php-fpm crashed on us and dumped a file in


There is some info in that file but what I'm after is in the section called CoreDump in a base64 encoded format. How can I read what was running at the time of the crash?


In case if you don't want to install a bunch of sub-dependencies for apport-retrace tool, you can unpack apport format into separate files and to use only CoreDump dump with gdb as usual.

  1. apport-unpack systemGeneratedCrashReportPath.crash yourNewUnpackDirectoryHere

  2. cd yourNewUnpackDirectoryHere/

  3. gdb `cat ExecutablePath` CoreDump (pay attention to tildes here!)

  4. bt (output actual back-trace)

    Note: apport-unpack will sometimes crash itself on unpack operation (apport seems broken all around... xD), but your CoreDump and other files will be there, just ignore it and delete all .crash files in /var/crash after you move them elsewhere in order to allow system to output new crash reports from same apps there.

  • 1
    Worked like a charm, without requiring to install apport-retrace, thanks! – greuze Oct 31 '18 at 9:16
  • 1
    @digital_infinity no?! See it for yourself. There's a large difference between echo and cat... – stamster Feb 27 '19 at 16:19
  • 2
    @stamster You are right. Sorry I missed that there is a file with name ExecutablePath. I thought the reader must fill the executable path there. – digital_infinity Feb 28 '19 at 8:27

There is a tool called apport-retrace that reads the .crash files and allows you to either fill it with a fully-symbolic stack trace or run a gdb session using the core dump. To start a gdb session, run apport-retrace -g CRASHFILE.crash. Note that you need to have the -dbg packages installed to get a good stack trace.

That being said (I'm not an expert on PHP), it might actually be something that you wrote in one of your files that is causing the crash.

  • 6
    Doesnt seem to work: # apport-retrace -g _usr_sbin_php5-fpm.1002.crash ERROR: report file does not contain one of the required fields: CoreDump DistroRelease Package ExecutablePath` # grep CoreDump _usr_sbin_php5-fpm.1002.crash CoreDump: base64 – user76369 Mar 17 '14 at 3:26
  • 12
    Edit the crash file and add the field "Package: 0" under ExecutableTimestamp. – DarkNeuron Nov 9 '16 at 9:28
  • See wiki.ubuntu.com/DebuggingProgramCrash for documentation – XavierStuvw Mar 18 '20 at 7:04
  • Instead of manually editing the crash file, the --rebuild-package-info should also work as long as you are on the same system the crash happened, I think? I get errors because of missing deb-src URIs and can't be bothered to get it to work, I'll try the apport-unpack version. – mxmlnkn Dec 5 '20 at 23:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.