Note: This tip assumes that you’ve checked the filesystem for legitimate files called core before running the scripts/commands contained herein! See the bottom of this article for how to do that.
Coredumps are created when a program crashes and dumps the contents of memory at the time of the crash to disk. Left unchecked, coredumps can quickly become a problem, consuming vast amounts of disk space.
You can find and remove core dumps with a command such as:
|
|
find / -name "core" -exec rm {} \; |
This is fine for a quick fix, but for a longer-lasting solution you can do one of two things. If your OS/Shell support it, you can add the following line to /etc/profile for POSIX compliant shells to disable core dump generation:
|
|
ulimit -c 0 2>/dev/null |
(For the C shell, add the line “limit coredumpsize 0” to /etc/csh.login).
If your OS/Shell doesn’t support this, you can still tackle the problem as it happens. Most core files appear in users home directories. Running a quick script such as:
|
|
#!/bin/sh find / -name "core" -print > corelist while read corefile do cat /dev/null > $corefile chmod 444 $corefile done < corelist exit 0 |
will ensure that any core file on the system is truncated to zero bytes and marked read-only, so that the core file cannot be re-created and thus will never be larger than 0 bytes. Obviously, this is a very kludgy solution, and to work efficiently, you’d need a zero byte core file in everyone’s home directory (and anywhere else on the system coredumps are found), but suffices on very old systems where ulimit isn’t available. Run from cron on a nightly basis, this can be a very useful technique on old systems.
A much more robust way of searching for and deleting core dumps is with a command like:
|
|
find . -name "core" -type f -exec file {} \; |\ awk 'BEGIN { FS = ":" } $2 ~ /core file/ { print $1 }' | xargs rm -f |
If you want to be cautious, then change the rm -f to rm -i.
If you’re using a system other than Solaris, you may need to modify the regex in the awk command to match whatever the output of the file command gives you when executed against a core dump.
We can see this in action here…
|
|
$ sleep 100 & [3] 3244 $ kill -11 %3 $ [3] + Segmentation Fault $ ls core $ mkdir tmp $ touch tmp/core $ file tmp/core tmp/foo: empty $ find . -name "core" -type f -exec file {} \; |\ > awk 'BEGIN { FS = ":" } $2 ~ /core file/ { print $1 }' | xargs rm -f $ ls $ ls tmp core |
As you can see, it’s only removed the true core dump.