/proc/kcore a little big :|

Luciano Miguel Ferreira Rocha strange at nsk.no-ip.org
Fri Feb 13 14:19:10 UTC 2004


On Fri, Feb 13, 2004 at 08:49:42AM -0500, Raphael wrote:
> Hello
> 
> This morning running tripwire, I see /proc/kcore modified. Considering I did 
> not know this file, I go see and try to edit it to see. God ! 
> 
> ------------
> -r--------    1 root     root     951070720 Feb 13 08:48 kcore
> ------------
> 
> What this file contain? The 951mo is stable but it is modified every minute.

The memory of your system, in ELF core format. It's a virtual file, by
reading from it or writing to it you're accessing directly the memory of
your system (RAM, so to speak). No space is wasted on your harddisk by
that or any file in /proc.

Read the manual page for proc for more information (man proc).

Regards,
Luciano Rocha





More information about the fedora-list mailing list