trying to write a ksh script to remove core files from /

[PamelaJThrasher]

Occasionally, my hpux 11.31 server drops a core file and fills up / which makes it impossible for me to get on to the server.

I would like to write a script to remove any core files in / (and only /) that would be executed automatically by our monitoring software when root fills up.

I have been playing around with the find command but have not been sucessful in limiting that to searching only /.

Any suggestions?

[James R. Ferguson]

Hi Pamela:

If you truly want to limit your 'find' to the '/' filesystem you need to use '-xdev' which keeps 'find' from crossing mountpoints:

# find / -xdev -type f -name core -exec rm {} +

Regards!

...JRF...

[PamelaJThrasher]

I should have been more specific.

I want to keep it to just the root directory not just the root file system.

[James R. Ferguson]

Hi (again) Pamela:

Try this:

# cd / && find . -xdev -path "./*" -prune -name core -type f -exec ls -ld {} +

If this is satisfactory, change the 'ls -ld' to 'rm'.

Regards!

...JRF...

[Tingli]

If it is in root directory only, then you can
#! /usr/bin/ksh
if [[ -f /core ]]
then
rm /core
fi

[TTr]

> I want to keep it to just the root directory not just the root file system

Why use the find commnad to find the core file in the / directory? What's wrong with "rm /core" or "ls /core"?

If you want to prevent programs from generating core files in /, you can use the "ulimit -H -c 0" command in ksh (put in in /etc/profile or /.kshrc if it exists.

[Dennis Handly]

>TTr: If you want to prevent programs from generating core files in /,

Or simply: mkdir /core

[D. Jackson_1]

I agree with Dennis.

Just make a directory and chmod 000 on it.

[Bill Hassell · Accepted solution]

Probably the best way to control core files is to first identify the process(es) that created them. Then within the environment that the process runs (ie a startup script), set ulimit -c 0 which eliminates core files no matter where the process moves during execution.

By the way, if the process actually creates a /core file (and not /etc/core or some other directory in the / filesystem), I would definitely change the environment of the program. The / directory is (should always be) 755 owned by root which means that the process can create (or remove) files in / -- not a good thing all. The program is already crashing. Another mistake in the program could remove all files in /. That could destroy your entire system.

[Tor-Arne Nostdal]

:) just be a bit careful with the statement from D. Jackson....
It is the new directory named core (that Dennis Handly mentioned), which you could run the chmod command on - by all means NOT the / itself - that would down your system ;)

Anyway... it is not needed to do any chmod command on the directory, so the proposal is obsolete.
----------

Trashing core-files like this should always be considered as a temporary fix. You should try to get rid of the core reason why these core files appear.

To identify which program that dumped the core file, you could simply use:
file /core
Normally you will get the name of the program and the interrupt signal (reason) why it dumped (see: man 5 signals)
This is at least a good starting point for investigating the root-cause without analyzing the dump completely.

Best regards
/2r

[Arturo Galbiati]

Hello Pamela,
1) # Limit the core file to 1G.
ulimit -c $((1024*1024*2))

2) # Seek and show core dump files
find / -name core -type f -exec echo "\n" \; -exec file {} \; -exec what {} \;

3) #remove
find / -name core -type f -exe rm -f {} \;

HTH,
Art

[PamelaJThrasher]

Thanks for all the replies.

I would love to find out what process is dropping the core file and fix the cause of the problem. The difficulty with that has been that it happens sporadically and when it does, it filled root so I could not get on the server to do any investigation.

I think I will try to limit the size of the core file so that it will not fill root the next time this happends. This will allow me do get in and find out what is going on.

Thanks again!
Pam

[Larry Klasmier]

Here is another thought. Create a symbolic link in / for the core file to a file system that has enough space to contain the entire core file. This way you can capture the entire core file for analysis.

[Robert Herron]

Be careful what "core" files you remove.

There is a kernel module in HP-UX 11.31 PA-RISC named core (/usr/conf/mod/core). If you remove it, you will not be able to compile a kernel. Ignite recovery tapes will fail if the tapes was created without this core module on the server.

[PamelaJThrasher]

Thanks. All my 11.31 servers are Itanium. I will still be careful.

[Dennis Handly]

>Pamela: All my 11.31 servers

With 11.31, you can use coreadm(1m) to redirect or disable core files for all processes.
http://docs.hp.com/en/B2355-60130/coreadm.1M.html

[PamelaJThrasher]

.