inside the mind of a linux admin

Finding & Deleting Linux Core Dump Files Safely

Linux sometimes dumps a huge file when a script crashes. These core files can build up and eat away valuable disk space. Some other methods of deleting core files will damage your server. Here are a few simple commands I use to find and delete these core dump files safely.

Deleting files on Linux can be dangerous – one wrong character can destroy important files. I read a few other methods of removing core files that will potentially delete important files while leaving the core dumps on disk. Do not use these methods. The problem is that they are looking for files named “core” with no extension. If you do this you’re just trashing system files and leaving the dump files behind.

Linux core dump file names look like “core.4324″ – they have a three or four digit number as the extension. If your system has a different core dump format you’ll need to adjust these commands. We need a reliable way to find these files and only these files. We will need to find file names with the following criteria:

  • Must be a file – not a directory
  • Must begin with “core.”
  • Must have an extension of exactly four numbers
  • Linux find is a powerful tool, and with a little regular expression magic we can tackle all of these at once. Before deleting anything, we should do a test run with find to make sure we are not catching anything unwanted. Run the following find command to locate all core dump files in the current directory and all subdirectories.

    find . -type f -regex “.*/core\.[0-9][0-9][0-9][0-9]$”

    The regex in the above command matches the file name “core.xxxx” where “xxxx” is exactly four numbers 0-9. If the results look correct, we can delete all those dump files with the following command.

    If your core files are dumping with three numbers, or five numbers, you will want to add another [0-9] or remove a [0-9] expression accordingly.

    If you’ve seen your results, and you want them gone, go ahead and execute this:

    find . -type f -regex “.*/core\.[0-9][0-9][0-9][0-9]$” -exec rm {} \;

    The one downfall of this method is that it’s slower, since regular expressions take time to process. But this is a small price to pay for getting rid of these files in large numbers safely. If you see any errors with the above code or have any experiences to share please leave a comment below.

    Related Posts

    synergy: How to enable crypto (encryption) and generate SSL certificate

    The newer Linux versions of the popular mouse/keyboard sharing application “synergy” now has built in encryption. Here’s how to configure it: Just simply passing the –enable-crypto flag on your synergy server without having a proper SSL certificate will result in the inability to connect to clients and generate an error message similar to this in […]

    Read More

    Change Number Pad Delete (dot) key from a comma in Ubuntu Linux

    I recently purchased a new keyboard and updated to the latest Ubuntu, I’m also an avid user of the number pad for quick input when dealing with spreadsheets or accounting. I found that my num pad’s delete key (“.”) was outputting a comma (“,”) instead. Pretty annoying? I agree, but this can be very easily […]

    Read More

    2 Comments

    • David Ramirez on Thursday, July 12, 2012

      Something like:
      core[0-9]{3-5}
      would match string any like:
      core123 core1234 core12345
      but not
      core core1 core2 core123456 coreabc …

    • A on Tuesday, December 13, 2016

      Or set kernel.core_pattern to e.g. /var/crash/core.%e.%p.sig-%s so that core dumps don’t get scattered across the file system but will all land in /var/crash. The above is for Linux, for Solaris coreadm can be used instead.

    Leave a Reply

    Your email address will not be published. Required fields are marked *

    This site uses Akismet to reduce spam. Learn how your comment data is processed.

    Tweeter button Facebook button Myspace button