Finding Source of a UNIX Signal from Coredump Finding Source of a UNIX Signal from Coredump unix unix

Finding Source of a UNIX Signal from Coredump


Recent-enough versions of the Linux kernel store this information in the core file. And, recent-enough versions of gdb can read it. Then you can use print $_siginfo with a core file just as you would when debugging live.


You can also read this information from core dump by eu-readelf:

$ eu-readelf --notes coredump | headNote segment of 3180 bytes at offset 0x4a0:  Owner          Data size  Type  CORE                 336  PRSTATUS    info.si_signo: 6, info.si_code: 0, info.si_errno: 0, cursig: 6    sigpend: <>    sighold: <>    pid: 28046, ppid: 3774, pgrp: 28046, sid: 3774    utime: 0.000000, stime: 0.002895, cutime: 0.000000, cstime: 0.000000    orig_rax: 35, fpvalid: 1

Note info.si_signo: 6, which means that process was killed by SIGABRT.