Can not find core-dump file in Ubuntu 18.04 and Ubuntu 20.04

Question

I can't find any core dump files in ubuntu 18.04 and ubuntu 20.04, even I have changed core file size and /proc/sys/kernel/core_pattern:

smart@stable:~$ ulimit -c unlimited

smart@stable:~$ ulimit -a
core file size          (blocks, -c) unlimited
data seg size           (kbytes, -d) unlimited
scheduling priority             (-e) 0
file size               (blocks, -f) unlimited
pending signals                 (-i) 63699
max locked memory       (kbytes, -l) 65536
max memory size         (kbytes, -m) unlimited
open files                      (-n) 1048576
pipe size            (512 bytes, -p) 8
POSIX message queues     (bytes, -q) 819200
real-time priority              (-r) 0
stack size              (kbytes, -s) 8192
cpu time               (seconds, -t) unlimited
max user processes              (-u) 1048576
virtual memory          (kbytes, -v) unlimited
file locks                      (-x) unlimited

smart@stable:~$ cat /proc/sys/kernel/core_pattern 
|/usr/share/apport/apport %p %s %c %d %P %E

smart@stable:~$ sudo su
root@stable:~# echo "/var/crash/core-%e-%p-%t" > /proc/sys/kernel/core_pattern

After do that all, I run a program which will get a Segmentation fault error, but it didn't generate a core-dump file in /var/crash/, so what wrong with that?

Answer 1

The short answer for Ubuntu 20.04, assuming you set everything up correctly,

Regular user dumps caught by Apport write to

/var/lib/apport/coredump/

Answer 2

For your own programs you also have to set:

mkdir -p ~/.config/apport
printf '[main]
unpackaged=true
' >> ~/.config/apport/settings

or else:

cat /var/log/apport.log

says:

ERROR: apport (pid 503174) Sat Nov 26 21:51:47 2022: executable does not belong to a package, ignoring

and you get no .crash.

Tested on Ubuntu 22.04.

See also: https://askubuntu.com/questions/1349047/where-do-i-find-core-dump-files-and-how-do-i-view-and-analyze-the-backtrace-st/1442665#1442665

Answer 3

The first small issue is that it appears you have a typo in your directory names:

/var/crash/

The second and more important issue is that you need to set a system-wide ulimit on Ubuntu.

Below is the SO post that helped me figure out the solution to your problem:

I was also struggling to get coredumps and I had the same problem with ulimit. The session specific setting suggested by Niranjan also didn't work for me.

Finally I found the solution at https://serverfault.com/questions/216656/how-to-set-systemwide-ulimit-on-ubuntu

in /etc/security/limits.conf add:

root - core unlimited
*    - core unlimited

And log out / log in.

Then

ulimit -c

on the terminal should return "unlimited" and core dumps are generated.

Answer 4

Have you enabled apport as outlined here? https://askubuntu.com/questions/966407/where-do-i-find-the-core-dump-in-ubuntu-16-04lts

Specifically:

In Ubuntu the core dumps are handled by Apport and can be located in /var/crash/. But it is disabled by default in stable releases.

To enable Apport, run: sudo systemctl enable apport.service or sudo service apport start