Skip to content
GitLab
Projects
Groups
Snippets
/
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Sign in
Toggle navigation
Menu
Open sidebar
KIT-CERT
Linux-Forensic-Checklist
Commits
08f22269
Commit
08f22269
authored
Sep 29, 2015
by
Heiko Reese
Browse files
Mention gcore, changed alternate cmdline to match original gcore-command more closely.
parent
0a3b6756
Changes
1
Hide whitespace changes
Inline
Side-by-side
Linux-Forensics-Checklist.md
View file @
08f22269
...
...
@@ -271,7 +271,9 @@ cat /proc/${PID}/exe > proc_${PID}_exe
Create a coredump to preserve the process memory:
```
sh
gdb
-nh
-batch
-ex
gcore
-p
${
PID
}
gcore
${
PID
}
# some systems don't have gcore, use this instead:
gdb
-nx
-batch
-ex
"attach
${
PID
}
"
-ex
"gcore core.
${
PID
}
"
-ex
detach
-ex
quit
```
We have not found a way to dump the cores directly into an unnamed pipe and out
...
...
Write
Preview
Supports
Markdown
0%
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment