5

Debugging information (core dumps) gets saved to /cores (information on what was happening when app 'x' crashed). These files can take up a huge amount of space - I have manually removed them several times recovering 3-10GB each time, to no ill effect, with sudo rm -f /cores/*.

Some recommend disabling core dumps entirely by adding

kern.coredump=0

to /etc/sysctl.conf.

Would there be any harm in doing so? Seems like something only the app developer would use.

1 Answer 1

6

No, disabling Core Dumps will not cause any problems, as you've said, it is meant for developers and IT Managers. Apple, in a Technical Note, says:

There are a number of circumstances in which the ability to capture a kernel core dump is useful.

  • When you're writing a kernel extension and you encounter a kernel panic, you can usually debug the problem with the two-machine kernel debugger. However, there are circumstances where this isn't possible. For example, if a tester or end user reports a problem that you can't reproduce on your desktop—either because it happens infrequently or because it only happens with obscure hardware or in a non-standard environment—you will not be able to debug using the standard tools. In these circumstances it's helpful if you can capture a core dump of the panicked kernel and debug using that core dump.

  • If you manage a large group of Macintosh computers, you might want to monitor which computers are panicking and why. You can use this information to determine how frequently kernel panics occurs, whether there are any common symptoms, and, most importantly, whether any third party kernel extensions are involved.

  • Finally, if you manage a high-availability Macintosh server and you have problems with the server panicking, you can capture a kernel core dump, immediately restart the server, and then debug the problem offline.

There's even a good reason not to keep them, as the Core Dumps may contain sensitive data, which an attacker could use in a nefarious way.

1
  • Reassuring, thanks - and had just come across another reference to sensitive data insecurity with dumps! Disabled it is.
    – Simbamangu
    Jan 31, 2013 at 13:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .