Environment
SUSE Linux
Situation
When you browse through the file system you see a huge file named kcore. What is this file for?
Resolution
Like all other files below /proc the kcore file is only a virtual file. It contains the RAM the kernel can allocate. Therefore this should not be touched or read. It is nothing to worry about. This file doesn't use actual disk space and only exists virtually.
Note: On 64-bit systems the size of /proc/kcore is even 128TB because that's the absolute limit of what 64-bit systems can allocate.
Note: On 64-bit systems the size of /proc/kcore is even 128TB because that's the absolute limit of what 64-bit systems can allocate.
Additional Information
Some services like NTP have these files below their respective directories as well. For example /var/lib/ntp/proc/kcore
Certain services run in a so-called change root (short chroot) environment. This is done mainly for security reasons. The chroot environment means that the service only sees the files below a certain directory. For NTP this is /var/lib/ntp. NTPs root in this case is /var/lib/ntp. Since it might need access to certain files below /proc/ it mounts /proc below its own root file system again. You can see that when you use the command 'mount' and you will see a line like this:
/proc on /var/lib/ntp/proc type proc (ro)
Certain services run in a so-called change root (short chroot) environment. This is done mainly for security reasons. The chroot environment means that the service only sees the files below a certain directory. For NTP this is /var/lib/ntp. NTPs root in this case is /var/lib/ntp. Since it might need access to certain files below /proc/ it mounts /proc below its own root file system again. You can see that when you use the command 'mount' and you will see a line like this:
/proc on /var/lib/ntp/proc type proc (ro)