Retrieve Core dump files Firepower 1140

[00u18jg7x27DHjRMh5d7]

I'm trying to get core dump files for a TAC case. I am in expert mode the TAC said it should be in var/common directory. So I navigated to cd /ngfw/var/common  then command ls -l. But I do not see any core dump files just the following.

-rw-r--r-- 1 root admin 5396000 Jun 12 18:38 results-06-12-2023--183543.tar.gz
-rw------- 1 root admin 0 Dec 2 16:05 sftls_clear_lmdb_counters.cmd

Can anyone give me another place to look or the expert command to locate the files.

Thanks

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/216245-collection-of-core-files-from-a-firepowe.html

Check the step of root user 

MHM

[00u18jg7x27DHjRMh5d7]

I went threw this earlier today it helped but when using the ls -l | grep -i core. It returned nothing. 

root@ET-FP-02:/ngfw/var/common# ls -l | grep -i core
root@ET-FP-02:/ngfw/var/common#

I also tryed this and still had nothing 

root@ET-P-02:/home/admin# cd /ngfw/var/data/cores/
root@ET-FP-02:/ngfw/var/data/cores#
root@ET-FP-02:/ngfw/var/data/cores# ls -l | grep -i core

Thanks

[MHM Cisco World]

I dont precisely where you find Core files but' you can use 

Cd (change the directory)

And 

Ls (list directory content)

To check the files in each directory' and then when find it copy and share to Cisco TAC.

MHM