[root@T185 ~]# cat /etc/a.sh

ulimit -c

cd /data/coredump/

/root/a.out

cd -

[root@T185 ~]# 

) 默认情况下，core dump生成的文件名为core，而且就在程序当前目录下。新的core会覆盖已存在的core。通过修改/proc/sys/kernel/core_uses_pid文件，可以将进程的pid作为作为扩展名，生成的core文件格式为core.xxx，其中xxx即为pid

) 通过修改/proc/sys/kernel/core_pattern可以控制core文件保存位置和文件格式。例如：将所有的core文件生成到/corefile目录下，文件名的格式为core-命令名-pid-时间戳. echo "/corefile/core-%e-%p-%t" > /proc/sys/kernel/core_pattern

[root@localhost ~]# cat /proc/sys/kernel/core_pattern

|/usr/libexec/abrt-hook-ccpp %s %c %p %u %g %t e

[root@localhost ~]# service abrtd status

abrtd (pid  ) is running...

[root@localhost ~]# service abrtd stop

Stopping abrt daemon:                                      [  OK  ]

[root@localhost ~]# tail -n  /var/log/messages |grep abrt

Sep  :: localhost abrtd: Corrupted or bad directory /var/spool/abrt/ccpp----::-, deleting

Sep  :: localhost abrtd: Directory 'ccpp-2017-09-28-15:25:58-15980' creation detected

Sep  :: localhost abrt[]: Saved core dump of pid  (/opt/scorpion/KingKong/KingKong/KingKong) to /var/spool/abrt/ccpp----::- ( bytes)

Sep  :: localhost abrtd: Executable '/opt/scorpion/KingKong/KingKong/KingKong' doesn't belong to any package

Sep  :: localhost abrtd: 'post-create' on '/var/spool/abrt/ccpp-2017-09-28-15:25:58-15980' exited with

Sep  :: localhost abrtd: Corrupted or bad directory /var/spool/abrt/ccpp----::-, deleting

Sep  :: localhost abrtd: Got signal , exiting

Sep  :: localhost abrt[]: abrtd is not running. If it crashed, /proc/sys/kernel/core_pattern contains a stale value, consider resetting it to 'core'

Sep  :: localhost abrt[]: Saved core dump of pid  to /data/coredump/core. ( bytes)

[root@localhost ~]#