How can we trace problems of crashing programs in Linux?

Question

If an application crashes in Windows we can check the Event Viewer in the Administration tools to see what has crashed. Sometimes it has useful information others not, but it is a start.
In linux if an application (any) crashes how one starts to trace what happened?
Is there e.g. some central log or something similar?

Solution 1

Is there e.g. some central log or something similar?

The normal place for system logs is /var/log/. What gets put in each log depends on the syslog configuration, but commonly everything except logins goes to /var/log/syslog.

This is no guarantee that individual applications will have left any clue there in the event of a problem. But they, or the shell, will likely spit something to the standard out/standard error streams, and if you run a troublesome application in the foreground from a terminal you'll be able to see that stuff.

Solution 2

On Ubuntu segfaults get written at /var/log/kern.log. I tested it by creating a program that segfaults:

void main() {
    int *a=0;
    *a=0;
}

After it segfaulted there was this line in /var/log/kern.log:

a.out[534]: segfault at 0 ip 08048432 sp bfaec8c0 error 6 in a.out[8048000+1000]

Solution 3

In Ubuntu if you are launching your application from a .desktop launcher file, add the option Terminal=true to your .desktop file.

Comments

[Admin]

64-bit versions of Linux will log a short description of a crashed process (one that died due to a signal) in /var/log/syslog. Linux provides a way for a daemon to be notified of process crashes. Ubuntu's apport and Red Hat's abrt use this to provide centralized logging and report-generation facilities. Generally a core dump is saved so that you can invoke a debugger on the crashed program.

[Admin]

I would have upvoted this question, but the OP does not seem to want to help the community by accepting, or posting, an answer, so I will find a similar question which does accept an answer and upvote that, in the hope that it will rise to the top of search results and help future searchers

[Jim]

What should one look for in /var/log?Which log file?Is there some convention?

[hiad]

If you can make the crash happen, do so, then see which file under /var/log was most recently changed. With ls -lart, the last file in the listing was the most recently changed.

[goldilocks]

There are conventions -- linux is much more heterogeneous than windows. Syslog refers to the system logger, but there is not a universal implementation, and the variations can then be configured in different ways. The general logic is that messages are sent to syslog by the application, and these messages are then sorted into different files. As mentioned, commonly everything ends up in /var/log/syslog, but different distros do things differently. If you know what which syslog you are using, you can examine its configuration to determine this.