Ok to delete these?
- Vous devez vous identifier ou créer un compte pour écrire des commentaires
I am cleaning up my HDD before I try to upgrade to Trisquel 12. I found these apparent coredump files in the /var directory. Is it OK to delete these? Also, why are such files accumulating? They are huge.
Thanks!
| Pièce jointe | Taille |
|---|---|
| Screenshot at 2026-04-15 17-46-42.png | 18.98 Ko |
Yes but you may also wish to look into which program is crashing and why. If you do file core.171 for example and see the name of a program which is a start.
Ooooh. They are tmp files from Systemd, all from last February. I guess I have to switch to Devuan!
I tried to delete but no luck. In fact, I appear to have made things behave very strangely. The file size is now a question mark, but the contents are marked "empty". The file creation date is now today instead of February.
You originally found actual core dumps (e.g., core.871) which are indeed memory snapshots of crashed programs but you somehow got lost, ended up in /tmp, saw the "systemd" on some folders you couldn't delete and somehow concluded that those are systemd core dump files. But they're not.
Systemd has a security feature called PrivateTmp. For services that have this enabled (like the bluetooth, colord, and resolved services shown in the screenshot), systemd mounts a dedicated, isolated temporary space just for that service. This prevents services from snooping on or interfering with each other's temporary files.
They have "?" sizes and won't delete because they're are owned by root to enforce that security isolation. Because you're browsing with a file manager, probably running as a standard user, you're being denied access. The file manager can see the folders exist but it doesn't have the permissions to see the items inside (hence the "? items") or the permission to delete them.
Temporary files and these private directories are cleared and recreated fresh every time the system boots or the service restarts so the date says today because that's when the system was last booted or those services were last (re-)started.
You should go back to working on the core dumps. Or just delete the core dumps. But please leave those systemd folders alone. They're not core dumps but a normal functioning security feature, and the OS is protecting them from deletion.
Thanks JXSELF, that is a great explanation. I found the real files again in /var by checking the box View Hidden Files. The file dates are February, so I think these are the real coredumps. How can I safely delete these?
Note: I am not short of disk space. My goal is just a "spring cleaning" and creation of a good backup. Then I will attempt to upgrade to Trisquel 12.
The usual process would be sudo rm /path/to/file
Problem: The files are write protected.

