How to view Core file (general)
The core(5)
manpage describes the parameters affecting core dumps in detail, including their naming etc.
To answer your stated question, there is no generalisable way to find a core dump. By default, core is dumped in the process's current working directory, if the process is allowed to write there, if there's enough room on the containing filesystem, if there's no existing core dump (under some circumstances), and if the file size and core file size limits (as set by ulimit
or similar mechanisms) allow it. But /proc/sys/kernel/core_pattern
provides many different ways of processing core dumps, so you really need to look at that too and figure out what's going on.
In your case, I don't know why the core couldn't be found initially, but I do know why you stopped getting cores after setting the redirection up: when using a pipe in core_pattern
, the processing program must be specified using an absolute pathname. tee
on its own won't be used; you need to specify /usr/bin/tee
. Note that you should take particular care with this type of setup on multi-user systems, because the program run to process the core dump is run as root
.
On Debian derivatives I install corekeeper
, which writes core dumps in an easily-usable manner to per-user directories under /var/crash
.