Linux sometimes dumps a huge file when a script crashes. These core files can build up and eat away valuable disk space. Some other methods of deleting core files will damage your server. Here are a few simple commands I use to find and delete these core dump files safely.
Deleting files on Linux can be dangerous – one wrong character can destroy important files. I read a few other methods of removing core files that will potentially delete important files while leaving the core dumps on disk. Do not use these methods. The problem is that they are looking for files named “core” with no extension. If you do this you’re just trashing system files and leaving the dump files behind.
Linux core dump file names look like “core.4324″ – they have a three or four digit number as the extension. If your system has a different core dump format you’ll need to adjust these commands. We need a reliable way to find these files and only these files. We will need to find file names with the following criteria:
Linux find is a powerful tool, and with a little regular expression magic we can tackle all of these at once. Before deleting anything, we should do a test run with find to make sure we are not catching anything unwanted. Run the following find command to locate all core dump files in the current directory and all subdirectories.
find . -type f -regex “.*/core\.[0-9][0-9][0-9][0-9]$”
The regex in the above command matches the file name “core.xxxx” where “xxxx” is exactly four numbers 0-9. If the results look correct, we can delete all those dump files with the following command.
If your core files are dumping with three numbers, or five numbers, you will want to add another [0-9] or remove a [0-9] expression accordingly.
If you’ve seen your results, and you want them gone, go ahead and execute this:
find . -type f -regex “.*/core\.[0-9][0-9][0-9][0-9]$” -exec rm {} \;
The one downfall of this method is that it’s slower, since regular expressions take time to process. But this is a small price to pay for getting rid of these files in large numbers safely. If you see any errors with the above code or have any experiences to share please leave a comment below.
Tweet
Something like:
core[0-9]{3-5}
would match string any like:
core123 core1234 core12345
but not
core core1 core2 core123456 coreabc …
Or set kernel.core_pattern to e.g. /var/crash/core.%e.%p.sig-%s so that core dumps don’t get scattered across the file system but will all land in /var/crash. The above is for Linux, for Solaris coreadm can be used instead.