core dump help— linux

Question

I'm trying to understand the core dump generation. Is the core dump generated separately for a user space application process crash and the kernel level crash? Is the ulimit -c for both kinds? Can you please clarify?

Answer 1

When a userland program crashes, it can leave a core file behind, containig a copy of the contents of the memory when it went down (the core name comes from the prehistory of computing, when memory was core). This is controlled by the ulimit(1) command, it is normally disabled as the core files are large and tend to confuse newbies. A core file can be analyzed by e.g. a debugger, together with the executable and symbol table, to find out what happened.

When the kernel crashes, it normally triggers a kernel panic. If the kernel has found some critical inconsistency, it really isn't wise to count on it bahaving sanely to write out anything. So no core gets generated, and the system goes down. Contents of registers and code surrounding the address where the problem happened is written to the console. It is a good idea to save this (e.g. take a picture) for possible later analysis.

A similar situation is the kernel Oops, when the kernel detects an inconsistency that isn't considered fatal. In that case (as in a kernel panic) contents of registers and code surrounding the address where the problem happened is written to the console, and also logged.