3

I have a vps server with 130GB hard disk. Recently, the server is crash down, I access ssh and use dh -h, 

Filesystem            Size  Used Avail Use% Mounted on
/dev/vzfs             130G  130G   0  99% /
none                  2.0G  4.0K  2.0G   1% /dev

Then use du -sh /* I find root fold with 59GB. then du -sh /root/*, a long list with some file like 

...
43M     /root/core.7856
59M     /root/core.7859
59M     /root/core.7862
43M     /root/core.7883
43M     /root/core.7885
43M     /root/core.7889
59M     /root/core.7892
59M     /root/core.7904
43M     /root/core.7906
59M     /root/core.7913
43M     /root/core.7915
59M     /root/core.7940
59M     /root/core.7942
43M     /root/core.7947
43M     /root/core.7951
...

I access my server with fileZilla, 1204 core.* files create in recent 3 days.

So what is centos /root/core.* files? How are they created? Could I delete them without damage my server? And how to avoid them to be created again?

FIX THE PROBLEM

The problem caused by linux mail system. I changed /etc/mail/trusted-users permission in etc/mail/submit.cf line 552. then, no /root/core.* files be created again.

|improve this question
  • These look like core dump. Is your system crashing? – phoops Apr 17 '14 at 13:34
  • You might also keep a couple of core file for some post-mortem analysis, just to know what crashed so hard/often. Why is another story though ... – Ouki Apr 17 '14 at 13:39
  • @edvinas.me, Thanks, i have deleted them now i can reboot my server . how to check my system is crashing? It seems good, I can open my page, all the thing looks good. but the core.* files still created automaticly. – yuli chika Apr 17 '14 at 13:41
  • @Ouki, how to analysis them? Any log record them? How can i know ahy are they created? Thanks. – yuli chika Apr 17 '14 at 13:46
  • 1
    /var/log/messages* (dmesg being a part of them) are always a good start. Then maybe your web error log files ... – Ouki Apr 17 '14 at 13:54
7

These are so-called core dumps. Some signals' default handler besides killing the receiver of the signal is writing out the memory contents and process state at the time of death for post-mortem analysis. Unless you're planning to dissect those files you can safely remove them.

You could also inhibit the creation of core dumps by setting the appropriate resource limit to 0 (this is done by setting the core item in /etc/security/limits.conf to 0).

You should note that the fact that your system creates those files rather rapidly should alarm you that there's something not going too well because some process regularly dies in a non-intended way. This could be caused by a buggy (automatically respawning) program or be caused by more serious problems like memory defect. You might want to look into your log files and dmesg output to get a hold on that.

|improve this answer
  • thanks for your answer, which log file can i check? and if i set /etc/security/limits.conf to 0, is it safe for my server? – yuli chika Apr 17 '14 at 13:50
  • 3
    Switching off core dump generation is completely safe. But you should understand that this core dumps aren't your real problem but just a symptom. You should start looking at the files in /var/log and see if there's something logged about crashed processes. Another approach would be calling dmesg and look what the kernrel has to say (I'd guess that the offending process would have be killed by SIGBUS or SIGSEGV, at least the latter one — segmentation faults — are usually logged by the kernel). – Andreas Wiese Apr 17 '14 at 13:53
  • find something could be make the problem in maillog NOQUEUE: SYSERR(root): /etc/mail/submit.cf: line 552: fileclass: cannot open '/etc/mail/trusted-users': World writable directory – yuli chika Apr 17 '14 at 14:03
  • I would suggest fixing this disturbing "world writable directory" problem then : sudo chmod o-w /etc/mail/trusted-users. You may want to check your permissions in general, actually... – John WH Smith Apr 17 '14 at 17:15
  • And to emphasize, this is most probably not the problem you're looking for. – Andreas Wiese Apr 17 '14 at 18:05
3

They are dumps of the memory core of programs that have crashed while being run by the root user. Unless you plan on debugging them, you can delete them.

|improve this answer
  • thanks , i have deleted them, and now i can restart my server. but how are they created? Which log can i check? and how to stop them be created? – yuli chika Apr 17 '14 at 13:43
1

You can prevent the core files being created again with:

ulimit -c 0

This limits the maximum size of core files created to 0.

See bash man page for further details.

|improve this answer
0

Core dumps are crash dumps. The program file with one of the core files as argument might tell you which program keeps crashing.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.