I have a C++ program that does what it is supposed to do, but there must be some problem with pointer, since it crashes at the end and creates a core dump. My problem is that I cannot find the core file, so I cannot debug it.

I have tried

ulimit -c unlimited
ulimit -a

and now the dimension of the file is set to unlimited, but still I cannot find the core. I have tried in every folder written here but still it seems that no core file is created.

Where can I find it?


3 Answers 3


In Ubuntu the core dumps are handled by Apport and can be located in /var/crash/. But it is disabled by default in stable releases.

To enable Apport, run: sudo systemctl enable apport.service or sudo service apport start.

To disable, run: sudo systemctl disable apport.service or sudo service apport stop in order to back to regular core dumping method. See: How do I enable or disable Apport?.

To disable permanently, edit /etc/apport/crashdb.conf file and comment the following line:

'problem_types': ['Bug', 'Package'],

by adding a hash symbol (#) in the beginning of the line.

To disable crash reporting (back to normal), remove the hash symbol (the same as it was).

You can also check core_pattern, how core dumps are handled by the kernel:

$ cat /proc/sys/kernel/core_pattern
|/usr/share/apport/apport %p %s %c

So even core files are disabled by ulimit, apport will still capture the crash.

See also:


All the above did not worked for me... I looked at /var/log/apport.log:

cat /var/log/apport.log 

and I saw the file name:

ERROR: apport (pid 3426) Mon Nov  8 14:34:07 2021: writing core dump to core._home_guest_a_out.1000.4 ... 

and then I search throughout all the system

sudo find . -name "core._home_guest_a_out.1000.4..."

I found the core dump in /var/lib/apport/coredump/

  • 6
    It is beyond me why the core file gets written there instead of /var/crash (which everyone and their donkey is talking about), why apport does not log the full path, where to configure this and why there is hardly anything to be found for "/var/lib/apport/coredump" via Google. What are the Ubuntu people doing there?
    – frog.ca
    Nov 24, 2021 at 12:51
  • 1
    Agreeing with frog.ca... it shouldn't be this hard. I just spent the last hour trying to figure out how to enable and locate a simple core dump...
    – Evan
    Feb 24, 2022 at 14:21

For those googlin': ( in my case -- Ubuntu 16.04 and 18.04 and a custom app ) /var/crash was still empty, so a quick way to handle core creation ( provided that you are e.g. using a relevant ulimit builtin setting ) was

sudo sysctl -w kernel.core_pattern=core.%u.%p.%t # to enable core generation


systemctl restart apport # to restore default apport settings
# which, by the way, were "|/usr/share/apport/apport %p %s %c %d %P" (without quotes)


  • Simple, straightforward, worked.
    – Taekahn
    Oct 15, 2019 at 18:18
  • This didn't work for me without specifying a full path, e.g. sudo sysctl -w kernel.core_pattern=/tmp/core-%e.%p.%h.%t jvns.ca/blog/2018/04/28/debugging-a-segfault-on-linux
    – jtpereyda
    Aug 21, 2020 at 0:09
  • @jtpereyda it used to be cwd by default ; have no idea what modern restrictions might apply (e.g. apparmor and the like), and it is probably a good hint for e.g. daemon processes anyway Aug 23, 2020 at 7:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .