Linux Commands

gcore Linux Command

Core files get generated when a process closes unexpectedly to act as snapshots that offer the debugging information in Linux. The core dump contains the snapshot of the memory that the closed process occupied. At times, you may need to generate the core dump manually and Linux offers the gcore command, which makes this possible.

The main function of the gcore command is to get the core images of the specified running process. This article covers the use of a process’ id to easily get its core image through gcore.

How to Use the Gcore Linux Command

The gcore command doesn’t offer a plenty of usage options. Nonetheless, you can use it differently to get the different core images for running the processes. With gcore, unlike the automatic case where the core dumps get created when running processes unexpectedly close, the running of processes is not affected by using the gcore command.

The first step to getting started with gcore is to view its man page.

$ man gcore

You will notice that only two options are provided, the -o and -a. We will use the options with the different examples to understand the command.

The basic syntax to use the gcore is:

$ gcore [-o filename] [pid]

Depending on your preference, you can combine the multiple process ids or use a single one.

There are different ways to go about getting a process id. You can use the top command which lists the running process.

In our case, we are trying to get the process id for the process top. We can see from the previous output that its PID is 9855 .

Alternatively, if you know the process name, you can use the pidof command shown in the following syntax to get its process id.

$ pidof [process-name]

Note that the two methods give the same process id.

With the process id known, we can proceed to use the gcore to get the core image for the process manually. The command is as follows:

$ sudo gcore 9855

Once the core image gets created, it gets stored in the current working directory. And, as in the previous example, we note that it was saved with an extension of the process id.

To save it with a different name, use the -o flag followed by the name that you prefer to use. For instance, let’s save the same core image as sample1.

$ sudo gcore -o filename process-id

We now have a new output file named “sample1.9855”.

Working with Multiple Processes

You can create a core image of the snapshots of different processes, provided that you have their process id. The syntax is as shown in the following:

$ gcore -o filename pid1 pid2 pidn

Note that if you don’t specify the name for the core image, gcore will create the core images using the specified process ids, like in the previous image, where it creates one core image after the other.

Here’s an example of where we specify the same name for the core image.

Note how the core images are created using the same name, linuxhint, but with a different process id to distinguish them.

Also, when running the gcore command, the super user privilege is required to allow gcore to detach itself from the specific process to avoid interrupting it even after generating its core dump.


The Linux system has a way of automatically creating the core dumps when the processes unexpectedly close to help in the debugging of the problems. However, you can still manually generate the core dump images of any running process using the gcore Linux command. The good thing with gcore is that the process won’t be affected. Instead, it keeps running even after the core image gets generated. We covered the different ways which you can play around with the gcore Linux command.

About the author

Denis Kariuki

Denis is a Computer Scientist with a passion for Networking and Cyber Security. I love the terminal, and using Linux is a hobby. I am passionate about sharing tips and ideas about Linux and computing.