Testing the alert for core dump files and would like to evaluate how likely would be a case when a core dump file is moved to anoter directory from the original one where is was created?
What is common practice to deal with core dump files?
I would see it as unlikely. If a core file is moved away by the admin it shows that the admin has seen it, and then it doesn't need an alert any longer.
At least on F5 they're always in /var/core. So unlikely there as well.