Where is core dumped file by handling SIGQUIT stored?

Question

From http://qr.ae/TUTxgN

SIGQUIT is the dump core signal. The terminal sends it to the foreground process when the user presses ctrl-\. The default behavior is to terminate the process and dump core, but it can be caught or ignored. The intention is to provide a mechanism for the user to abort the process. You can look at SIGINT as "user-initiated happy termination" and SIGQUIT as "user-initiated unhappy termination."

$ sleep 100
^\[1]+  Done                    nohup sleep 100
Quit (core dumped)

But I can't find the dump file in the current directory. Where is it? Thanks.

Answer 1

The general case is covered by How to view Core file (general).

This specific case is different. Your /proc/sys/kernel/core_pattern value of |/usr/share/apport/apport %p %s %c %d %P indicates that your system is set up to use Apport to handle core dumps, and that has special handling of SIGQUIT: instead of feeding the core dump into the system’s error reporting tool, it writes it to a file in the current directory, if the ulimit settings allow it, and if the binary being dumped is readable and not setuid or setgid. Look at the output of ulimit -c: if it’s 0, you won’t get a core, otherwise you will, if the size allowed by ulimit (which might be “unlimited”) is sufficient to store the core dump. Apport ensures that you don’t get partial core dumps: if the limit isn’t “unlimited”, core dumps larger than the limit are deleted once Apport realises that it’s going over the limit. The core file will be named core, possible followed by . and the process identifier (if /proc/sys/kernel/core_uses_pid is 1).