{"id": "N0WHERE:173030", "bulletinFamily": "tools", "title": "ProcDump Sysinternals Tool for Linux", "description": "ProcDump is a Linux reimagining of the classic ProcDump tool from the Sysinternals suite of tools for Windows. ProcDump provides a convenient way for Linux developers to create core dumps of their application based on performance triggers. \n\n\n\n## Requirements \n\n * Minimum OS: \n * Red Hat Enterprise Linux / CentOS 7 \n * Fedora 26 \n * Mageia 6 \n * Ubuntu 14.04 LTS \n * gdb &gt;= 7.6.1 \n * zlib (build-time only) \n\n## Usage \n \n \n Usage: procdump [OPTIONS...] TARGET\r\n OPTIONS\r\n -C CPU threshold at which to create a dump of the process from 0 to 100 * nCPU\r\n -c CPU threshold below which to create a dump of the process from 0 to 100 * nCPU\r\n -M Memory commit threshold in MB at which to create a dump\r\n -m Trigger when memory commit drops below specified MB value.\r\n -n Number of dumps to write before exiting\r\n -s Consecutive seconds before dump is written (default is 10)\r\n TARGET must be exactly one of these:\r\n -p pid of the process\r\n -w Name of the process executable\r\n \n\n### Examples \n\nThe following examples all target a process with pid == 1234 \nThe following will create a core dump immediately. \n \n \n sudo procdump -p 1234\r\n \n\nThe following will create 3 core dumps 10 seconds apart. \n \n \n sudo procdump -n 3 -p 1234\r\n \n\nThe following will create 3 core dumps 5 seconds apart. \n \n \n sudo procdump -n 3 -s 5 -p 1234\r\n \n\nThe following will create a core dump each time the process has CPU usage &gt;= 65%, up to 3 times, with at least 10 seconds between each dump. \n \n \n sudo procdump -C 65 -n 3 -p 1234\r\n \n\nThe following will create a core dump each time the process has CPU usage &gt;= 65%, up to 3 times, with at least 5 seconds between each dump. \n \n \n sudo procdump -C 65 -n 3 -s 5 -p 1234\r\n \n\nThe following will create a core dump when CPU usage is outside the range [10,65]. \n \n \n sudo procdump -c 10 -C 65 -p 1234\r\n \n\nThe following will create a core dump when CPU usage is &gt;= 65% or memory usage is &gt;= 100 MB. \n \n \n sudo procdump -C 65 -M 100 -p 1234\r\n \n\n> All options can also be used with -w instead of -p. -w will wait for a process with the given name. \n\nThe following waits for a process named ` my_application ` and creates a core dump immediately when it is found. \n \n \n sudo procdump -w my_application\n\n## Current Limitations \n\n * Currently will only run on Linux Kernels version 3.5+ \n * Does not have full feature parity with Windows version of ProcDump, specifically, stay alive functionality, and custom performance counters \n\n[  ](<https://github.com/Microsoft/ProcDump-for-Linux>)\n", "published": "2018-11-21T01:02:16", "modified": "2018-11-21T01:02:16", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://n0where.net/procdump-sysinternals-tool-for-linux", "reporter": "N0where", "references": ["https://github.com/Microsoft/ProcDump-for-Linux"], "cvelist": [], "type": "n0where", "lastseen": "2019-03-06T01:51:07", "edition": 2, "viewCount": 105, "enchantments": {"dependencies": {}, "score": {"value": 0.1, "vector": "NONE"}, "backreferences": {}, "exploitation": null, "vulnersScore": 0.1}, "toolHref": "https://github.com/Microsoft/ProcDump-for-Linux", "scheme": null, "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1645691696}}

{}