Re: [PLUG] What is /proc/kcore

[Toby DiPasquale <toby@cbcg.net>]

Paul wrote:
> OK, so how do we find out how much memory is being used to hold kcore, 
> which represents, in my case, 320MB of RAM?

/proc/kcore itself uses just as much memory as any other /proc entry, which is 
exactly sizeof( struct proc_dir_entry). This is negligable and kcore is 
required for Linux to operate properly (see below).

kcore's purpose is to allow you to debug the kernel while it is running. From 
linux-2.4.20/Documentation/Configure.help:

Kernel core (/proc/kcore) format
CONFIG_KCORE_ELF
  If you enabled support for /proc file system then the file
  /proc/kcore will contain the kernel core image. This can be used
  in gdb:

  $ cd /usr/src/linux ; gdb vmlinux /proc/kcore

  You have two choices here: ELF and A.OUT. Selecting ELF will make
  /proc/kcore appear in ELF core format as defined by the Executable
  and Linking Format specification. Selecting A.OUT will choose the
  old "a.out" format which may be necessary for some old versions
  of binutils or on some architectures.

  This is especially useful if you have compiled the kernel with the
  "-g" option to preserve debugging information. It is mainly used
  for examining kernel data structures on the live kernel so if you
  don't understand what this means or are not a kernel hacker, just
  leave it at its default value ELF.

/proc/kcore can only be removed if you disable the proc filesystem, which will 
break almost everything else related to administering a Linux system. You'd do 
well to leave kcore alone and move on to other, more likely, locations in 
which to reduce RAM usage.

--
Tobias DiPasquale
88FA 30C9 1E63 CFE2 CBD8  37C4 DA1C E2BF 1D26 F036
http://cbcg.net/

_________________________________________________________________________
Philadelphia Linux Users Group        --       http://www.phillylinux.org
Announcements - http://lists.netisland.net/mailman/listinfo/plug-announce
General Discussion  --   http://lists.netisland.net/mailman/listinfo/plug