I have a friend who has a Mac (Mojave) that recently ran out of space. I found that the space was being used by files in the /cores folder. I deleted them and used to the command sudo launchctl limit core 0 0 to turn off the creation of the files. But somehow the crash dump got turned back on and the HDD was full again. Now I'm curious as to what created the core dump.

How do a go about reading a core.xxx file when I don't know which program is crashing?

Can I identify the crashing application from the core dump?


The handling of coredumps has changed on Mojave, so you cannot use "otool -c" as you did on older macOS versions. Instead you open the Terminal and run the following command:

lldb -c /cores/core.12345

where 12345 needs to be replaced by the actual filename of your coredump file.

When lldb has started up, you'll get an (lldb) prompt, where you enter the following command:

target list

Then you should be shown which program crashed. For example like this:

(lldb) target list
Current targets:
* target #0: /usr/local/bin/emacs ( arch=x86_64-*-*, platform=host, state=stopped )

In this case the crashed program was "emacs" in the folder /usr/local/bin.

  • Hello,I've tried running this command but I get back target #0: <none> (platform=host). Any other suggestions? For some context, I'm getting infinite loop of core dumps, from the moment I login (unless in safe mode), until I run out of disk space
    – Dogoku
    Feb 28 '20 at 8:49
  • Turns out had to run with sudo to see the target
    – Dogoku
    Feb 28 '20 at 9:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .