> Source: [sk110535](https://support.checkpoint.com/results/sk/sk110535)

# sk110535 - "Copied binary" and "Renamed core" logs in/var/log/messages, when a process which pm (process manager) monitors crashes

| Property | Value |
|----------|-------|
| Solution ID | sk110535 |
| Date Created | 2016-03-15 |
| Last Modified | 2021-12-20 |
| Technical Level | Advanced |
| Products | Security Gateway, Security Management Server |
| Versions | R81.10 (EOS), R81 (EOS), R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- The following messages are outputted when a process which pm (process manager) monitors (ex: snmpd, routed and so on... ) crashes.  
Messages in `/var/log/messages` file:  
* kernel: do_coredump: corename = |/etc/coredump/compress.sh /var/log/dump/usermode/snmpd.[PID].core
* kernel: do_coredump: argv_arr[0] = /etc/coredump/compress.sh
* kernel: do_coredump: argv_arr[1] = /var/log/dump/usermode/snmpd.[PID].core
* pm[PID]: Reaped: snmpd[PID]
* pm[PID]: ** Copied binary /usr/sbin/snmpd to /var/tmp/snmpd-01.02.2016-052221.
* pm[PID]: ** Renamed core /var/tmp/snmpd.core to /var/tmp/snmpd.core-01.02.2016-052221.
* pm[PID]: Scheduled snmpd for +1 secs
* pm[PID]: Restarted /usr/sbin/snmpd[PID], count=1

## Cause

The meaning of "\*\* Copied binary" and "\*\* Renamed core" are the following:

When Gaia process manager (pm) detect that one of its sub processes has crashed, and core dump has been created, it will move the core dump and a copy of the process executable to */var/tmp/* directory.

This messages describe this operations.

Note that Gaia have a separated core dump manager which works before pm and keep core dumps at */var/log/dump/usermode/* directory, and only the process executable is found at */var/tmp/*.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content