James G. Sack (jim) wrote: > Ralph wrote: >> .. > > It seems that there _ought_ to be a way to dump all memory, > but I sure don't know what it is.
AHA! ..here's something else. after attaching gdb to the process, you can force a core dump (and it doesn't even abort the process, in case you wondered) gdb attach PID > generate-core-file /tmp/coredump I have verified that the text of a unsaved email composition is present (at least in thunderbird) -- it just has to be if that really is a core dump. The coredump is pretty big, but the strings program is a nice tool for finding text in such a haystack. And at least you have a raw copy of everything that you can poke into at your leisure. It might be good to make a copy of /proc/PID/numa_maps, just in case the it might help with future examination of the core dump. Regard, ..jim -- [email protected] http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list
