Ever wondered what process just core dumped?

The AIX errpt command will tell you where the core file has been dumped and in most cases the program name:

# errpt -a | head -45
---------------------------------------------------------------------------
LABEL:          CORE_DUMP
IDENTIFIER:     C69F5C9B

Date/Time:       Wed Jul 22 13:41:52 EET 2009
Sequence Number: 2694
Machine Id:      00C01C704C00
Node Id:         hxaix14
Class:           S
Type:            PERM
Resource Name:   SYSPROC

Description
SOFTWARE PROGRAM ABNORMALLY TERMINATED

Probable Causes
SOFTWARE PROGRAM

User Causes
USER GENERATED SIGNAL

        Recommended Actions
        CORRECT THEN RETRY

Failure Causes
SOFTWARE PROGRAM

        Recommended Actions
        RERUN THE APPLICATION PROGRAM
        IF PROBLEM PERSISTS THEN DO THE FOLLOWING
        CONTACT APPROPRIATE SERVICE REPRESENTATIVE

Detail Data
SIGNAL NUMBER
          11
USER'S PROCESS ID:
               1646842
FILE SYSTEM SERIAL NUMBER
          19
INODE NUMBER
       18736
CORE FILE NAME
/usr/sap/SMD/J98/SMDAgent/core
PROGRAM NAME
jlaunch

But what if the AIX error report has been cleared out and all you have is the core file. How do you know who generated the core file?

Once you've found the core file, run the following command to determine what command and/or process failed:

# cd /usr/sap/SMD/J98/SMDAgent/

# lquerypv -h core 6b0 64
000006B0   7FFFFFFF FFFFFFFF 7FFFFFFF FFFFFFFF  |................|
000006C0   00000000 000007D0 7FFFFFFF FFFFFFFF  |................|
000006D0   00120000 1A7743F8 00000000 00000003  |................|
000006E0   736C6565 70000000 00000000 00000000  |jlaunch.........|
000006F0   00000000 00000000 00000000 00000000  |................|
00000700   00000000 00000000 00000000 00000027  |...............'|
00000710   00000000 00000001 00000000 00000027  |...............'|