Answers to related questions all suggest using lsof or checking under /proc/NPID/, which is not helpful for when the process is already gone and only its core-dump remains.

However, it should be possible to obtain the file-descriptors opened by the late process, along with the filesystem-identifier(s) and inode-number for each.

I realize, this is OS-specific, but I only need it for (modern) Linux... I suppose, it needs to be a script fed to gdb, but what are the global symbols to look for?

  • What led to to your declaration that this is possible, upon which premise you are basing the question?
    – JdeBP
    Jun 22, 2018 at 18:06
  • 1
    @JdeBP, I'm fairly certain, opened file-descriptors are listed in the process' memory somewhere, and gdb should be able to print them. Even if the descriptors themselves aren't available, the stdio data-structures (the FILE structures) certainly are -- if stdio is used, that is...
    – Mikhail T.
    Jun 22, 2018 at 20:48
  • So you did not get this idea from any doco, then? I hope not. Such doco would need correction. (-:
    – JdeBP
    Jun 24, 2018 at 23:30
  • I don't think this is possible. The core dump just contains file descriptor numbers, the translation to FSID and inode comes from the kernel's file table. And what about things like pipes and sockets -- the endpoints of these no longer exist.
    – Barmar
    Jun 28, 2018 at 16:59
  • I only care for the "real" files, actually -- are you sure, FSIDs and inums aren't in the core somewhere?
    – Mikhail T.
    Jun 28, 2018 at 19:37


You must log in to answer this question.

Browse other questions tagged .