When I SSH into an instance of a CentOS server, I notice that these files like this are created:
11714560 Sep 14 02:18 core.1084
Does anyone know what these are, and perhaps why this is happening?
I have the same problem on a CPanel setup. In my case, running
strings core.nnnn | less
shows that the problem can be traced to an errant Perl command. This is the offending section of /etc/bashrc
(found by grep'ing for perl in startup scripts):
if [ "$LOCALLIBUSER" != "root" ]; then
eval $(perl -Mlocal::lib)
fi
If I try running eval $(perl -Mlocal::lib)
at the console, it dumps core, so this is definitely the problem.
This is common enough that a quick google search turned up this thread, which doesn't offer much advice other than checking the perl modules.
Core files are signs of a core dump. It means the program has crashed and you have this core dump of the programs' memory at the time of dump.
You can prevent it if you put 'ulimit -c 0' into sysconfig - you won't get core files. But you should also first check out what is crashing and why - you may have a serious problem there.
Read more at http://aplawrence.com/Linux/limit_core_files.html
Command:
gdb -c core.1084
will explain which process has crashed and why.
Perhaps there's some GUI program that is set up to run automatically in your .bashrc, which crashes when it has no access to running X server.
zladuric already explained you the core files.
Perhaps you have something which crashes auto-running every time for example in ~/.bashrc
or ~/.profile
files?
Check file core.1084
— if it is a sshd
that is crashing it may be a rootkit, which replaced your original sshd
binary or some library used by sshd
.
This is a crude script for verifying that a binary and libraries it uses checksums are consistent with rpm
database:
#!/bin/bash
{
echo "$1"
cd /lib
ldd "$1" | cut -d ' ' -f 1 | xargs rpm -qf
cd /usr/lib
ldd "$1" | cut -d ' ' -f 1 | xargs rpm -qf
} 2>/dev/null | sort -u | xargs rpm -V