core(4)                                                             core(4)


   NAME
         core - core image file

   DESCRIPTION
         The UNIX system writes out a core image of a process when it is
         terminated due to the receipt of some signals.  The core image is
         called core and is written in the process's working directory
         (provided it can be; normal access controls apply).  A process with
         an effective user ID different from the real user ID will not produce
         a core image.

         The core file contains all the process information pertinent to
         debugging: contents of hardware registers, process status and process
         data.  The format of a core file is object file specific.

         For ELF executable programs [see a.out(4)], the core file generated
         is also an ELF file, containing ELF program and file headers.  The
         etype field in the file header has type ETCORE.  The program header
         contains an entry for every loadable and writeable segment that was
         part of the process address space, including shared library segments.
         The contents of the segments themselves are also part of the core
         image.

         The program header of an ELF core file also contains a NOTE segment.
         This segment may contain the following entries.  Each has entry name
         "CORE" and presents the contents of a system structure:

         prstatust
               The entry containing this structure has a NOTE type of 1.  This
               structure contains things of interest to a debugger from the
               operating system's u-area, such as the general registers,
               signal dispositions, state, reason for stopping, process ID and
               so forth.  The structure is defined in <sys/procfs.h>.

         prpsinfot
               The entry containing this structure has a NOTE type of 3.  It
               contains information of interest to the ps(1) command, such as
               process status, cpu usage, "nice" value, controlling terminal,
               user ID, process ID, the name of the executable and so forth.
               The structure is defined in <sys/procfs.h>.

         COFF executable programs produce core files consisting of two parts:
         the first section is a copy of the system's per-user data for the
         process, including the general registers.  The format of this section
         is defined in the header files <sys/user.h> and <sys/reg.h>.  The
         remainder of a COFF core image represents the actual contents of the
         process data space.

         The size of the core file created by a process may be controlled by
         the user [see getrlimit(2)].



   7/91                                                                 Page 1

   core(4)                                                             core(4)


   SEE ALSO
         sdb(1), getrlimit(2), setuid(2), elf(3E), a.out(4), signal(5).
         crash(1M) in the System Administrator's Reference Manual.
         The ``Object Files'' chapter in the Programmer's Guide: ANSI C and
         Programming Support Tools.
















































   Page 2                                                                 7/91