After experiencing a DDOS attack, somehow /proc/kcore is very huge, I use a small php class to check the current disk space, and how many has been used.
It shows the following:
Total Disk Space: 39.2 GB
Used Disk Space: 98 GB
Free Disk Space: 811.6 MB
My question is, is it safe to delete the /proc/kcore file? Or is there a solution on getting it to an normal size.
The filesize of /proc/kcore is 140.737.486.266.368 bytes
I have hosted my server at DigitalOcean.
If any more information needed to know, please ask ;)
Many thanks!
Edit...
df -h returns:
Filesystem Size Used Avail Use% Mounted on
/dev/vda 40G 37G 755M 99% /
udev 993M 12K 993M 1% /dev
tmpfs 401M 224K 401M 1% /run
none 5.0M 0 5.0M 0% /run/lock
none 1002M 0 1002M 0% /run/shm
du -shx returns:
du -shx *
8.7M bin
27M boot
12K dev
6.3M etc
4.8M home
0 initrd.img
229M lib
4.0K lib64
16K lost+found
8.0K media
4.0K mnt
4.0K opt
du: cannot access `proc/3765/task/3765/fd/3': No such file or directory
du: cannot access `proc/3765/task/3765/fdinfo/3': No such file or directory
du: cannot access `proc/3765/fd/3': No such file or directory
du: cannot access `proc/3765/fdinfo/3': No such file or directory
0 proc
40K root
224K run
8.0M sbin
4.0K selinux
4.0K srv
0 sys
4.0K tmp
608M usr
506M var
0 vmlinuz
Results of lsof | grep deleted:
mysqld 1356 mysql 4u REG 253,0 0 1835011 /tmp/ib4jBFkc (deleted)
mysqld 1356 mysql 5u REG 253,0 0 1835012 /tmp/ibcE99rr (deleted)
mysqld 1356 mysql 6u REG 253,0 0 1835013 /tmp/ibrxYEzG (deleted)
mysqld 1356 mysql 7u REG 253,0 0 1835014 /tmp/ibK95UJV (deleted)
mysqld 1356 mysql 11u REG 253,0 0 1835015 /tmp/iboOi8Ua (deleted)
nginx 30057 root 2w REG 253,0 0 789548 /var/log/nginx/error.log (deleted)
nginx 30057 root 5w REG 253,0 37730323404 268273 /etc/nginx/off (deleted)
nginx 30057 root 6w REG 253,0 0 789548 /var/log/nginx/error.log (deleted)
nginx 30058 www-data 2w REG 253,0 0 789548 /var/log/nginx/error.log (deleted)
nginx 30058 www-data 5w REG 253,0 37730323404 268273 /etc/nginx/off (deleted)
nginx 30058 www-data 6w REG 253,0 0 789548 /var/log/nginx/error.log (deleted)
nginx 30059 www-data 2w REG 253,0 0 789548 /var/log/nginx/error.log (deleted)
nginx 30059 www-data 5w REG 253,0 37730323404 268273 /etc/nginx/off (deleted)
nginx 30059 www-data 6w REG 253,0 0 789548 /var/log/nginx/error.log (deleted)
4 Answers
In answer to your original question:
"Is it safe to delete the
/proc/kcorefile? Or is there a solution on getting it to an normal size."
No, it's not safe. Well, I wouldn't like to bet what would happen if you deleted it anyway!
The /proc directory is the mount point for procfs (run mount and see the output like below: )
proc on /proc type proc (rw)
procfs is a bit of dark magic; no files in it are real. It looks like a filesystem, acts like a filesystem, and is a filesystem. But not one that is stored on disk (or elsewhere).
/proc/kcore specifically is a file which maps directly to every available byte in your virtual memory ... I'm not absolutely clear on the details; the 128TB comes from Linux allocating 47ish bits of the 64bits available for virtual memory.
(There's discussion on the 128TB limit here: )
Anyway, putting aside Linux's hard-coded virtual memory limits - what we come to understand in the context of your question is this: /proc/kcore is a system file, provided by the virtual procfs filesystem, and is not a real file.
Don't delete it ;-)
Update: 2016-06-03
My answer here keeps periodically being up-voted - so I assume people are still looking for an explanation of what /proc/kcore is.
There's a helpful Wikipedia article titled Everything is a file which gives a little background. If you're really curious - take a look into the Plan9 OS.
Hopefully my original answer sufficiently explains kcore itself. I'm speculating that people reading this answer may be curious about other files in /proc too - so here are some other "interesting" examples.
/proc/sys/*is a mechanism for the user (you) to read/write details from the heart of Linux (the kernel and associated drivers etc). A cute example of a r/w item is "IP forwarding":Read:
cat /proc/sys/net/ipv4/ip_forward(0is off,1is on)Write:
echo 1 > /proc/sys/net/ipv4/ip_forwardAs with
kcore, this isn't a real file. But it acts like one. So when you write to it, you're actually changing software settings as opposed to bytes on a disk./proc/meminfoand/proc/cpuinfoare read-only. You cancatorlessthem, orfopen()from your own application. They show you details about your hardware (memory and CPU)./proc/[0-9]+are actually process IDs running on your machine! These are (IMHO) by far the coolest feature of/proc. Inside them you will find more fake files likecmdlinewhich tell you what command was used to start the process.
Finally there's some other examples of "interesting filesystems", like /proc. There are purely in-memory and "user-space" to name just two. Again these (generally speaking) do not consume any real disk space, although tools like df and ls may report real file sizes.
It's completely safe to run the command sudo rm /proc/kcore. It will just say rm: cannot remove '/proc/kcore': Operation not permitted.
All the files in /proc do not actually exist on your hard drive, so they can't be removed. Those files represent information about the system. For example, when you do ls /proc, you're asking the kernel for a list of the processes on the system. If you run ls -l /proc/22/exe, you're asking the kernel for the file path of the executable of process number 22. And so on.
Please check your log file's space. I removed all error log and access log files and my Website is running.
Use this command to check which folder is taking more space:
cd /
sudo du -sh * 2>/dev/null | sort -h
Looks like you need to clean up the disk of files that are deleted but are reserved. You can use the 'tune2fs' command with something like:
tune2fs -m 1 /dev/<drive>
This should free up the reserved block space and give you access to the privileged processes reserved disk space. Note that 1 is the percentage that will be allocated to the privileged processes afterwards, do this only if you have enough disk space for critical processes such as syslog, or ssh.
NOTE: You will never gain disk space by removing files from '/proc'. That is a virtual filesystem that has nothing whatsoever to do with space on your HDD.
