Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I've got problem with Handbrake/ffmpeg. After ~5 minutes transcoding, the computer locks up. I'm fairly sure it's a kernel panic because caps-lock starts flashing.

There are a few logical questions about what to do and some about specific bugs but I'm really after one thing: what happened right before everything died?!

I've checked /var/log/kern.log and all I see around the time is me sticking in a DVD and then a few minutes later, the system booting up. No errors, no panic notice.

Is there any way to force panics to be logged? I'm fairly sure I can reproduce this (it's happened 100% of the times I've tried recently) so while I'd rather this "just worked", I'm happy enough to reboot a few times if it means I can find the cause of the panic.

share|improve this question
    
Any specific message you get when transcoding? Might be useful in tracking down the solution ;) –  Rinzwind Feb 16 '12 at 15:29
    
@Rinzwind Nope. Didn't show anything, just froze. –  Oli Feb 16 '12 at 15:33

2 Answers 2

up vote 9 down vote accepted

All your system logs in Ubuntu are handled by rsyslog which keeps its configuration in /etc/rsyslog.conf and /etc/rsyslog.d/.

For more information on how to configure rsyslog and the possible options visit the rsyslog.conf man page.

Opening /etc/rsyslog.d/50-default.conf you can see that one of the lines contains

*.*;auth,authpriv.none -/var/log/syslog*

Meaning that the file you are looking for in this case is any of the huge /var/log/syslog logs you will probably have.

You can see that the file name also starts with a -, this means that the file is cached before writing, its great but can leave you with a bad log, what you want is that the log is written as soon as there is a problem. Remove the dash and reboot or reload rsyslog and then make your computer crash again, check /var/log/syslog.

share|improve this answer

If it really is a kernel panic then it won't be written into a log via normal methods. Since the kernel has at this point crashed, writing into the filesystem is a risky operation - not much of the kernel can be trusted anymore, so writes into logs might actually be spewing random crap over your bootloader!

Instead, you can dump the contents of memory into your swap, and then debug it later. This is known as a kernel crash / core dump.

The Ubuntu Wiki has a CrashdumpRecipe that may be useful - though it looks a bit out of date, I don't think too much should have changed.

share|improve this answer
6  
The CrashdumpRecipe refers to the Linux Kernel Crash Dump (LKCD) tool available on Sourceforge - there is a package for Ubuntu called linux-crashdump; this package is still available in all versions. –  Mei Mar 29 '12 at 14:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.