Core

When a process receives certain signals it will exit and dump core. This is the state of the process when the signal arrived. A debugger such as gdb can be used to examine this corefile. A corefile can be called "core", "program.core" or even be configured to be written to a certain location (in FreeBSD). A program can switch off writing a corefile by setting the resource limit "core file size" (RLIMIT_CORE) to 0.

The kernel also can dump core upon a panic or when instructed to do so. It saves the corefile to swap which is then transferred upon the next boot to /var/crash, it's a good idea to have the /var filesystem big enough to accomodate the size of the physical memory of the system.

Signals that cause a process to dump core

    SIGQUIT     create core image   quit program
    SIGILL      create core image   illegal instruction
    SIGTRAP     create core image   trace trap
    SIGABRT     create core image   abort(3) call (formerly SIGIOT)
    SIGEMT      create core image   emulate instruction executed
    SIGFPE      create core image   floating-point exception
    SIGBUS      create core image   bus error
    SIGSEGV     create core image   segmentation violation
    SIGSYS      create core image   system call given invalid argument