Creating a core dump file for troubleshooting (Linux)

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black App Control
• Carbon Black App Control (formerly Cb Protection)
• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Enterprise EDR
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
• Carbon Black EDR
• VMware Carbon Black
• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Troubleshooting on Linux computers may sometimes require a core dump for analysis. Use these steps to generate a core dump. 

Environment

• Linux OS: All Supported Versions

Resolution

1. Find the PID of the Linux process that a core is needed:

   # pidof <process>

   Example:

   # pidof cbagentd 

2. Generate the core dump:

   # gcore -o /tmp/corefile-<process>-<MMDDYY> <PID>

   Example, if the PID value is "1234":

   # gcore -o /tmp/corefile-cbagentd-11062024 1234

3. This will create a file located at /tmp/corefile-cbagentd-11062024.1234

Additional Information

• These steps require the "gdb" package. To install using yum:

  # yum install -y gdb

• These steps can be used to cause a process to create a core dump when crashing