4 files located in "/" (filesystem root)?

Looking at the ‘ls -alF /’ I see these files:

-rw-r--r--   1 root   root   156313 Oct 25 18:29 .readahead
-rw-------   1 root   root  1306624 Oct 25 18:42 core
-rw-r--r--   1 root   root     2198 Nov 26 10:54 global.conf
srwxr-xr-x   1 root   root        0 Nov 23 00:33 klauncherT21452.1.slave-socket=

(yes the last one is shown in pink in the console, no idea why)

After having installed the OS (long ago) I have disabled the readahead using:

systemctl disable systemd-readahead-collect.service
systemctl disable systemd-readahead-replay.service

because the OS is installed on SSD.

The global.conf contains 157 lines of this:


...
LogLevel warn
LogLevel warn
LogLevel warn
...

and /core contains some binary data and I have no idea what it is used for.

My questions are:

  1. What are these files used for?
  2. Should I remove any of them? (if they are not used given the circumstances)
  • ".readahead
    " is “Normal” – about 75K on my 13.2 system, about 170K on my Leap system; - "core
    " is a crash dump file – something crashed – a software developer can analyse “core” files to determine what caused the “something” to crash.

Unfortunately, if the crashed application is unknown then, the “core” file is completely useless – delete it;

  • "global.conf
    " – not present on 13.2 – also not present on my Leap system – no idea as to why it’s appeared on your Leap system; - "klauncherT21452.1.slave-socket=
    " – not present on 13.2 – but, also present on my Leap system – 3 copies.

After stopping the Display Manager (init 3) I did an “unlink” (root permissions) on each of them and the slave sockets didn’t reappear when the Display Manager was restarted.

Of those files, I only see “.readahead”. It has a date about the time that I last rebooted. Yours is far older, and that suggests that it is no longer being used. You can maybe try deleting it.

I don’t have a core file around to test , but in my experience you can use

file core

and that will often tell you the name of the command that crashed.

Even if I have disabled the readahead as explained in the OP?

That’s what I am thinking too but I am trying to be cautions. That’s why I am asking.

I don’t have a core file around to test , but in my experience you can use

file core

and that will often tell you the name of the command that crashed.

It says:


# file core 
core: ELF 64-bit LSB core file x86-64, version 1 (SYSV), SVR4-style, from '/usr/sbin/wicked --systemd ifreload all'

I moved them all to a temporary directory and rebooted. The were not recreated and I can’t see any related errors in journal. I guess they were leftovers.

Thanks.

So wicked crashed on Oct 25th. That may have been an older version of wicked, before you updated to the latest Leap 42.1 release.

Personally, I would probably ignore this if it hasn’t happened more recently. That is to say, I would not report a bug for it. And then I would probably remove that core file, since it is only useful for bug analysis.

Yes. I removed the 4 of them. Thanks again!