process identification

Question

Let's say i have 15 processes/daemons running in the background. let's say one of the process has dumped the core.

how could i identify which process has dumped the core.

i am using hpux!

Answer 1

1) If processes have the same name then I think you have to run them from different folders. If a process dumps a core you will get it in its folder. I don't know how you start them. If you use & to start a process then you can use $! to get PID of the last started daemon process and thus save the PID of the process in its folder. Or you can take a look at the log of your daemon in this folder and get PID of the process in this folder from there.

2) If you run different applications you can use file ./core to find out the name of the application.

Updated: 3) Have just read about this:

Run first coreadm -p core.%p.%f.%t.%n or put this command in your profile. And then if an application coredumps you will see a core file with name core.<PID>.<Application-Name>.<Timestamp>.<Server>. For example: core.29305.main.1278939422:531259.srv2-rx8

Answer 2

It can write the pid as part of the filename. I don't know what or how you start your 15 processes but it is common to store the pid. Daemons usually create their own pid file with something that identifies the instance.

Answer 3

It should be in the index file generated during the dump. HPUX 10.26 (really old) kept the dumps in:

 /var/adm/crash

You will be needing q4 or a similar tool to investigate the dump. To set the pattern as epronk suggested, you'll need coreadm. Consult the manual pages:

  man coreadm