我怎样才能找出导致核心转储的程序？
How can I figure out the program that caused core dump?
我在 Mac OS X 10.10.
我注意到我的硬盘已满，因为每隔几分钟就会在 /cores:
中出现一个新的核心转储文件
$ ls -alhtr /cores
total 3551488
-rw-r--r--@ 1 saqib admin 6.0K Apr 24 12:38 .DS_Store
drwxr-xr-x 32 root admin 1.1K Aug 1 17:00 ../
-r-------- 1 saqib admin 578M Aug 1 22:36 core.35049
-r-------- 1 saqib admin 578M Aug 1 22:37 core.35202
drwxrwxr-t@ 6 root admin 204B Aug 1 22:38 ./
-r-------- 1 saqib admin 578M Aug 1 22:38 core.35438
但我不知道哪些进程正在创建这些核心文件。文件名中的数字应该代表创建它们的进程的 PID。但当然，这些进程现在已经死了。那么我怎样才能弄清楚哪个进程正在创建这些核心，以便我可以 fix/remove 它？
编辑 1
对核心文件执行 gdb -c 没有提供我需要的信息：
$ gdb -c /cores/core.35438
GNU gdb (GDB) 7.8.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-apple-darwin14.0.0".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word".
"/cores/core.35438": no core file handler recognizes format
(gdb)
编辑 2
file 好像也不行:
$ file /cores/core.35049
/cores/core.35049: Mach-O core i386
编辑 3
我使用名为 MachOView 的应用程序打开了核心文件。你可以看到它给我看的截图。我仍然无法弄清楚哪个应用程序创建了这个核心文件。
如果系统安装了gdb，您可以使用gdb -c ..命令：
gdb -c core.35049
您将得到如下输出：
GNU gdb (Ubuntu 7.9-1ubuntu1) 7.9
Copyright (C) 2015 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word".
[New LWP 2905]
Core was generated by `./a.out'.
Program terminated with signal SIGSEGV, Segmentation fault.
通过阅读，您将看到核心是由 a.out 程序生成的。
更新
使用file，也可以获得类似的信息：
$ file core
core: ELF 64-bit LSB core file x86-64, version 1 (SYSV), SVR4-style, from './a.out'
运行 控制台实用程序，在 /Applications/Utilities 中找到。在诊断和使用信息下查看用户诊断报告和系统诊断报告。每个最近的崩溃都应该有一个条目，其中包含程序名称、日期、时间和主机名。您可以单击其中的每一个以获取更多信息。
您也可以直接在文件系统中访问诊断报告。用户诊断报告在 ~/Library/Logs/DiagnosticReports/ 中，系统诊断报告在 /Library/Logs/DiagnosticReports/.
中
我只需要在 OS X 10.13 上执行此操作并使用 lldb 中的 image list 命令对我有用。
lldb -c /cores/core.45943
(lldb) target create "/cores/core.45943"
Core file '/cores/core.45943' (i386) was loaded
(lldb) image list
我在 Mac OS X 10.10.
我注意到我的硬盘已满，因为每隔几分钟就会在 /cores:
$ ls -alhtr /cores
total 3551488
-rw-r--r--@ 1 saqib admin 6.0K Apr 24 12:38 .DS_Store
drwxr-xr-x 32 root admin 1.1K Aug 1 17:00 ../
-r-------- 1 saqib admin 578M Aug 1 22:36 core.35049
-r-------- 1 saqib admin 578M Aug 1 22:37 core.35202
drwxrwxr-t@ 6 root admin 204B Aug 1 22:38 ./
-r-------- 1 saqib admin 578M Aug 1 22:38 core.35438
但我不知道哪些进程正在创建这些核心文件。文件名中的数字应该代表创建它们的进程的 PID。但当然，这些进程现在已经死了。那么我怎样才能弄清楚哪个进程正在创建这些核心，以便我可以 fix/remove 它？
编辑 1
对核心文件执行 gdb -c 没有提供我需要的信息：
$ gdb -c /cores/core.35438
GNU gdb (GDB) 7.8.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-apple-darwin14.0.0".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word".
"/cores/core.35438": no core file handler recognizes format
(gdb)
编辑 2
file 好像也不行:
$ file /cores/core.35049
/cores/core.35049: Mach-O core i386
编辑 3
我使用名为 MachOView 的应用程序打开了核心文件。你可以看到它给我看的截图。我仍然无法弄清楚哪个应用程序创建了这个核心文件。
如果系统安装了gdb，您可以使用gdb -c ..命令：
gdb -c core.35049
您将得到如下输出：
GNU gdb (Ubuntu 7.9-1ubuntu1) 7.9
Copyright (C) 2015 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word".
[New LWP 2905]
Core was generated by `./a.out'.
Program terminated with signal SIGSEGV, Segmentation fault.
通过阅读，您将看到核心是由 a.out 程序生成的。
更新
使用file，也可以获得类似的信息：
$ file core
core: ELF 64-bit LSB core file x86-64, version 1 (SYSV), SVR4-style, from './a.out'
运行 控制台实用程序，在 /Applications/Utilities 中找到。在诊断和使用信息下查看用户诊断报告和系统诊断报告。每个最近的崩溃都应该有一个条目，其中包含程序名称、日期、时间和主机名。您可以单击其中的每一个以获取更多信息。
您也可以直接在文件系统中访问诊断报告。用户诊断报告在 ~/Library/Logs/DiagnosticReports/ 中，系统诊断报告在 /Library/Logs/DiagnosticReports/.
中我只需要在 OS X 10.13 上执行此操作并使用 lldb 中的 image list 命令对我有用。
lldb -c /cores/core.45943
(lldb) target create "/cores/core.45943"
Core file '/cores/core.45943' (i386) was loaded
(lldb) image list