Core file reappears after being deleted

[HPOPSW]

Hello,

We have a / filesystem which has reached 100% on a HPUX server. There was a core file generated. I deleted the file and the filesystem came down to 87%. However, after some time the core file generates again making the filesystem 100% full. The file keeps on re appearing after deleting it many times. Please suggest.

[Bill Hassell · Accepted solution]

A core file is created when a program crashes. Before deleting the core file, run the file command like this:

file core

This will identify the programs that is crashing. Now you can remove the core file. Then stop the program from running -- it is not working correctly. You'll need to determine if this program is part of HP-UX or an application.

If you don't know how to stop or start this program, you can prevent the core file from being created by creating a directory called core. To do this, you must cd to the directory with the core file. Remove the core file and then make the directory:

cd /someplace (if core is in /, then cd /)
file core

(write down the program name and the signal)

rm core
mkdir core

This is just a temporary workaround. You must still get the program corrected.

[Michael Steele_2]

Hi

lsof the core file. Verify if anything is still writing to it.

If the file system has few processes attached to it then you can also fuser the file system and ps the pids attached to it.

[Dennis Handly]

Besides Bill's file(1) command, you can use gdb to get a stack trace. That might be enough to match a previous report.
On 11.31 there is coreadm(1m).

>Michael: lsof the core file. Verify if anything is still writing to it.

Typically this isn't needed since it should be written quickly, unless multiple Gigs. Also, it was finished since it was reduced to 87% after it was deleted.

[Taifur]

Hi,

Be careful what "core" files you remove.
There is a kernel module in HP-UX 11.31 PA-RISC named core (/usr/conf/mod/core). If you remove it, you will not be able to compile a kernel. Ignite recovery tapes will fail if the tapes was created without this core module on the server.

1. # Seek and show core dump files
find / -name core -type f -exec echo "\n" \; -exec file {} \; -exec what {} \;

2. #remove
find / -name core -type f -exe rm -f {} \;

Check below link ,
http://docs.hp.com/en/B2355-60130/coreadm.1M.html

Rgds//
Taifur

[HPOPSW]

Thanks all for your help. The core file was generated my midaemon. We restarted midaemon and the problem was solved.

[Bill Hassell]

midaemon is a special process to gather information from the kernel for tools like Glance. If it crashes, you will need to update to the latest version.