When a process fails, the system tries to create up to two core files for each failed process, using a global core file name pattern and a per-process core file name pattern to create each core file name. The coreadm command controls these name patterns and specifies the location of the core files. This section describes some of the file path and file name parameters. For a full description of the core dump process, see the core(5) man page. For the full description of the coreadm options, see the coreadm(8) man page.
When a process terminates abnormally, it produces a core file in the current directory by default. If the global core file path is enabled, each abnormally terminating process might produce two files: one in the current working directory and another in the global core file location. The file paths that are used are configurable parameters.
Two configurable core file paths can be enabled or disabled independently of each other as follows:
A per-process core file path, which defaults to core and is enabled by default. If enabled, the per-process core file path causes a core file to be produced when the process terminates abnormally. The per-process path is inherited by a new process from its parent process.
When generated, a per-process core file is owned by the owner of the process with read/write permissions for the owner. Only the owner can view this file.
A global core file path, which defaults to core and is disabled by default. If enabled, an additional core file with the same content as the per-process core file is produced by using the global core file path.
When generated, a global core file is owned by root, with read/write permissions for root only. Non-privileged users cannot view this file.
The name of a core file contains fields with information about the failed process. For a full description of the core file name fields, see the coreadm(8) man page. This section focuses on the global variables.
If a global core file directory is enabled, core files can be distinguished from one another by using the following variables:
Executable file directory name, up to a maximum of MAXPATHLEN characters
Executable file name, up to a maximum of MAXCOMLEN characters
Effective group ID
The process clearance in internal format (atohexlabel "($plabel)")
Machine name (uname -m)
System node name (uname -n)
Process ID
Decimal value of time(2)
Effective user ID
Name of the zone in which the process executes (zonename)
Literal %
For example, suppose /var/share/cores/core.%f.%p is set as the global core file path. If a sendmail process with PID 12345 terminates abnormally, it would produce /var/share/cores/core.sendmail.12345 as the core file.
You can improve the performance of core file dumping on a system by excluding some parts of the binary image of a process from the core dump. When you use the coreadm command to customize your core dump specifications, you could specify exclusion of, for example, Deployment Image Servicing and Management (DISM) mappings, or Intimate Shared Memory (ISM) mappings, or System V shared memory from a core dump. For more information, see the coreadm(8) man page.