coredumpctl(1)
Retrieve and analyze core dump files from the systemd journal.
Synopsis
coredumpctl [OPTIONS...] {COMMAND} [PID|COMM|EXE|MATCH]Description
coredumpctl is a tool for retrieving core dumps stored in the systemd journal. Core dumps are automatically captured by the kernel when a process crashes, and systemd's coredump handler indexes them for easy retrieval and analysis.
You can list available core dumps, extract them to files, examine metadata, or launch a debugger directly on a core dump. This is essential for post-mortem debugging of crashed applications.
Common options
| Flag | What it does |
|---|---|
-1, --one | Show only the newest core dump matching the criteria |
-n, --lines=N | Print last N lines of backtrace (default 10) |
-F, --field=FIELD | Print only the specified journal field from core dump metadata |
-o, --output=FILE | Extract core dump to specified file instead of stdout |
-S, --since=DATE | Only show core dumps since the specified date/time |
-U, --until=DATE | Only show core dumps until the specified date/time |
-r, --reverse | Reverse chronological order in list output |
-j, --json=MODE | Output as JSON (short, pretty, or off) |
-N, --no-pager | Do not pipe output through a pager |
--no-legend | Omit the legend header in list output |
Examples
Display all core dumps available in the journal with timestamps and process info
coredumpctl listExtract core dump for PID 1234 and pipe directly into gdb for immediate debugging
coredumpctl dump 1234 | gdb /usr/bin/myappShow metadata for the most recent core dump from the nginx process
coredumpctl -1 info nginxExtract the latest python3 core dump to a file named crash.core
coredumpctl -o crash.core dump /usr/bin/python3Display the last 20 lines of backtrace from the newest core dump
coredumpctl -n 20 -1 infoList all core dumps captured since January 15th, 2024
coredumpctl --since 2024-01-15 listLaunch gdb directly with the specified core dump already loaded
coredumpctl gdb 1234Show only the filenames of stored core dump files
coredumpctl -F COREDUMP_FILENAME list