Hello,
I know this list has been rather quiet for a while... so I might as
well ask a question :-)
I've been trying to find some information on /proc/kcore and have not
been entirely successful. I know is that it is an alias to memory,
that is in ELF format, and that can be used with gdb to debug the
kernel. The `k' seems to imply that it is the kernel's memory, but
all documentation I've found states that it is the size of physical
memory plus 4KB (example below):
https://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/en-US/Referenc…
This does not seem to be the case, however, when I do a listing in
/proc/kcore on my machine (F8) which has 2 GB of memory:
ls -lh /proc/kcore
-r-------- 1 root root 897M 2008-08-01 19:05 /proc/kcore
I have confirmed the same type of results on other machines to which I
have access. I also do not seem to have the kcore.h file on my system
(and I have kernel-devel installed), since it is a zero byte file:
-rw-r--r-- 1 root root 0 2008-07-21 02:05
/usr/src/kernels/2.6.25.11-60.fc8-i686/include/config/proc/kcore.h
I am also aware of other tools that can be used to extract information
about kcore like the redhat crash utility:
http://people.redhat.com/anderson/
I am wondering why there is a discrepancy between the documentation
and the actual implementation of the /proc/kcore file? I would also
like to know where I can find more detailed information about the
kcore file besides the usual description of what it is and how to use
it for debugging.
All the best,
-Jamie Levy
