On Fri, Feb 13, 2004 at 08:49:42AM -0500, Raphael wrote: > Hello > > This morning running tripwire, I see /proc/kcore modified. Considering I did > not know this file, I go see and try to edit it to see. God ! > > ------------ > -r-------- 1 root root 951070720 Feb 13 08:48 kcore > ------------ > > What this file contain? The 951mo is stable but it is modified every minute. The memory of your system, in ELF core format. It's a virtual file, by reading from it or writing to it you're accessing directly the memory of your system (RAM, so to speak). No space is wasted on your harddisk by that or any file in /proc. Read the manual page for proc for more information (man proc). Regards, Luciano Rocha
