Free space without losing evidence OPS-2230

OpenShell basics · Easy · Investigate · about 15 min ·Linux

Lab machine

A private Linux machine with the problem already set up. Sessions last up to 60 minutes.
Ivo Petrov opened OPS-2230 at 10:41SEV-3

The release volume is at 91% and climbing. Waybill crashed at 04:47, and Ivo needs whatever it left behind to find out why.

A disk alert keeps firing for the release volume. Nobody deployed anything overnight, but something in srv/releases/2026-09-27 grew by more than a hundred megabytes.

"Waybill segfaulted at 04:47. If that is a core dump, I need it to find the bug. Move it somewhere safe, please do not delete it. And do not touch the binary, it is the one we are running." (Ivo)

A core dump is the memory of a process at the moment it crashed. It is evidence: once it is gone, the crash can only be guessed at.

Your task

Measure what is using the space in the release directory, identify the crash dump, and move it into srv/evidence/ intact. Leave the application binary, its library, and the manifest exactly as they are.

On the machine

  • srv/releases/2026-09-27/ with the application, a library, logs, and one unexpected large file
  • srv/evidence/, empty
  • du, ls -lhS, find -size all work as usual

Timeline

04:47Waybill on depot-west exits with signal 11 and restarts.
06:00Disk alert: release volume 85%.
10:30Alert again: 91%.
10:41Ivo: "Do not delete it, I need it."

Done when

  1. The large crash dump is no longer in the release directory.
  2. It is preserved in full in srv/evidence/.
  3. The application binary, library, and manifest are unchanged.

Hints

Hint 1

du -ah srv/releases | sort -h | tail shows the biggest files last.

Hint 2

A file named core.<number> is a crash dump: memory of a process at the moment it crashed.

Hint 3

The incident team wants it kept, so move it rather than delete it.

Hint 4

mv srv/releases/2026-09-27/bin/core.* srv/evidence/

Show the solution

du -ah srv/releases | sort -h | tail -5 shows core.<pid> at about 120 MB. Move it with mv srv/releases/2026-09-27/bin/core.<pid> srv/evidence/.