How can I read a crash file from /var/crash

Question

php-fpm crashed on us and dumped a file in

/var/crash/_usr_sbin_php5-fpm.1002.crash

There is some info in that file but what I'm after is in the section called CoreDump in a base64 encoded format. How can I read what was running at the time of the crash?

Answer 1

There is a tool called apport-retrace that reads the .crash files and allows you to either fill it with a fully-symbolic stack trace or run a gdb session using the core dump. To start a gdb session, run apport-retrace -g CRASHFILE.crash. Note that you need to have the -dbg packages installed to get a good stack trace.

That being said (I'm not an expert on PHP), it might actually be something that you wrote in one of your files that is causing the crash.

Answer 2

In case if you don't want to install a bunch of sub-dependencies for apport-retrace tool, you can unpack apport format into separate files and to use only CoreDump dump with gdb as usual.

1. apport-unpack systemGeneratedCrashReportPath.crash yourNewUnpackDirectoryHere
2. cd yourNewUnpackDirectoryHere/
3. gdb `cat ExecutablePath` CoreDump (pay attention to tildes here!)

4. bt (output actual back-trace)

   Note: apport-unpack will sometimes crash itself on unpack operation (apport seems broken all around... xD), but your CoreDump and other files will be there, just ignore it and delete all .crash files in /var/crash after you move them elsewhere in order to allow system to output new crash reports from same apps there.