Skip to content

Opening cores in the apport "crash" file format (e.g. var crash _usr_bin_scylla_*.crash)

Botond Dénes edited this page Feb 6, 2020 · 1 revision

Apport is used on Debian and some derivatives, most notably Ubuntu. It generates coredumps in a "crash" file format, that are placed in /var/crash/. These are text files that contain the actual coredump inline, in a base64 encoded format. The coredump can be extracted using apport-unpack

Example:

$ mkdir unpacked-crash
$ apport-unpack ./_usr_bin_scylla.115.somename.11.crash unpacked-crash
$ ls unpacked-crash
Architecture  CoreDump  Date  DistroRelease  ExecutablePath  ExecutableTimestamp  ProblemType  ProcCmdline  ProcCwd  ProcEnviron  ProcMaps  ProcStatus  Signal  Uname
$ file ./unpacked-crash/CoreDump
CoreDump: ELF 64-bit LSB core file x86-64, version 1 (SYSV), SVR4-style, from '/usr/bin/scylla --log-to-syslog 1 --log-to-stdout 0 --default-log-level info --', real uid: 115, effective uid: 115, real gid: 119, effective gid: 119

apport-unpack is contained in the apport-retrace package as of Ubuntu 18.04.

Clone this wiki locally