Hi all, We use the dynatrace to monitor our instances in the AWS (CentOS). We spotted that there are a huge amount of core files in the root (/) directory. First we tried to disable the SSM agent, but it helped not so much. Deep analysis showed that the problem could be in the dynatrace oneagent. The audit enabled was showing that the core file is generated when we are trying to reinstall httpd via rpm.
Here is the entry of the auditd watch that is confirming the generation of the core file by the dynatrace oneagent: -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- type=PROCTITLE msg=audit(09/03/21 18:34:08.809:257082) : proctitle=/opt/dynatrace/oneagent/agent/rdp -p 2388 -P 2388 -e rpm -s 31 type=PATH msg=audit(09/03/21 18:34:08.809:257082) : item=1 name=//core.2388 inode=738850 dev=ca:01 mode=file,700 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:root_t:s0 objtype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 type=PATH msg=audit(09/03/21 18:34:08.809:257082) : item=0 name=// inode=64 dev=ca:01 mode=dir,555 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:root_t:s0 objtype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 type=CWD msg=audit(09/03/21 18:34:08.809:257082) : cwd=/ type=SYSCALL msg=audit(09/03/21 18:34:08.809:257082) : arch=x86_64 syscall=open success=yes exit=5 a0=0x7ffe8e0528e0 a1=O_WRONLY|O_CREAT a2=0777 a3=0x2 items=2 ppid=86 pid=2389 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=rdp exe=/opt/dynatrace/oneagent/agent/lib64/oneagentdumpproc subj=system_u:system_r:kernel_t:s0 key=core_support
