https://www.kernel.org/doc/Documentation/sysctl/kernel.txt shows that %e in /proc/sys/kernel/core_pattern is supposed to expand to the executable filename. However, if prctl() has been used to set a thread name, then %e will expand to that name instead. ┌(toojays@kano)─(600)─(0)─(2013 04 08 14:35:26) └─(/tmp/exe-name)─> cat /proc/sys/kernel/core_pattern core-%e.%p ┌(toojays@kano)─(601)─(0)─(2013 04 08 14:35:51) └─(/tmp/exe-name)─> cat exe-name.c #include <stdlib.h> #include <sys/prctl.h> void main (void) { char name[] = "not the exe name"; prctl(PR_SET_NAME, (unsigned long)&name, 0, 0, 0); abort(); } We would expect that running this program would result in a core file called "core-exe-name.<pid>". ┌(toojays@kano)─(602)─(0)─(2013 04 08 14:36:09) └─(/tmp/exe-name)─> ./exe-name Aborted (core dumped) However, the core file ends up being named "core-not the exe nam.<pid>". ┌(toojays@kano)─(603)─(134)─(2013 04 08 14:37:04) └─(/tmp/exe-name)─> ls core-not the exe nam.4006 exe-name exe-name.c Christoph Mathys reported this to lkml a couple of years back, but I found no follow-up, see <https://lkml.org/lkml/2011/11/17/166>.