Linux Core Dump Management: Detection, Analysis, and Disk Space Recovery

What Are Core Dumps?

Core dumps are memory snapshots created when a process crashes. They are invaluable for debugging but can fill disks and expose sensitive data if not managed properly.

Core Pattern Configuration

cat /proc/sys/kernel/core_pattern
# Disable: echo "" > /proc/sys/kernel/core_pattern
# systemd: echo "|/usr/lib/systemd/systemd-coredump" > /proc/sys/kernel/core_pattern

Using coredumpctl

coredumpctl list
coredumpctl info
coredumpctl dump PID > /tmp/core.dump
coredumpctl gdb  # debug latest crash

Finding Core Dumps

find / -name "core" -o -name "core.*" 2>/dev/null
du -sh /var/lib/systemd/coredump/
ls -la /var/crash/

Resource Limits

ulimit -c  # current core size limit
ulimit -c 0  # disable core dumps
ulimit -c unlimited  # enable unlimited

Automated Check with dargslan-coredump-check

pip install dargslan-coredump-check
dargslan-coredump-check