Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When I SSH into an instance of a CentOS server, I notice that these files like this are created:

11714560 Sep 14 02:18 core.1084

Does anyone know what these are, and perhaps why this is happening?

share|improve this question
add comment

5 Answers

up vote 2 down vote accepted

I have the same problem on a CPanel setup. In my case, running

strings core.nnnn | less

shows that the problem can be traced to an errant Perl command. This is the offending section of /etc/bashrc (found by grep'ing for perl in startup scripts):

if [ "$LOCALLIBUSER" != "root" ]; then
    eval $(perl -Mlocal::lib)
fi

If I try running eval $(perl -Mlocal::lib) at the console, it dumps core, so this is definitely the problem.

This is common enough that a quick google search turned up this thread, which doesn't offer much advice other than checking the perl modules.

share|improve this answer
    
perl -Mlocal::lib, is what is causing the dump. I'm also using CPanel. I'm considering either debugging via GDB, or simply removing the command from my bash script. How did you resolve it? –  indi Sep 23 '12 at 20:49
add comment

Core files are signs of a core dump. It means the program has crashed and you have this core dump of the programs' memory at the time of dump.

You can prevent it if you put 'ulimit -c 0' into sysconfig - you won't get core files. But you should also first check out what is crashing and why - you may have a serious problem there.

Read more at http://aplawrence.com/Linux/limit_core_files.html

share|improve this answer
add comment

Command:

gdb -c core.1084 

will explain which process has crashed and why.

Perhaps there's some GUI program that is set up to run automatically in your .bashrc, which crashes when it has no access to running X server.

share|improve this answer
add comment

zladuric already explained you the core files.

Perhaps you have something which crashes auto-running every time for example in ~/.bashrc or ~/.profile files?

share|improve this answer
add comment

Check file core.1084 — if it is a sshd that is crashing it may be a rootkit, which replaced your original sshd binary or some library used by sshd.

This is a crude script for verifying that a binary and libraries it uses checksums are consistent with rpm database:

#!/bin/bash

{
  echo "$1"
  cd /lib
  ldd "$1" | cut -d ' ' -f 1 | xargs rpm -qf
  cd /usr/lib
  ldd "$1" | cut -d ' ' -f 1 | xargs rpm -qf
} 2>/dev/null | sort -u | xargs rpm -V
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.