Part 7 · 1 chapters · ~8 min

Core Dumps and Debuggers

When a process crashes or hangs: enabling and collecting core dumps (ulimit, systemd-coredump, containers), gdb and lldb basics for native code and runtimes, Delve for Go, jdb and jcmd for the JVM, Node's llnode and diagnostic reports, and live debugging safely in production.

Cores, gdb and runtime debuggers

code

# allow and find core dumps
ulimit -c unlimited ; cat /proc/sys/kernel/core_pattern       # often piped to systemd-coredump
coredumpctl list ; coredumpctl gdb <pid>

# gdb on a native crash: where did it die?
gdb /usr/bin/myservice core.4123
(gdb) bt full            # backtrace with locals
(gdb) info threads ; thread apply all bt

# a hung process: dump without killing it
gcore <pid>              # writes core.<pid> while the process keeps running
# Go:  dlv attach <pid>  → goroutines, bt;  or send SIGQUIT to print all goroutine stacks
# JVM: jcmd <pid> Thread.print ; jcmd <pid> GC.heap_dump
# Node: node --report-on-signal → kill -USR2 <pid>; llnode for core files

In production: prefer capturing state (core, thread dump, heap dump, diagnostic report) and analysing it elsewhere over attaching an interactive debugger to a live process, which pauses it. In containers, core dumps go to the host's core_pattern; plan where they land and how large they are before you need one.