5

When I SSH into an instance of a CentOS server, I notice that these files like this are created:

11714560 Sep 14 02:18 core.1084

Does anyone know what these are, and perhaps why this is happening?

Improve this question

5 Answers 5

Reset to default
2

I have the same problem on a CPanel setup. In my case, running

strings core.nnnn | less

shows that the problem can be traced to an errant Perl command. This is the offending section of /etc/bashrc (found by grep'ing for perl in startup scripts):

if [ "$LOCALLIBUSER" != "root" ]; then
    eval $(perl -Mlocal::lib)
fi

If I try running eval $(perl -Mlocal::lib) at the console, it dumps core, so this is definitely the problem.

This is common enough that a quick google search turned up this thread, which doesn't offer much advice other than checking the perl modules.

Improve this answer
1
  • perl -Mlocal::lib, is what is causing the dump. I'm also using CPanel. I'm considering either debugging via GDB, or simply removing the command from my bash script. How did you resolve it?
    – indi
    Sep 23, 2012 at 20:49
6

Core files are signs of a core dump. It means the program has crashed and you have this core dump of the programs' memory at the time of dump.

You can prevent it if you put 'ulimit -c 0' into sysconfig - you won't get core files. But you should also first check out what is crashing and why - you may have a serious problem there.

Read more at http://aplawrence.com/Linux/limit_core_files.html

Improve this answer
5

Command: 

gdb -c core.1084

will explain which process has crashed and why.

Perhaps there's some GUI program that is set up to run automatically in your .bashrc, which crashes when it has no access to running X server.

Improve this answer
2

zladuric already explained you the core files.

Perhaps you have something which crashes auto-running every time for example in ~/.bashrc or ~/.profile files?

Improve this answer
0

Check file core.1084 — if it is a sshd that is crashing it may be a rootkit, which replaced your original sshd binary or some library used by sshd.

This is a crude script for verifying that a binary and libraries it uses checksums are consistent with rpm database:

#!/bin/bash

{
  echo "$1"
  cd /lib
  ldd "$1" | cut -d ' ' -f 1 | xargs rpm -qf
  cd /usr/lib
  ldd "$1" | cut -d ' ' -f 1 | xargs rpm -qf
} 2>/dev/null | sort -u | xargs rpm -V
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .