Piping core dumps to a program
Since kernel 2.6.19, Linux supports an alternate syntax for the
/proc/sys/kernel/core_patternfile. If the first character of this file is a pipe symbol (
|), then the remainder of the line is interpreted as a program to be executed. Instead of being written to a disk file, the core dump is given as standard input to the program.
Note the following points:
The program must be specified using an absolute pathname (or apathname relative to the root directory, /), and must immediately follow the ‘|’ character.
The process created to run the program runs as user and grouproot.
Command-line arguments can be supplied to the program (since Linux2.6.24), delimited by white space (up to a total line length of 128 bytes).
The command-line arguments can include any of the % specifierslisted above. For example, to pass the PID of the process that is being dumped, specify %p in an argument.
| /path/to/myscript %p %s %c