If an application crashes in Windows we can check the Event Viewer in the Administration tools to see what has crashed. Sometimes it has useful information others not, but it is a start.
In linux if an application (any) crashes how one starts to trace what happened?
Is there e.g. some central log or something similar?
4 Answers
Is there e.g. some central log or something similar?
The normal place for system logs is /var/log/. What gets put in each log depends on the syslog configuration, but commonly everything except logins goes to /var/log/syslog.
This is no guarantee that individual applications will have left any clue there in the event of a problem. But they, or the shell, will likely spit something to the standard out/standard error streams, and if you run a troublesome application in the foreground from a terminal you'll be able to see that stuff.
-
1What should one look for in
/var/log?Which log file?Is there some convention?Jim– Jim2014-01-22 21:53:38 +00:00Commented Jan 22, 2014 at 21:53 -
3If you can make the crash happen, do so, then see which file under /var/log was most recently changed. With
ls -lart, the last file in the listing was the most recently changed.Devon_C_Miller– Devon_C_Miller2014-01-22 22:36:17 +00:00Commented Jan 22, 2014 at 22:36 -
1There are conventions -- linux is much more heterogeneous than windows. Syslog refers to the system logger, but there is not a universal implementation, and the variations can then be configured in different ways. The general logic is that messages are sent to syslog by the application, and these messages are then sorted into different files. As mentioned, commonly everything ends up in
/var/log/syslog, but different distros do things differently. If you know what which syslog you are using, you can examine its configuration to determine this.goldilocks– goldilocks2014-01-22 22:57:28 +00:00Commented Jan 22, 2014 at 22:57
On Ubuntu segfaults get written at /var/log/kern.log. I tested it by creating a program that segfaults:
void main() {
int *a=0;
*a=0;
}
After it segfaulted there was this line in /var/log/kern.log:
a.out[534]: segfault at 0 ip 08048432 sp bfaec8c0 error 6 in a.out[8048000+1000]
In Ubuntu if you are launching your application from a .desktop launcher file, add the option Terminal=true to your .desktop file.
Run the daemon exec barely in the command line, instead of being taken over by systemd, then you will get the full crashing stack info from the stdout when the crash is reproduced. It will save lots of time to blindly adding trace log everywhere.
/var/log/syslog. Linux provides a way for a daemon to be notified of process crashes. Ubuntu's apport and Red Hat's abrt use this to provide centralized logging and report-generation facilities. Generally a core dump is saved so that you can invoke a debugger on the crashed program.