A small independent application is crashing on my system (Kubuntu 12.04). I want to manually review the info in the crash report and then email the relevant parts to the developer. The file is located in /var/crash/_usr_bin_appname.1000.crash however I am not sure which tool I need in order to read, edit and save the crash report in a form that I can email to the developer.

3 Answers 3


Apport Crash reports should be located in:


And when I look at one:

jmunsch@NE-522:/var/log$ sudo cat /var/crash/*.*

ProblemType: Crash
Architecture: i386
Date: Fri Jul 11 20:40:09 2014
DistroRelease: Ubuntu 12.04

This is the program that caused a problem:

ExecutablePath: /usr/sbin/winbindd
ExecutableTimestamp: 1395068066
ProcCmdline: /usr/sbin/winbindd
ProcCwd: /var/log/samba/cores/winbindd
 PATH=(custom, no user)

These are the C shared objects / shared libraries that were being used by the problem program:

 b6606000-b6622000 r-xp 00000000 08:01 394314     /lib/i386-linux-gnu/libgcc_s.so.1
 b6622000-b6623000 r--p 0001b000 08:01 394314     /lib/i386-linux-gnu/libgcc_s.so.1
 b6623000-b6624000 rw-p 0001c000 08:01 394314     /lib/i386-linux-gnu/libgcc_s.so.1
 b6642000-b664d000 r-xp 00000000 08:01 442782     /lib/i386-linux-gnu/libnss_files-2.15.so
 b664d000-b664e000 r--p 0000a000 08:01 442782     /lib/i386-linux-gnu/libnss_files-2.15.so
 b664e000-b664f000 rw-p 0000b000 08:01 442782     /lib/i386-linux-gnu/libnss_files-2.15.so
 b664f000-b6659000 r-xp 00000000 08:01 442517     /lib/i386-linux-gnu/libnss_nis-2.15.so
 b6659000-b665a000 r--p 00009000 08:01 442517     /lib/i386-linux-gnu/libnss_nis-2.15.so
 b665a000-b665b000 rw-p 0000a000 08:01 442517     /lib/i386-linux-gnu/libnss_nis-2.15.so
 b665b000-b6662000 r-xp 00000000 08:01 442803     /lib/i386-linux-gnu/libnss_compat-2.15.so
 b6662000-b6663000 r--p 00006000 08:01 442803     /lib/i386-linux-gnu/libnss_compat-2.15.so
 b6663000-b6664000 rw-p 00007000 08:01 442803     /lib/i386-linux-gnu/libnss_compat-2.15.so
 b666c000-b6670000 rw-s 00000000 00:0f 11331      /run/samba/messages.tdb
 b6670000-b6679000 rw-s 00000000 08:01 393253     /var/lib/samba/account_policy.tdb
 b6679000-b6682000 rw-s 00000000 08:01 445067     /var/lib/samba/passdb.tdb
 b6682000-b668a000 rw-s 00000000 08:01 394026     /var/cache/samba/winbindd_cache.tdb
 b668a000-b668b000 rw-s 00000000 08:01 442342     /var/cache/samba/netsamlogon_cache.tdb
 b668b000-b668d000 rw-s 00000000 00:0f 11353      /run/samba/serverid.tdb

This shows what the program was doing when the crash happened:

 Name:  winbindd
 State: S (sleeping)
 Tgid:  1556
 Pid:   1556
 PPid:  1
 TracerPid: 0
 Uid:   0   0   0   0
 Gid:   0   0   0   0
 FDSize:    256
 VmPeak:       18000 kB
 VmSize:       17880 kB
 VmLck:        0 kB
 VmPin:        0 kB
 VmHWM:     2956 kB
 VmRSS:     2956 kB
 VmData:         400 kB
 VmStk:      136 kB
 VmExe:     7668 kB
 VmLib:     8656 kB
 VmPTE:       44 kB
 VmSwap:           0 kB
 Threads:   1
 SigQ:  2/30418
 SigPnd:    0000000000000000
 ShdPnd:    0000000000000000
 SigBlk:    0000000000000400
 SigIgn:    0000000000001000
 SigCgt:    0000000180014e47
 CapInh:    0000000000000000
 CapPrm:    ffffffffffffffff
 CapEff:    ffffffffffffffff
 CapBnd:    ffffffffffffffff
 Cpus_allowed:  3
 Cpus_allowed_list: 0-1
 Mems_allowed:  1
 Mems_allowed_list: 0
 voluntary_ctxt_switches:   1215
 nonvoluntary_ctxt_switches:    11
Signal: 6
Uname: Linux 3.2.0-53-lowlatency-pae i686

This could have all your passwords in it be careful with this information:

CoreDump: base64
core dump looks like

Here's the best solution I have found so far:

apt-get install apport-retrace

Then study the manual at either:



man apport-retrace

I came up with this command:

apport-retrace --confirm --gdb --sandbox system --verbose --cache /my/path/cache/apport-retrace --output /mypath/apport-retrace/appname.1000.crash /var/crash/_usr_bin_appname.1000.crash

Use your own paths (instead of /my/path) and the correct application name (instead of 'appname') in the command above. See the manual for variations on that command.

  • 2
    Important note for new users: When you decide to omit the --cache ... option, you might think something is going wrong, but it isn't. A comprehensive apt-get procedure will be triggered (without root!) that can be imagined as a kind of "virtual machine" in which the command in question will be executed. Frankly, when this happened first time, I just thought "What the heck is going on NOW??" Besides, be patient - it will take minutes until the debugging environment is ready to use. Jan 23, 2015 at 8:28
  • 4
    Additional note: You may NOT use -o resp. --output in combination with --gdb, this is not possible. Jan 23, 2015 at 8:37

Well Ubuntu had designed a sequence for you also. It's named as Debugging Program Crash.

Edit I just heard about a program named as volatility and it's available for Ubuntu, you can install with

sudo apt install volatility

Volatility Framework - Volatile memory extraction utility framework

The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.

For more information

  • 2
    StackExchange answers should not be just links to other sites.
    – MountainX
    Sep 22, 2013 at 17:32
  • // , Agreed. Still, it's a good link. Sep 11, 2016 at 20:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.