Note: This tip assumes that you’ve checked the filesystem for legitimate files called core before running the scripts/commands contained herein! See the bottom of this article for how to do that.

Coredumps are created when a program crashes and dumps the contents of memory at the time of the crash to disk. Left unchecked, coredumps can quickly become a problem, consuming vast amounts of disk space.

You can find and remove core dumps with a command such as:

This is fine for a quick fix, but for a longer-lasting solution you can do one of two things. If your OS/Shell support it, you can add the following line to /etc/profile for POSIX compliant shells to disable core dump generation:

(For the C shell, add the line “limit coredumpsize 0” to /etc/csh.login).

If your OS/Shell doesn’t support this, you can still tackle the problem as it happens. Most core files appear in users home directories. Running a quick script such as:

will ensure that any core file on the system is truncated to zero bytes and marked read-only, so that the core file cannot be re-created and thus will never be larger than 0 bytes. Obviously, this is a very kludgy solution, and to work efficiently, you’d need a zero byte core file in everyone’s home directory (and anywhere else on the system coredumps are found), but suffices on very old systems where ulimit isn’t available. Run from cron on a nightly basis, this can be a very useful technique on old systems.

A much more robust way of searching for and deleting core dumps is with a command like:

If you want to be cautious, then change the rm -f to rm -i.

If you’re using a system other than Solaris, you may need to modify the regex in the awk command to match whatever the output of the file command gives you when executed against a core dump.

We can see this in action here…

As you can see, it’s only removed the true core dump.