From cc4419ed929b5c7c99eaed020b015b1b2e8c7a66 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sat, 25 Feb 2017 17:29:14 -0500 Subject: coredumpctl,man: mark truncated messages as such in output Unit systemd-coredump@1-3854-0.service is failed/failed, not counting it. TIME PID UID GID SIG COREFILE EXE Fri 2017-02-24 11:11:00 EST 10002 1000 1000 6 none /home/zbyszek/src/systemd-work/.libs/lt-Sat 2017-02-25 00:49:32 EST 26921 0 0 11 error /usr/libexec/fprintd Sat 2017-02-25 11:56:30 EST 30703 1000 1000 - - /usr/bin/python3.5 Sat 2017-02-25 13:16:54 EST 3275 1000 1000 11 present /usr/bin/bash Sat 2017-02-25 17:25:40 EST 4049 1000 1000 11 truncated /usr/bin/bash For info and gdb output, the filename is marked in red and "(truncated)" is appended. (Red is necessary because the annotation is hard to see when running under a pager.) Fixed #3883. --- man/coredumpctl.xml | 55 +++++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 53 insertions(+), 2 deletions(-) (limited to 'man/coredumpctl.xml') diff --git a/man/coredumpctl.xml b/man/coredumpctl.xml index 5204db4073..2c657fed03 100644 --- a/man/coredumpctl.xml +++ b/man/coredumpctl.xml @@ -154,6 +154,57 @@ matching specified characteristics. If no command is specified, this is the implied default. + The output is designed to be human readable and contains list contains + a table with the following columns: + + + TIME + The timestamp of the crash, as reported by the kernel. + + + + + PID + The identifier of the process that crashed. + + + + + UID + GID + The user and group identifiers of the process that crashed. + + + + + SIGNAL + The signal that caused the process to crash, when applicable. + + + + + COREFILE + Information whether the coredump was stored, and whether + it is still accessible: none means the the core was + not stored, - means that it was not available (for + example because the process was not terminated by a signal), + present means that the core file is accessible by the + current user, journal means that the core was stored + in the journal, truncated is the + same as one of the previous two, but the core was too large and was not + stored in its entirety, error means that the core file + cannot be accessed, most likely because of insufficient permissions, and + missing means that the core was stored in a file, but + this file has since been removed. + + + + EXE + The full path to the executable. For backtraces of scripts + this is the name of the interpreter. + + + It's worth noting that different restrictions apply to data saved in the journal and core dump files saved in /var/lib/systemd/coredump, see overview in @@ -223,9 +274,9 @@ MATCH - General journalctl predicates (see + General journalctl predicate (see journalctl1). - Must contain an equal sign. + Must contain an equals sign (=). -- cgit v1.2.1