如何找出导致核心转储的程序？

Question

我在Mac OS X 10.10上。

我注意到我的硬盘正在填满，因为每隔几分钟就会在/cores中出现一个新的核心转储文件：

$ ls -alhtr /cores
total 3551488
-rw-r--r--@  1 saqib  admin   6.0K Apr 24 12:38 .DS_Store
drwxr-xr-x  32 root   admin   1.1K Aug  1 17:00 ../
-r--------   1 saqib  admin   578M Aug  1 22:36 core.35049
-r--------   1 saqib  admin   578M Aug  1 22:37 core.35202
drwxrwxr-t@  6 root   admin   204B Aug  1 22:38 ./
-r--------   1 saqib  admin   578M Aug  1 22:38 core.35438

但我不知道哪些进程正在创建这些核心文件。文件名中的数字应该表示创建它们的进程的PID。但当然这些过程现在已经死了。那么我怎样才能确定哪个进程正在创建这些内核以便我可以修复/删除它？

编辑1

在核心文件上执行gdb -c并不能提供我需要的信息：

$ gdb -c /cores/core.35438
GNU gdb (GDB) 7.8.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-apple-darwin14.0.0".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word".
"/cores/core.35438": no core file handler recognizes format
(gdb)

编辑2

file似乎也不起作用：

$ file /cores/core.35049
/cores/core.35049: Mach-O core i386

编辑3

我使用名为MachOView的应用程序打开了核心文件。你可以看到它给我看的截图。我仍然无法弄清楚哪个应用创建了这个核心文件。

Answer 1

运行/ Applications / Utilities中的Console实用程序。查看用户诊断报告和系统诊断报告的诊断和使用信息。每个最近崩溃都应该有一个条目，包括程序名称，日期，时间和主机名。您可以单击其中每个以获取其他信息。

您也可以直接在文件系统中访问诊断报告。用户诊断报告位于〜/ Library / Logs / DiagnosticReports /中，系统诊断报告位于/ Library / Logs / DiagnosticReports /中。

Answer 2

如果系统安装了gdb，则可以使用gdb -c ..命令：

gdb -c core.35049

您将获得如下输出：

GNU gdb (Ubuntu 7.9-1ubuntu1) 7.9
Copyright (C) 2015 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word".
[New LWP 2905]
Core was generated by `./a.out'.
Program terminated with signal SIGSEGV, Segmentation fault.

通过阅读，您将看到核心是由a.out程序生成的。

UPDATE

使用file，您还可以获得类似的信息：

$ file core
core: ELF 64-bit LSB core file x86-64, version 1 (SYSV), SVR4-style, from './a.out'

Answer 3

我只需要在OS X 10.13上执行此操作，并在lldb中使用image list命令为我工作。

lldb -c /cores/core.45943
(lldb) target create "/cores/core.45943"
Core file '/cores/core.45943' (i386) was loaded
(lldb) image list