When I SSH into an instance of a CentOS server, I notice that these files like this are created:

11714560 Sep 14 02:18 core.1084

Does anyone know what these are, and perhaps why this is happening?


I have the same problem on a CPanel setup. In my case, running

strings core.nnnn | less

shows that the problem can be traced to an errant Perl command. This is the offending section of /etc/bashrc (found by grep'ing for perl in startup scripts):

if [ "$LOCALLIBUSER" != "root" ]; then
    eval $(perl -Mlocal::lib)

If I try running eval $(perl -Mlocal::lib) at the console, it dumps core, so this is definitely the problem.

This is common enough that a quick google search turned up this thread, which doesn't offer much advice other than checking the perl modules.

  • perl -Mlocal::lib, is what is causing the dump. I'm also using CPanel. I'm considering either debugging via GDB, or simply removing the command from my bash script. How did you resolve it? – indi Sep 23 '12 at 20:49

Core files are signs of a core dump. It means the program has crashed and you have this core dump of the programs' memory at the time of dump.

You can prevent it if you put 'ulimit -c 0' into sysconfig - you won't get core files. But you should also first check out what is crashing and why - you may have a serious problem there.

Read more at http://aplawrence.com/Linux/limit_core_files.html



gdb -c core.1084 

will explain which process has crashed and why.

Perhaps there's some GUI program that is set up to run automatically in your .bashrc, which crashes when it has no access to running X server.


zladuric already explained you the core files.

Perhaps you have something which crashes auto-running every time for example in ~/.bashrc or ~/.profile files?


Check file core.1084 — if it is a sshd that is crashing it may be a rootkit, which replaced your original sshd binary or some library used by sshd.

This is a crude script for verifying that a binary and libraries it uses checksums are consistent with rpm database:


  echo "$1"
  cd /lib
  ldd "$1" | cut -d ' ' -f 1 | xargs rpm -qf
  cd /usr/lib
  ldd "$1" | cut -d ' ' -f 1 | xargs rpm -qf
} 2>/dev/null | sort -u | xargs rpm -V

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.