how to read and use crash reports?

Question

A small independent application is crashing on my system (Kubuntu 12.04). I want to manually review the info in the crash report and then email the relevant parts to the developer. The file is located in /var/crash/_usr_bin_appname.1000.crash however I am not sure which tool I need in order to read, edit and save the crash report in a form that I can email to the developer.

Solution 1

Here's the best solution I have found so far:

apt-get install apport-retrace

Then study the manual at either:

http://manpages.ubuntu.com/manpages/raring/en/man1/apport-retrace.1.html

or

man apport-retrace

I came up with this command:

apport-retrace --confirm --gdb --sandbox system --verbose --cache /my/path/cache/apport-retrace --output /mypath/apport-retrace/appname.1000.crash /var/crash/_usr_bin_appname.1000.crash

Use your own paths (instead of /my/path) and the correct application name (instead of 'appname') in the command above. See the manual for variations on that command.

Solution 2

Apport Crash reports should be located in:

/var/crash

And when I look at one:

jmunsch@NE-522:/var/log$ sudo cat /var/crash/*.*


ProblemType: Crash
Architecture: i386
Date: Fri Jul 11 20:40:09 2014
DistroRelease: Ubuntu 12.04

This is the program that caused a problem:

ExecutablePath: /usr/sbin/winbindd
ExecutableTimestamp: 1395068066
ProcCmdline: /usr/sbin/winbindd
ProcCwd: /var/log/samba/cores/winbindd
ProcEnviron:
 TERM=linux
 PATH=(custom, no user)

These are the C shared objects / shared libraries that were being used by the problem program:

ProcMaps:
 b6606000-b6622000 r-xp 00000000 08:01 394314     /lib/i386-linux-gnu/libgcc_s.so.1
 b6622000-b6623000 r--p 0001b000 08:01 394314     /lib/i386-linux-gnu/libgcc_s.so.1
 b6623000-b6624000 rw-p 0001c000 08:01 394314     /lib/i386-linux-gnu/libgcc_s.so.1
 b6642000-b664d000 r-xp 00000000 08:01 442782     /lib/i386-linux-gnu/libnss_files-2.15.so
 b664d000-b664e000 r--p 0000a000 08:01 442782     /lib/i386-linux-gnu/libnss_files-2.15.so
 b664e000-b664f000 rw-p 0000b000 08:01 442782     /lib/i386-linux-gnu/libnss_files-2.15.so
 b664f000-b6659000 r-xp 00000000 08:01 442517     /lib/i386-linux-gnu/libnss_nis-2.15.so
 b6659000-b665a000 r--p 00009000 08:01 442517     /lib/i386-linux-gnu/libnss_nis-2.15.so
 b665a000-b665b000 rw-p 0000a000 08:01 442517     /lib/i386-linux-gnu/libnss_nis-2.15.so
 b665b000-b6662000 r-xp 00000000 08:01 442803     /lib/i386-linux-gnu/libnss_compat-2.15.so
 b6662000-b6663000 r--p 00006000 08:01 442803     /lib/i386-linux-gnu/libnss_compat-2.15.so
 b6663000-b6664000 rw-p 00007000 08:01 442803     /lib/i386-linux-gnu/libnss_compat-2.15.so
 b666c000-b6670000 rw-s 00000000 00:0f 11331      /run/samba/messages.tdb
 b6670000-b6679000 rw-s 00000000 08:01 393253     /var/lib/samba/account_policy.tdb
 b6679000-b6682000 rw-s 00000000 08:01 445067     /var/lib/samba/passdb.tdb
 b6682000-b668a000 rw-s 00000000 08:01 394026     /var/cache/samba/winbindd_cache.tdb
 b668a000-b668b000 rw-s 00000000 08:01 442342     /var/cache/samba/netsamlogon_cache.tdb
 b668b000-b668d000 rw-s 00000000 00:0f 11353      /run/samba/serverid.tdb
.
.
.

This shows what the program was doing when the crash happened:

ProcStatus:
 Name:  winbindd
 State: S (sleeping)
 Tgid:  1556
 Pid:   1556
 PPid:  1
 TracerPid: 0
 Uid:   0   0   0   0
 Gid:   0   0   0   0
 FDSize:    256
 Groups:    
 VmPeak:       18000 kB
 VmSize:       17880 kB
 VmLck:        0 kB
 VmPin:        0 kB
 VmHWM:     2956 kB
 VmRSS:     2956 kB
 VmData:         400 kB
 VmStk:      136 kB
 VmExe:     7668 kB
 VmLib:     8656 kB
 VmPTE:       44 kB
 VmSwap:           0 kB
 Threads:   1
 SigQ:  2/30418
 SigPnd:    0000000000000000
 ShdPnd:    0000000000000000
 SigBlk:    0000000000000400
 SigIgn:    0000000000001000
 SigCgt:    0000000180014e47
 CapInh:    0000000000000000
 CapPrm:    ffffffffffffffff
 CapEff:    ffffffffffffffff
 CapBnd:    ffffffffffffffff
 Cpus_allowed:  3
 Cpus_allowed_list: 0-1
 Mems_allowed:  1
 Mems_allowed_list: 0
 voluntary_ctxt_switches:   1215
 nonvoluntary_ctxt_switches:    11
Signal: 6
Uname: Linux 3.2.0-53-lowlatency-pae i686
UserGroups: 

This could have all your passwords in it be careful with this information:

CoreDump: base64
.
.
.
core dump looks like
aASDFNFOSIefnsldgfnsweifnLEGNi43ng3gSNSDLgn483LNdg43ls
WO$EIGNOIDGNW$INGLSDKGNSLDIGNO$WIGNLRSIGN*RW(GNDKJNLGD
*TNOIDUGNSKJDGNKSDGNSIUEGFBSGUDB*SDgUSHNEUGBSD&GSAUBSD
.
.
.

Comments

[MountainX]

StackExchange answers should not be just links to other sites.

[syntaxerror]

Important note for new users: When you decide to omit the --cache ... option, you might think something is going wrong, but it isn't. A comprehensive apt-get procedure will be triggered (without root!) that can be imagined as a kind of "virtual machine" in which the command in question will be executed. Frankly, when this happened first time, I just thought "What the heck is going on NOW??" Besides, be patient - it will take minutes until the debugging environment is ready to use.

[syntaxerror]

Additional note: You may NOT use -o resp. --output in combination with --gdb, this is not possible.

[Alex Dueppen]

How would I go about viewing the CoreDump?

[jmunsch]

@A.Dueppen should be at the bottom of the file.

[Nathan Basanese]

// , How does this compare to apport-retrace? Also, wouldst consider adding wiki.ubuntu.com/DebuggingProgramCrash to this answer?