Home / ubuntu / Questions / 346953
Accepted
MountainX
Asked: 2013-09-18 21:04:18 +0800 CST

how to read and use crash reports?

  • 772

A small independent application is crashing on my system (Kubuntu 12.04). I want to manually review the info in the crash report and then email the relevant parts to the developer. The file is located in /var/crash/_usr_bin_appname.1000.crash however I am not sure which tool I need in order to read, edit and save the crash report in a form that I can email to the developer.

bug-reporting

3 Answers

  1. Apport Crash reports should be located in:

    /var/crash

    And when I look at one:

    jmunsch@NE-522:/var/log$ sudo cat /var/crash/*.*


ProblemType: Crash
Architecture: i386
Date: Fri Jul 11 20:40:09 2014
DistroRelease: Ubuntu 12.04

    This is the program that caused a problem:

    ExecutablePath: /usr/sbin/winbindd
ExecutableTimestamp: 1395068066
ProcCmdline: /usr/sbin/winbindd
ProcCwd: /var/log/samba/cores/winbindd
ProcEnviron:
 TERM=linux
 PATH=(custom, no user)

    These are the C shared objects / shared libraries that were being used by the problem program:

    ProcMaps:
 b6606000-b6622000 r-xp 00000000 08:01 394314     /lib/i386-linux-gnu/libgcc_s.so.1
 b6622000-b6623000 r--p 0001b000 08:01 394314     /lib/i386-linux-gnu/libgcc_s.so.1
 b6623000-b6624000 rw-p 0001c000 08:01 394314     /lib/i386-linux-gnu/libgcc_s.so.1
 b6642000-b664d000 r-xp 00000000 08:01 442782     /lib/i386-linux-gnu/libnss_files-2.15.so
 b664d000-b664e000 r--p 0000a000 08:01 442782     /lib/i386-linux-gnu/libnss_files-2.15.so
 b664e000-b664f000 rw-p 0000b000 08:01 442782     /lib/i386-linux-gnu/libnss_files-2.15.so
 b664f000-b6659000 r-xp 00000000 08:01 442517     /lib/i386-linux-gnu/libnss_nis-2.15.so
 b6659000-b665a000 r--p 00009000 08:01 442517     /lib/i386-linux-gnu/libnss_nis-2.15.so
 b665a000-b665b000 rw-p 0000a000 08:01 442517     /lib/i386-linux-gnu/libnss_nis-2.15.so
 b665b000-b6662000 r-xp 00000000 08:01 442803     /lib/i386-linux-gnu/libnss_compat-2.15.so
 b6662000-b6663000 r--p 00006000 08:01 442803     /lib/i386-linux-gnu/libnss_compat-2.15.so
 b6663000-b6664000 rw-p 00007000 08:01 442803     /lib/i386-linux-gnu/libnss_compat-2.15.so
 b666c000-b6670000 rw-s 00000000 00:0f 11331      /run/samba/messages.tdb
 b6670000-b6679000 rw-s 00000000 08:01 393253     /var/lib/samba/account_policy.tdb
 b6679000-b6682000 rw-s 00000000 08:01 445067     /var/lib/samba/passdb.tdb
 b6682000-b668a000 rw-s 00000000 08:01 394026     /var/cache/samba/winbindd_cache.tdb
 b668a000-b668b000 rw-s 00000000 08:01 442342     /var/cache/samba/netsamlogon_cache.tdb
 b668b000-b668d000 rw-s 00000000 00:0f 11353      /run/samba/serverid.tdb
.
.
.

    This shows what the program was doing when the crash happened:

    ProcStatus:
 Name:  winbindd
 State: S (sleeping)
 Tgid:  1556
 Pid:   1556
 PPid:  1
 TracerPid: 0
 Uid:   0   0   0   0
 Gid:   0   0   0   0
 FDSize:    256
 Groups:    
 VmPeak:       18000 kB
 VmSize:       17880 kB
 VmLck:        0 kB
 VmPin:        0 kB
 VmHWM:     2956 kB
 VmRSS:     2956 kB
 VmData:         400 kB
 VmStk:      136 kB
 VmExe:     7668 kB
 VmLib:     8656 kB
 VmPTE:       44 kB
 VmSwap:           0 kB
 Threads:   1
 SigQ:  2/30418
 SigPnd:    0000000000000000
 ShdPnd:    0000000000000000
 SigBlk:    0000000000000400
 SigIgn:    0000000000001000
 SigCgt:    0000000180014e47
 CapInh:    0000000000000000
 CapPrm:    ffffffffffffffff
 CapEff:    ffffffffffffffff
 CapBnd:    ffffffffffffffff
 Cpus_allowed:  3
 Cpus_allowed_list: 0-1
 Mems_allowed:  1
 Mems_allowed_list: 0
 voluntary_ctxt_switches:   1215
 nonvoluntary_ctxt_switches:    11
Signal: 6
Uname: Linux 3.2.0-53-lowlatency-pae i686
UserGroups:

    This could have all your passwords in it be careful with this information:

    CoreDump: base64
.
.
.
core dump looks like
aASDFNFOSIefnsldgfnsweifnLEGNi43ng3gSNSDLgn483LNdg43ls
WO$EIGNOIDGNW$INGLSDKGNSLDIGNO$WIGNLRSIGN*RW(GNDKJNLGD
*TNOIDUGNSKJDGNKSDGNSIUEGFBSGUDB*SDgUSHNEUGBSD&GSAUBSD
.
.
.
    • 13
  2. Best Answer

    Here's the best solution I have found so far:

    apt-get install apport-retrace

    Then study the manual at either:

    http://manpages.ubuntu.com/manpages/raring/en/man1/apport-retrace.1.html

    or 

    man apport-retrace

    I came up with this command:

    apport-retrace --confirm --gdb --sandbox system --verbose --cache /my/path/cache/apport-retrace --output /mypath/apport-retrace/appname.1000.crash /var/crash/_usr_bin_appname.1000.crash

    Use your own paths (instead of /my/path) and the correct application name (instead of 'appname') in the command above. See the manual for variations on that command.

    • 6

  3. Well Ubuntu had designed a sequence for you also. It's named as Debugging Program Crash.

    Edit I just heard about a program named as volatility and it's available for Ubuntu, you can install with

    sudo apt install volatility

    Volatility Framework - Volatile memory extraction utility framework

    The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.

    For more information

    • -2