EDR: Is it safe to delete core.PID files from /opt/carbonblack/response/bin/ on a Linux endpoint?

Products

• Carbon Black Hosted EDR (formerly Cb Response Cloud)

Issue/Introduction

Is it safe to delete core.PID files from /opt/carbonblack/response/bin/ on a Linux endpoint?

Environment

• EDR Linux Sensor: All Supported Versions
• Linux OS: All Supported Versions

Resolution

Generally speaking, core.PID files are safe to delete, as they only contain historical process data related to a process crash. 
 

Additional Information

Core.PID files are essentially process crash dumps. Similar to windows PROCESS.dmp type files. Its possible that these are either auto generated. Or were generated using the gcore application. However, if there are many of these files, an investigation should take place to understand why.