I have a C++ program that does what it is supposed to do, but there must be some problem with pointer, since it crashes at the end and creates a core dump. My problem is that I cannot find the core file, so I cannot debug it.

I have tried

ulimit -c unlimited
ulimit -a

and now the dimension of the file is set to unlimited, but still I cannot find the core. I have tried in every folder written here but still it seems that no core file is created.

Where can I find it?


In Ubuntu the core dumps are handled by Apport and can be located in /var/crash/. But it is disabled by default in stable releases.

To enable Apport, run: sudo systemctl enable apport.service or sudo service apport start.

To disable, run: sudo systemctl disable apport.service or sudo service apport stop in order to back to regular core dumping method. See: How do I enable or disable Apport?.

To disable permanently, edit /etc/apport/crashdb.conf file and comment the following line:

'problem_types': ['Bug', 'Package'],

by adding a hash symbol (#) in the beginning of the line.

To disable crash reporting (back to normal), remove the hash symbol (the same as it was).

You can also check core_pattern, how core dumps are handled by the kernel:

$ cat /proc/sys/kernel/core_pattern
|/usr/share/apport/apport %p %s %c

So even core files are disabled by ulimit, apport will still capture the crash.

See also:


For those googlin': ( in my case -- Ubuntu 16.04 and 18.04 and a custom app ) /var/crash was still empty, so a quick way to handle core creation ( provided that you are e.g. using a relevant ulimit builtin setting ) was

sudo sysctl -w kernel.core_pattern=core.%u.%p.%t # to enable core generation


systemctl restart apport # to restore default apport settings
# which, by the way, were "|/usr/share/apport/apport %p %s %c %d %P" (without quotes)


  • Simple, straightforward, worked.
    – Taekahn
    Oct 15 '19 at 18:18
  • This didn't work for me without specifying a full path, e.g. sudo sysctl -w kernel.core_pattern=/tmp/core-%e.%p.%h.%t jvns.ca/blog/2018/04/28/debugging-a-segfault-on-linux
    – jtpereyda
    Aug 21 '20 at 0:09
  • @jtpereyda it used to be cwd by default ; have no idea what modern restrictions might apply (e.g. apparmor and the like), and it is probably a good hint for e.g. daemon processes anyway Aug 23 '20 at 7:50

all the above did not worked for me... I looked at /var/log/apport.log:

cat /var/log/apport.log 

and I say the file name :

ERROR: apport (pid 3426) Mon Nov  8 14:34:07 2021: writing core dump to core._home_guest_a_out.1000.4 ... 

and than I search throughout all the system

sudo find . -name "core._home_guest_a_out.1000.4..."

I found the core dunp in /var/lib/apport/coredump/

  • It is beyond me why the core file gets written there instead of /var/crash (which everyone and their donkey is talking about), why apport does not log the full path, where to configure this and why there is hardly anything to be found for "/var/lib/apport/coredump" via Google. What are the Ubuntu people doing there?
    – frog.ca
    Nov 24 at 12:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.