Why is /proc/kcore so big?

  • 7004153
  • 11-Aug-2009
  • 30-Apr-2012


SUSE Linux


When you browse through the file system you see a huge file named kcore. What is this file for?


Like all other files below /proc the kcore file is only a virtual file. It contains the RAM the kernel can allocate. Therefore this should not be touched or read. It is nothing to worry about. This file doesn't use actual disk space and only exists virtually.

Note: On 64-bit systems the size of /proc/kcore is even 128TB because that's the absolute limit of what 64-bit systems can allocate.

Additional Information

Some services like NTP have these files below their respective directories as well. For example /var/lib/ntp/proc/kcore

Certain services run in a so-called change root (short chroot) environment. This is done mainly for security reasons. The chroot environment means that the service only sees the files below a certain directory. For NTP this is /var/lib/ntp. NTPs root in this case is /var/lib/ntp. Since it might need access to certain files below /proc/ it mounts /proc below its own root file system again. You can see that when you use the command 'mount' and you will see a line like this:

/proc on /var/lib/ntp/proc type proc (ro)