How I can determine that core.<pid> file generation started/finished?


You can put an inotify watch in the directory that will contain the core file. Demonstration:

/tmp$ { ulimit -c unlimited; exec sleep 9999; } &
[1] 25646
/tmp$ kill -QUIT %1                              
[1]  + 25646 quit (core dumped)  { ulimit -c unlimited; exec sleep 9999; }

And in another terminal:

$ inotifywait -e close_write /tmp
Setting up watches.
Watches established.

That last line, reporting a CLOSE_WRITE event, is emitted when the core file is fully written.

Alternatively, Linux lets you customize the generation of core files. This is a system-wide setting and requires root access, so it may or may not suit your scenario. You do this by setting the kernel.core_pattern ioctl to point to a program that will receive the core content on standard output. A toy program could be

cat >"/var/cores/$1-$2-$3.core"
# Do whatever you want now that the core file has been written
echo "/var/cores/$1-$2-$3.core" | mail -s "$4 dumped core" denys

in /usr/local/sbin/my_core_dumper, registered with

sysctl kernel.core_pattern='|/usr/local/sbin/my_core_dumper %t %P %e %E'

I am not sure if there is "hook"to determine this but, unless it is a OS core dump, it is done in an instant. The moment you see core file, it is finished dumping, in my experience. If something is taking a long time to dump core or any other file for that matter, I usually check the file size in 5 second intervals in a loop and when it has not increased in the 3 or 4 iterations, I can safely assume it is done.

I know this is not what you are looking for but it is a practical workaround, in the lack of another solution.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.