core.30990 etc. appearing in a folder?

[ZYV]

Hello,

I am not posting a trouble ticket because I don't have the CCP access to this customer's account. Maybe someone is able to help me anyway. The server in question is cpanel65 and the username is "romanov".

The problem is that few days ago two files "core.30990" and "core.31028" appeared in a subfolder, containing a CMS Made Simple installation. Both files are about 66-67 Mbs in size. I have downloaded one of them and ran through the file command:

zyv@mypride:~/Desktop$ file core.30990
core.30990: ELF 32-bit LSB core file Intel 80386, version 1 (SYSV), SVR4-style

What is this? Is it safe do delete? Why exactly were they created?

I am in the process of moving this site of Dathorn, because the customer decided to set up their own server, but I am curious anyway, because it's the first time I see this kind of things.

Thanks.

[AndrewT]

You can delete those files. They are being created as a result of one of your PHP scripts not fully executing and finishing properly. Generally if you compare the date/time stamps of the core files to the entries that are in the domain's HTTP log you can identify the script that is causing this and then work on fixing it from there.

[ZYV]

Thank you for the prompt reply! Most importantly it means that these are not malicious web-shells or rootkits We shall see if this will continue on the customers server and if it will, then we'll be trying to identify and fix the offending script.