core files

[prash_1]

Dear Gurus,

I am having HP-UX 11i.

In my system I found some core files
Some of them having size @10GB.
My question is
1) what is core files ? &
2) Can I delete them ?

[Sunny Jaisinghani · Accepted solution]

Hi Prash,

Core files eat up a lot of space of your disk. these files are created when there are core dumps.

You should regularly search such files and delete them.

find / -name core

will list all the core files. you can remove these files.

sunny

[Adisuria Wangsadinata_1]

Hi Prash,

What's the core file ?
You can check on the man page of core :

# man core

Can delete the core file ?
Yes, you can delete it. But for the best practice, I'm always check the core file first with the command below :

# file core
# strings core

If the core file generated from application (eg. oracle), I will inform to the appropriate team for this and let them to decide whether can remove this one or not.

Hope this information can help.

Cheers,
AW

[Reshma Malusare]

Hi Prash,
The operating system generates a core file when a signal is not caught by the program. The core file records the state of the program at the time that the fatal error occurred.You can use the debugger to diagnose some run-time errors after a program has aborted and produced a core file.so,if you dont want to dubug a problem you can delete the core files.
# Find / -name core

Refer following document for more details:
http://docs.hp.com/en/B3476-90015/ch08s01.html

Also,have a look on the following thread.
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1106692

If your query is solved then close the thread & reward answers with points.

Thanks & Regards
Reshma

[Eric Jacklin]

Hi paresh,

If any program or application terminated abnormally then a core file will get generated. Since this file contain lot of information which will help us to find out root cause of partial failure .

So normally these files are very big and you can remove it.
keep all latest file and delete all old file.

Please do check your system regularly for core file if core file is there then there will be some problem with your app. please does not ignore them

[Matti_Kurkela]

Be careful with "strings core"!

It will *not* tell the reason of the program crashing.

As the core dump is an exact copy of the memory area of the crashed program, it contains the program code... usually including *all* the error message texts the program might ever use.

So there is *no* guarantee that the "error message" you see in the "strings core" output is the error message that the program actually used.

Reporting the findings of "strings core" as the program's error message output will not help the developer/software support person that receives your report. Most likely, it will totally confuse him/her.

If you don't believe me, try it yourself:
use e.g. "kill -QUIT" to crash some small program. Then compare "strings core" and "strings ". You'll find the same error messages in both, and the program binary is certainly not modified by the crash.

"strings core" may be useful if you need to know something that you know is embedded in the program code, e.g. the exact version number of the crashed program.

[Dennis Handly]

>Matti: Be careful with "strings core"!

Right. This is particularly useless. While it may tell you the argv and environment, it also scares you into thinking the wrong error is occurring.

>Adisuria: # file core

You may want to record the output of file and ll on the core files. If they aren't old, and keep occurring, you may want to let someone know about the problem. If from an in house application, you should let the developers know about it.

[Johnny Damtoft]

You can find more info about the core files like this:

# man core
# strings /path/to/core
# type /path/to/core

And you can also delete the core files.
Is you have users, that happens to create the core files, without your knowledge - you can setup a cronjob to do the job for you. I did. :)

# Removal of core files (CoreDump) on the entire server, executes every Saturday at 1:15 AM. (Filesize: all)
15 1 * * 6 /usr/bin/find / -name core -type f -mtime +7 -exec /usr/bin/rm -f {} \;

or you can do it like this:

# Removal of core files (CoreDump) on the entire server, executes every Saturday at 1:15 AM. (Filesize: 15+mb)
15 1 * * 6 /usr/bin/find / -name core -type f -mtime +7 -size +15000 -exec /usr/bin/rm -f {} \;

[Johnny Damtoft]

On http://docs.hp.com there is more info.

http://docs.hp.com/en/B2355-60130/core.4.html

[prash_1]

Thanks for your valuable information
& replies.
Thanks