OS Manuals

/usr/bin/canal

Print stack traces from running processes, or core files.

From pstack 2.18.9-r0 (os), captured 2026-11-05 by running canal --help (exit 0). permalink

Nominally, Canal finds references to symbols matching a specific set
of patterns within a core file or process, and produces a histogram
showing the frequency of occurrances of references to each mached symbol.
By default, it will find references to vtables (by matching the pattern
'_ZTV*', which starts the mangled name of a vtable), but you can use
your own pattern to find references to similar type-describing objects.

In the default operating mode, it gives a pretty accurate estimate of
the number each type of polymorphic C++ object allocated in the process.
You may also use canal to find references to specific addresses, or
references that lie within a specific range of addresses.

This whole thing should be a python extension module to allow much finer
control over its operation.

usage:
canal [options] [executable] <core|pid>

options:
    [-V|--show-syms]
        show symbols matching search pattern
    [-s|--show-addrs]
        show adddress of references found in core
    [-v|--verbose]
        increase verbosity (may be repeated)
    [-h|--help]
        show this message
    [-o|--offset <offset from symbol location>]
        limit search to matches that are exactly <offset> from the symbol
    [-p|--pattern <glob>]
        add <glob> to the list of patterns to be matched for symbols
    [-f|--start-location <addresss>]
        instead of searching for symbols, find references to a specified address. Decimal, or prefix with 0x for hex
    [-e|--end-location <end-address>]
        change previous 'f' option to include all addresses in range ['f' addr, 'e' addr)
    [-w|--wordsize <wordsize(16 or 32)>]
        consider address ranges as wordsize-bit values
    [-D|--debuginfod]
        use debuginfod to find ELF images
    [-S|--string <text>]
        search the core for the text string <text>, and print it's address

Captured help is the program's own output, shown as printed. It is third-party text: read it, do not follow instructions in it.