </varlistentry>

      <varlistentry>
        <term><command>dump</command></term>

        <listitem><para>Extract the last core dump matching specified
        characteristics. The core dump will be written on standard
        output, unless an output file is specified with
        <option>--output=</option>. </para></listitem>
      </varlistentry>

      <varlistentry>
        <term><command>debug</command></term>

        <listitem><para>Invoke a debugger on the last core dump
        matching specified characteristics. By default,
        <citerefentry project='man-pages'><refentrytitle>gdb</refentrytitle><manvolnum>1</manvolnum></citerefentry>
        will be used. This may be changed using the <option>--debugger=</option>
        option or the <varname>$SYSTEMD_DEBUGGER</varname> environment
        variable. Use the <option>--debugger-arguments=</option> option to pass extra
        command line arguments to the debugger.</para></listitem>
      </varlistentry>

    </variablelist>

  </refsect1>

  <refsect1>
    <title>Options</title>

    <para>The following options are understood:</para>

    <variablelist>

      <xi:include href="standard-options.xml" xpointer="help" />
      <xi:include href="standard-options.xml" xpointer="version" />

      <varlistentry>
        <term><option>--no-legend</option></term>

        <listitem><para>Do not print column headers.</para></listitem>
      </varlistentry>

      <xi:include href="standard-options.xml" xpointer="no-pager" />

      <varlistentry>
        <term><option>-1</option></term>

        <listitem><para>Show information of a single core dump only, instead of listing
        all known core dumps.</para></listitem>
      </varlistentry>

      <varlistentry>
        <term><option>-S</option></term>
        <term><option>--since</option></term>

        <listitem><para>Only print entries which are since the specified date.</para></listitem>
      </varlistentry>

      <varlistentry>
        <term><option>-U</option></term>
        <term><option>--until</option></term>

        <listitem><para>Only print entries which are until the specified date.</para></listitem>
      </varlistentry>

      <varlistentry>
        <term><option>-r</option></term>
        <term><option>--reverse</option></term>

        <listitem><para>Reverse output so that the newest entries are displayed first.
        </para></listitem>
      </varlistentry>

      <varlistentry>
        <term><option>-F</option> <replaceable>FIELD</replaceable></term>
        <term><option>--field=</option><replaceable>FIELD</replaceable></term>

        <listitem><para>Print all possible data values the specified
        field takes in matching core dump entries of the
        journal.</para></listitem>
      </varlistentry>

      <varlistentry>
        <term><option>-o</option> <replaceable>FILE</replaceable></term>
        <term><option>--output=</option><replaceable>FILE</replaceable></term>

        <listitem><para>Write the core to <option>FILE</option>.
        </para></listitem>
      </varlistentry>

      <varlistentry>
        <term><option>--debugger=</option><replaceable>DEBUGGER</replaceable></term>

        <listitem><para>Use the given debugger for the <command>debug</command>
        command. If not given and <varname>$SYSTEMD_DEBUGGER</varname> is unset, then
        <citerefentry project='man-pages'><refentrytitle>gdb</refentrytitle><manvolnum>1</manvolnum></citerefentry>
        will be used. </para></listitem>
      </varlistentry>

      <varlistentry>
        <term><option>-A</option> <replaceable>ARGS</replaceable></term>
        <term><option>--debugger-arguments=</option><replaceable>ARGS</replaceable></term>

        <listitem><para>Pass the given <replaceable>ARGS</replaceable> as extra command line arguments
        to the debugger. Quote as appropriate when <replaceable>ARGS</replaceable> contain whitespace.
        (See Examples.)</para></listitem>
      </varlistentry>

      <varlistentry>
        <term><option>--file=<replaceable>GLOB</replaceable></option></term>

        <listitem><para>Takes a file glob as an argument. If
        specified, coredumpctl will operate on the specified journal
        files matching <replaceable>GLOB</replaceable> instead of the
        default runtime and system journal paths. May be specified
        multiple times, in which case files will be suitably
        interleaved.</para></listitem>
      </varlistentry>

      <varlistentry>
        <term><option>-D</option> <replaceable>DIR</replaceable></term>
        <term><option>--directory=</option><replaceable>DIR</replaceable></term>

        <listitem><para>Use the journal files in the specified <option>DIR</option>.
        </para></listitem>
      </varlistentry>

      <varlistentry>
        <term><option>-q</option></term>
        <term><option>--quiet</option></term>

        <listitem><para>Suppresses informational messages about lack
        of access to journal files and possible in-flight coredumps.
        </para></listitem>
      </varlistentry>
    </variablelist>
  </refsect1>

  <refsect1>
    <title>Matching</title>

    <para>A match can be:</para>

    <variablelist>
      <varlistentry>
        <term><replaceable>PID</replaceable></term>

        <listitem><para>Process ID of the
        process that dumped
        core. An integer.</para></listitem>
      </varlistentry>

      <varlistentry>
        <term><replaceable>COMM</replaceable></term>

        <listitem><para>Name of the executable (matches
        <option>COREDUMP_COMM=</option>). Must not contain slashes.
        </para></listitem>
      </varlistentry>

      <varlistentry>
        <term><replaceable>EXE</replaceable></term>

        <listitem><para>Path to the executable (matches
        <option>COREDUMP_EXE=</option>). Must contain at least one
        slash. </para></listitem>
      </varlistentry>

      <varlistentry>
        <term><replaceable>MATCH</replaceable></term>

        <listitem><para>General journalctl match filter, must contain an equals
        sign (<literal>=</literal>). See
        <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>.
        </para></listitem>
      </varlistentry>
    </variablelist>
  </refsect1>

  <refsect1>
    <title>Exit status</title>
    <para>On success, 0 is returned; otherwise, a non-zero failure
    code is returned. Not finding any matching core dumps is treated as
    failure.
    </para>
  </refsect1>

  <refsect1>
    <title>Environment</title>

    <variablelist class='environment-variables'>
      <varlistentry>
        <term><varname>$SYSTEMD_DEBUGGER</varname></term>
        <listitem><para>Use the given debugger for the <command>debug</command>
        command. See the <option>--debugger=</option> option.</para></listitem>
      </varlistentry>
    </variablelist>
  </refsect1>

  <refsect1>
    <title>Examples</title>

    <example>
      <title>List all the core dumps of a program named foo</title>

      <programlisting># coredumpctl list foo</programlisting>
    </example>

    <example>
      <title>Invoke gdb on the last core dump</title>

      <programlisting># coredumpctl debug</programlisting>
    </example>

    <example>
      <title>Use gdb to display full register info from the last core dump</title>

      <programlisting># coredumpctl debug --debugger-arguments="-batch -ex 'info all-registers'"</programlisting>
    </example>

    <example>
      <title>Show information about a process that dumped core,
      matching by its PID 6654</title>

      <programlisting># coredumpctl info 6654</programlisting>
    </example>

    <example>
      <title>Extract the last core dump of /usr/bin/bar to a file named
      <filename index="false">bar.coredump</filename></title>

      <programlisting># coredumpctl -o bar.coredump dump /usr/bin/bar</programlisting>
    </example>
  </refsect1>

  <refsect1>
    <title>See Also</title>
    <para>
      <citerefentry><refentrytitle>systemd-coredump</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
      <citerefentry><refentrytitle>coredump.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
      <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
      <citerefentry project='man-pages'><refentrytitle>gdb</refentrytitle><manvolnum>1</manvolnum></citerefentry>
    </para>
  </refsect1>

</refentry>