topic Re: trying to write a ksh script to remove core files from / in Operating System - HP-UX

trying to write a ksh script to remove core files from /

PamelaJThrasher — Mon, 30 Nov 2009 19:56:59 GMT

Occasionally, my hpux 11.31 server drops a core file and fills up / which makes it impossible for me to get on to the server.

I would like to write a script to remove any core files in / (and only /) that would be executed automatically by our monitoring software when root fills up.

I have been playing around with the find command but have not been sucessful in limiting that to searching only /.

Any suggestions?

Re: trying to write a ksh script to remove core files from /

James R. Ferguson — Mon, 30 Nov 2009 20:02:38 GMT

Hi Pamela:

If you truly want to limit your 'find' to the '/' filesystem you need to use '-xdev' which keeps 'find' from crossing mountpoints:

# find / -xdev -type f -name core -exec rm {} +

Regards!

...JRF...

Re: trying to write a ksh script to remove core files from /

PamelaJThrasher — Mon, 30 Nov 2009 20:04:54 GMT

I should have been more specific.

I want to keep it to just the root directory not just the root file system.

Re: trying to write a ksh script to remove core files from /

James R. Ferguson — Mon, 30 Nov 2009 20:33:53 GMT

Hi (again) Pamela:

Try this:

# cd / && find . -xdev -path "./*" -prune -name core -type f -exec ls -ld {} +

If this is satisfactory, change the 'ls -ld' to 'rm'.

Regards!

...JRF...

Re: trying to write a ksh script to remove core files from /

Tingli — Mon, 30 Nov 2009 20:40:15 GMT

If it is in root directory only, then you can
#! /usr/bin/ksh
if [[ -f /core ]]
then
rm /core
fi

Re: trying to write a ksh script to remove core files from /

TTr — Mon, 30 Nov 2009 20:45:07 GMT

> I want to keep it to just the root directory not just the root file system

Why use the find commnad to find the core file in the / directory? What's wrong with "rm /core" or "ls /core"?

If you want to prevent programs from generating core files in /, you can use the "ulimit -H -c 0" command in ksh (put in in /etc/profile or /.kshrc if it exists.

Re: trying to write a ksh script to remove core files from /

Dennis Handly — Mon, 30 Nov 2009 21:14:58 GMT

>TTr: If you want to prevent programs from generating core files in /,

Or simply: mkdir /core

Re: trying to write a ksh script to remove core files from /

D. Jackson_1 — Mon, 30 Nov 2009 23:34:59 GMT

I agree with Dennis.

Just make a directory and chmod 000 on it.

Re: trying to write a ksh script to remove core files from /

Bill Hassell — Tue, 01 Dec 2009 01:47:32 GMT

Probably the best way to control core files is to first identify the process(es) that created them. Then within the environment that the process runs (ie a startup script), set ulimit -c 0 which eliminates core files no matter where the process moves during execution.

By the way, if the process actually creates a /core file (and not /etc/core or some other directory in the / filesystem), I would definitely change the environment of the program. The / directory is (should always be) 755 owned by root which means that the process can create (or remove) files in / -- not a good thing all. The program is already crashing. Another mistake in the program could remove all files in /. That could destroy your entire system.

Re: trying to write a ksh script to remove core files from /

Tor-Arne Nostdal — Tue, 01 Dec 2009 07:57:04 GMT

:) just be a bit careful with the statement from D. Jackson....
It is the new directory named core (that Dennis Handly mentioned), which you could run the chmod command on - by all means NOT the / itself - that would down your system ;)

Anyway... it is not needed to do any chmod command on the directory, so the proposal is obsolete.
----------

Trashing core-files like this should always be considered as a temporary fix. You should try to get rid of the core reason why these core files appear.

To identify which program that dumped the core file, you could simply use:
file /core
Normally you will get the name of the program and the interrupt signal (reason) why it dumped (see: man 5 signals)
This is at least a good starting point for investigating the root-cause without analyzing the dump completely.

Best regards
/2r

Re: trying to write a ksh script to remove core files from /

Arturo Galbiati — Tue, 01 Dec 2009 09:21:28 GMT

Hello Pamela,
1) # Limit the core file to 1G.
ulimit -c $((1024*1024*2))

2) # Seek and show core dump files
find / -name core -type f -exec echo "\n" \; -exec file {} \; -exec what {} \;

3) #remove
find / -name core -type f -exe rm -f {} \;

HTH,
Art

Re: trying to write a ksh script to remove core files from /

PamelaJThrasher — Tue, 01 Dec 2009 13:29:25 GMT

Thanks for all the replies.

I would love to find out what process is dropping the core file and fix the cause of the problem. The difficulty with that has been that it happens sporadically and when it does, it filled root so I could not get on the server to do any investigation.

I think I will try to limit the size of the core file so that it will not fill root the next time this happends. This will allow me do get in and find out what is going on.

Thanks again!
Pam

Re: trying to write a ksh script to remove core files from /

Larry Klasmier — Tue, 01 Dec 2009 17:06:45 GMT

Here is another thought. Create a symbolic link in / for the core file to a file system that has enough space to contain the entire core file. This way you can capture the entire core file for analysis.

Re: trying to write a ksh script to remove core files from /

Robert Herron — Tue, 01 Dec 2009 18:21:58 GMT

Be careful what "core" files you remove.

There is a kernel module in HP-UX 11.31 PA-RISC named core (/usr/conf/mod/core). If you remove it, you will not be able to compile a kernel. Ignite recovery tapes will fail if the tapes was created without this core module on the server.

Re: trying to write a ksh script to remove core files from /

PamelaJThrasher — Tue, 01 Dec 2009 18:23:53 GMT

Thanks. All my 11.31 servers are Itanium. I will still be careful.

Re: trying to write a ksh script to remove core files from /

Dennis Handly — Wed, 02 Dec 2009 03:23:41 GMT

>Pamela: All my 11.31 servers

With 11.31, you can use coreadm(1m) to redirect or disable core files for all processes.
http://docs.hp.com/en/B2355-60130/coreadm.1M.html

Re: trying to write a ksh script to remove core files from /

PamelaJThrasher — Wed, 02 Dec 2009 13:14:31 GMT