Why is /proc/kcore so big?

This document (7004153) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux

Situation

When you browse through the file system you see a huge file named kcore. What is this file for?

Resolution

Like all other files below /proc the kcore file is only a virtual file. It contains the RAM the kernel can allocate. Therefore this should not be touched or read. It is nothing to worry about. This file doesn't use actual disk space and only exists virtually.

Note: On 64-bit systems the size of /proc/kcore is even 128TB because that's the absolute limit of what 64-bit systems can allocate.

Additional Information

Some services like NTP have these files below their respective directories as well. For example /var/lib/ntp/proc/kcore

Certain services run in a so-called change root (short chroot) environment. This is done mainly for security reasons. The chroot environment means that the service only sees the files below a certain directory. For NTP this is /var/lib/ntp. NTPs root in this case is /var/lib/ntp. Since it might need access to certain files below /proc/ it mounts /proc below its own root file system again. You can see that when you use the command 'mount' and you will see a line like this:

/proc on /var/lib/ntp/proc type proc (ro)

Disclaimer

This Support Knowledgebase provides a valuable tool for NetIQ/Novell/SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.

Document ID:7004153
Creation Date:11-AUG-09
Modified Date:30-APR-12
- NovellOpen Enterprise Server
- SUSESUSE Linux Enterprise Desktop
  SUSE Linux Enterprise Point of Service
  SUSE Linux Enterprise Real Time Extension
  SUSE Linux Enterprise Server

Did this document solve your problem? Provide Feedback