How can the size of the core file be predicted based on for example /proc/pid/maps, /proc/pid/coredump_filter, values shown by top like VIRT RES and so on?
Generally speaking, on what does the size of the core file depend and what exactly does the file contain (which parts of virtual address space?)?
I’m a little confused by a fact that the core file may be smaller than a VIRT or a sum of all memory ranges in /proc/pid/maps, so I suspect the file to be incomplete.
Advertisement
Answer
How can the size of the core file be predicted based on for example /proc/pid/maps, /proc/pid/coredump_filter, values shown by top like VIRT RES and so on?
The upper bound is the sum of all mappings in /proc/$$/maps. However, usually read-only mappings are not saved in the core (under assumption that you will have the files that are mapped read-only available at the time when you use the core).
The lower bound is the sum of all writable mappings in /proc/$$/maps. It’s a lower bound because the kernel usually also dumps the first page of executable read-only mappings, as that’s where linker BUILD_ID ELF note is. That note allows GDB to find correct version of the executable or shared libraries used, even if the system has been updated with newer ones. core also contains a dump of registers for each thread. There is also some overhead to the ELF format itself.
VIRT and RES are usually not a good estimate: VIRT is “too big” — it contains read-only mappings, as well as pages that are mmaped into the process, but haven’t actually been paged in. RES may be too small if parts of your memory have been swapped out.
I’m a little confused by a fact that the core file may be smaller than a VIRT or a sum of all memory ranges in /proc/pid/maps, so I suspect the file to be incomplete.
As I explained above, the core being smaller than VIRT and the sum of all memory ranges in /proc/pid/maps is normal and expected.
Finally, if you really wish to find a fairly precise estimate before actually dumping the core, you may wish to study Google user-space coredumper.