Finding & Deleting Linux Core Dump Files Safely

Posted on May 22nd, 2009 by Gabriel Harper in Servers & Security
Finding & Deleting Linux Core Dump Files Safely

Linux sometimes dumps a huge file when a script crashes. These core files can build up and eat away valuable disk space. Some other methods of deleting core files will damage your server. Here are a few simple commands I use to find and delete these core dump files safely.

Deleting files on Linux can be dangerous - one wrong character can destroy important files. I read a few other methods of removing core files that will potentially delete important files while leaving the core dumps on disk. Do not use these methods.  The problem is that they are looking for files named “core” with no extension. If you do this you’re just trashing system files and leaving the dump files behind.

Linux core dump file names look like “core.4324″ - they have a four digit number as the extension. If your system has a different core dump format you’ll need to adjust these commands. We need a reliable way to find these files and only these files. We will need to find file names with the following criteria:

  1. Must be a file - not a directory
  2. Must begin with “core.”
  3. Must have an extension of exactly four numbers

Linux find is a powerful tool, and with a little regular expression magic we can tackle all of these at once. Before deleting anything, we should do a test run with find to make sure we aren’t catching anything unwanted. Run the following find command to locate all core dump files in the current directory and all subdirectories.

Find all core dump files:

find . -type f -regex ".*/core\.[0-9][0-9][0-9][0-9]$"

The regex in the above command matches the file name “core.xxxx” where “xxxx” is exactly four numbers 0-9. If the results look correct, we can delete all those dump files with the following command.

Find and delete all core dump files:

find . -type f -regex ".*/core\.[0-9][0-9][0-9][0-9]$" -exec rm {} \;

The one downfall of this method is that it’s slower, since regular expressions take time to process. But this is a small price to pay for getting rid of these files in large numbers safely. If you see any errors with the above code or have any experiences to share please leave a comment below.


| More

One Response to “Finding & Deleting Linux Core Dump Files Safely”

  1. SECUREFILTERENGINE Says:

    Gabriel :
    I came from google, so thank you for the helpful information. I wantto let you know that the re can be simplify to be :

    find . -type f -regex “.*/core\.[0-9]*$” -exec rm -v {} \;

    * means any number from 0 - 9 repeated any number of times.

    also, yours does not work if the core file name core.22378

    Thanks,

Leave a Reply


Intavant          Servermind

©2020 Gabriel Harper. Do not use, copy or re-publish any part of this blog.