Ok to delete these?

6 réponses [Dernière contribution]
IBM1130
En ligne
A rejoint: 09/24/2020

I am cleaning up my HDD before I try to upgrade to Trisquel 12. I found these apparent coredump files in the /var directory. Is it OK to delete these? Also, why are such files accumulating? They are huge.
Thanks!

Pièce jointeTaille
Screenshot at 2026-04-15 17-46-42.png18.98 Ko
jxself
Hors ligne
A rejoint: 09/13/2010

Yes but you may also wish to look into which program is crashing and why. If you do file core.171 for example and see the name of a program which is a start.

IBM1130
En ligne
A rejoint: 09/24/2020

Ooooh. They are tmp files from Systemd, all from last February. I guess I have to switch to Devuan!

I tried to delete but no luck. In fact, I appear to have made things behave very strangely. The file size is now a question mark, but the contents are marked "empty". The file creation date is now today instead of February.

Screenshot at 2026-04-15 19-30-04.png Screenshot at 2026-04-15 21-02-39.png
jxself
Hors ligne
A rejoint: 09/13/2010

You originally found actual core dumps (e.g., core.871) which are indeed memory snapshots of crashed programs but you somehow got lost, ended up in /tmp, saw the "systemd" on some folders you couldn't delete and somehow concluded that those are systemd core dump files. But they're not.

Systemd has a security feature called PrivateTmp. For services that have this enabled (like the bluetooth, colord, and resolved services shown in the screenshot), systemd mounts a dedicated, isolated temporary space just for that service. This prevents services from snooping on or interfering with each other's temporary files.

They have "?" sizes and won't delete because they're are owned by root to enforce that security isolation. Because you're browsing with a file manager, probably running as a standard user, you're being denied access. The file manager can see the folders exist but it doesn't have the permissions to see the items inside (hence the "? items") or the permission to delete them.

Temporary files and these private directories are cleared and recreated fresh every time the system boots or the service restarts so the date says today because that's when the system was last booted or those services were last (re-)started.

You should go back to working on the core dumps. Or just delete the core dumps. But please leave those systemd folders alone. They're not core dumps but a normal functioning security feature, and the OS is protecting them from deletion.

IBM1130
En ligne
A rejoint: 09/24/2020

Thanks JXSELF, that is a great explanation. I found the real files again in /var by checking the box View Hidden Files. The file dates are February, so I think these are the real coredumps. How can I safely delete these?
Note: I am not short of disk space. My goal is just a "spring cleaning" and creation of a good backup. Then I will attempt to upgrade to Trisquel 12.

Screenshot at 2026-04-16 08-34-35.png Screenshot at 2026-04-16 09-06-08.png
jxself
Hors ligne
A rejoint: 09/13/2010

The usual process would be sudo rm /path/to/file

IBM1130
En ligne
A rejoint: 09/24/2020

Problem: The files are write protected.