/proc kcore file is huge

In answer to your original question:

“Is it safe to delete the /proc/kcore file? Or is there a solution
on getting it to an normal size.”

No, it’s not safe. Well, I wouldn’t like to bet what would happen if you deleted it anyway!

The /proc directory is the mount point for procfs (run mount and see the output like below: )

proc on /proc type proc (rw)

procfs is a bit of dark magic; no files in it are real. It looks like a filesystem, acts like a filesystem, and is a filesystem. But not one that is stored on disk (or elsewhere).

/proc/kcore specifically is a file which maps directly to every available byte in your virtual memory … I’m not absolutely clear on the details; the 128TB comes from Linux allocating 47ish bits of the 64bits available for virtual memory.

(There’s discussion on the 128TB limit here: https://unix.stackexchange.com/questions/116640/what-is-maximum-ram-supportable-by-linux )

Anyway, putting aside Linux’s hard-coded virtual memory limits – what we come to understand in the context of your question is this: /proc/kcore is a system file, provided by the virtual procfs filesystem, and is not a real file.

Don’t delete it 😉

Update: 2016-06-03

My answer here keeps periodically being up-voted – so I assume people are still looking for an explanation of what /proc/kcore is.

There’s a helpful Wikipedia article titled Everything is a file which gives a little background. If you’re really curious – take a look into the Plan9 OS.

Hopefully my original answer sufficiently explains kcore itself. I’m speculating that people reading this answer may be curious about other files in /proc too – so here are some other “interesting” examples.

• /proc/sys/* is a mechanism for the user (you) to read/write details from the heart of Linux (the kernel and associated drivers etc). A cute example of a r/w item is “IP forwarding”:

  Read: cat /proc/sys/net/ipv4/ip_forward (0 is off, 1 is on)

  Write: echo 1 > /proc/sys/net/ipv4/ip_forward

  As with kcore, this isn’t a real file. But it acts like one. So when you write to it, you’re actually changing software settings as opposed to bytes on a disk.

• /proc/meminfo and /proc/cpuinfo are read-only. You can cat or less them, or fopen() from your own application. They show you details about your hardware (memory and CPU).

• /proc/[0-9]+ are actually process IDs running on your machine! These are (IMHO) by far the coolest feature of /proc. Inside them you will find more fake files like cmdline which tell you what command was used to start the process.

Finally there’s some other examples of “interesting filesystems”, like /proc. There are purely in-memory and “user-space” to name just two. Again these (generally speaking) do not consume any real disk space, although tools like df and ls may report real file sizes.