title: Linux: what creates large hidden files at / at each startup?
body: <p>ALT Linux p8 (Mandriva based distro) with kernel 4.19 and systemd.
  At each startup there is a new hidden file (starting with .) at / approx. 40-50 Mb:</p>
  <pre>
  drwxr-xr-x  23 root root     2048 мар 12 13:57 .
  drwxr-xr-x  23 root root     2048 мар 12 13:57 ..
  -rw-------   1 root root 45531136 мар 12 12:24 .16726
  -rw-------   1 root root 50364416 мар 12 12:24 .894
  -rw-------   1 root root 52592640 мар 12 13:57 .963
  drwxr-xr-x   2 root root     4096 мар 11 20:15 bin
  drwx------   5 root root     2048 мар 12 13:59 boot
  drwxr-xr-x  20 root root     4340 мар 12 14:11 dev
  drwxr-xr-x 149 root root     6144 мар 12 14:09 etc
  drwxr-xr-x   4 root root     4096 дек 12  2019 home
  drwxr-xr-x  25 root root     4096 мар 11 16:32 lib
  drwxr-xr-x   6 root root     8192 мар 12 14:09 lib64
  drwx------   2 root root     2048 дек 12  2019 lost+found
  drwxr-xr-x   2 root root     2048 апр 12  2019 media
  drwxr-xr-x   7 root root     2048 мар 29  2020 mnt
  drwxr-xr-x   2 root root     2048 фев 11  2016 opt
  dr-xr-xr-x 296 root root        0 мар 12 16:57 proc
  drwx------  12 root root     2048 мар 12 14:11 root
  drwxr-xr-x  35 root root     1100 мар 12 14:57 run
  drwxr-xr-x   2 root root     6144 мар 12 14:09 sbin
  dr-xr-xr-x   2 root root     2048 фев 11  2016 selinux
  drwxr-xr-x   2 root root     2048 фев 11  2016 srv
  dr-xr-xr-x  13 root root        0 мар 12 18:05 sys
  drwxrwxrwt  15 root root     2048 мар 12 17:39 tmp
  drwxr-xr-x  13 root root     2048 апр  5  2019 usr
  drwxr-xr-x  20 root root     2048 ноя 14  2019 var
  </pre>
  <p>Files .16726, .894 and .963 after 3 reboot. ELF format. Looks like some RAM image of kernel space.</p>
  <p>Can anyone tell what creates these files and how to turn it off?</p>
  <p>P.S. Cannot attach systemctl list due to &quot;This looks like spam&quot; restriction.</p>
  <p><strong>UPD 1</strong>
  Found out that these files are coredumps, created if some process crashed. Coredumps are turned off by default in almost all linux distributives (same is mine), but in some cases dumps can still be created by some processes (SDDM in my case). Solutions are:</p>
  <ol>
  <li>update (or downgrade) the crashing process packet</li>
  <li>of no result - try to disable special cases of dumps.</li>
  </ol>
  <p>Currently stuck with second solution, as no upgrade available, and downgrade is impossible. Basic coredump can be disabled via /etc/sysctl/conf, /etc/systemd/, /etc/security/limits - lots! All these settings are set in my distro, trying  to find some more...</p>
  <p>As an option, <em>sysctl -w kernel.core_pattern=DIR</em> can be changed to some other than '/' unwritable directory (broken symlink, etc).</p>