Core dumps in root filesytem

[Aaron_82]

On 17 servers we had a core file fill up the root filesystem. Some servers we had to reboot because we could not log in to the system to delete. We have a ticket open with HP on what the cause of the core was but I would like to know how I can prevent this from happening again. Somebody told me that we can create a /core directory and that would prevent it from happening. Any suggestions?

[Robert-Jan Goossens · Accepted solution]

for the time being, you could create a link in / to /dev/null, at least this prevent stalling your systems.

# ln -s /dev/null/ core

Regards,
Robert-Jan

[Antonio Cardoso_1]

Aaron,
- to identify which process is creating this core file:
file /core

- then you can change start script of this process to chdir a core directory.

[Prashant Zanwar_4]

I think if it is a root process, then what would you do?
You might try identifying source of the file..(process), it can be a cron script or some startup script, you can check for fixing it..

You can create a job (cron), which will look for core file under root, and move it to some place (different than root), and leave a stamp of dir where it was and date.. YOu can keep the time you want this way and you are not risking root this way..



find / -name core -xdev -exec mv {} /var/tmp/somedir/core. \;


some script tricks can acheive this..

Thanks and good luck
Prashant

[Bill Hassell]

You find the name of the program that created the core file like this:

file /core

(assuming the core file is in /) Now until you can prevent the bad program from creating further problems, remove the core file and create a directory called /core. There are other techniques including setting ulimit -c but the directory method is the simplest.

Now since the core file is in the / directory, something is very wrong about the startup of this program. / (as you've seen) is critical to system operation so root's home as well as scripts that remain in / while running tasks are not good at all.