Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Debugging information (core dumps) gets saved to /cores (information on what was happening when app 'x' crashed). These files can take up a huge amount of space - I have manually removed them several times recovering 3-10GB each time, to no ill effect, with sudo rm -f /cores/*.

Some recommend disabling core dumps entirely by adding


to /etc/sysctl.conf.

Would there be any harm in doing so? Seems like something only the app developer would use.

share|improve this question
up vote 6 down vote accepted

No, disabling Core Dumps will not cause any problems, as you've said, it is meant for developers and IT Managers. Apple, in a Technical Note, says:

There are a number of circumstances in which the ability to capture a kernel core dump is useful.

  • When you're writing a kernel extension and you encounter a kernel panic, you can usually debug the problem with the two-machine kernel debugger. However, there are circumstances where this isn't possible. For example, if a tester or end user reports a problem that you can't reproduce on your desktop—either because it happens infrequently or because it only happens with obscure hardware or in a non-standard environment—you will not be able to debug using the standard tools. In these circumstances it's helpful if you can capture a core dump of the panicked kernel and debug using that core dump.

  • If you manage a large group of Macintosh computers, you might want to monitor which computers are panicking and why. You can use this information to determine how frequently kernel panics occurs, whether there are any common symptoms, and, most importantly, whether any third party kernel extensions are involved.

  • Finally, if you manage a high-availability Macintosh server and you have problems with the server panicking, you can capture a kernel core dump, immediately restart the server, and then debug the problem offline.

There's even a good reason not to keep them, as the Core Dumps may contain sensitive data, which an attacker could use in a nefarious way.

share|improve this answer
Reassuring, thanks - and had just come across another reference to sensitive data insecurity with dumps! Disabled it is. – Simbamangu Jan 31 '13 at 13:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.