15

If an application crashes in Windows we can check the Event Viewer in the Administration tools to see what has crashed. Sometimes it has useful information others not, but it is a start.
In linux if an application (any) crashes how one starts to trace what happened?
Is there e.g. some central log or something similar?

3
  • 4
    The standard way of debugging this kind of thing is to launch the problematic application from a terminal manually. That way you can see any error messages printed.
    – terdon
    Jan 22, 2014 at 21:55
  • 2
    64-bit versions of Linux will log a short description of a crashed process (one that died due to a signal) in /var/log/syslog. Linux provides a way for a daemon to be notified of process crashes. Ubuntu's apport and Red Hat's abrt use this to provide centralized logging and report-generation facilities. Generally a core dump is saved so that you can invoke a debugger on the crashed program. Jan 22, 2014 at 22:58
  • I would have upvoted this question, but the OP does not seem to want to help the community by accepting, or posting, an answer, so I will find a similar question which does accept an answer and upvote that, in the hope that it will rise to the top of search results and help future searchers
    – Mawg
    Oct 13, 2016 at 9:26

4 Answers 4

15

Is there e.g. some central log or something similar?

The normal place for system logs is /var/log/. What gets put in each log depends on the syslog configuration, but commonly everything except logins goes to /var/log/syslog.

This is no guarantee that individual applications will have left any clue there in the event of a problem. But they, or the shell, will likely spit something to the standard out/standard error streams, and if you run a troublesome application in the foreground from a terminal you'll be able to see that stuff.

3
  • 1
    What should one look for in /var/log?Which log file?Is there some convention?
    – Jim
    Jan 22, 2014 at 21:53
  • 3
    If you can make the crash happen, do so, then see which file under /var/log was most recently changed. With ls -lart, the last file in the listing was the most recently changed. Jan 22, 2014 at 22:36
  • 1
    There are conventions -- linux is much more heterogeneous than windows. Syslog refers to the system logger, but there is not a universal implementation, and the variations can then be configured in different ways. The general logic is that messages are sent to syslog by the application, and these messages are then sorted into different files. As mentioned, commonly everything ends up in /var/log/syslog, but different distros do things differently. If you know what which syslog you are using, you can examine its configuration to determine this.
    – goldilocks
    Jan 22, 2014 at 22:57
10

On Ubuntu segfaults get written at /var/log/kern.log. I tested it by creating a program that segfaults:

void main() {
    int *a=0;
    *a=0;
}

After it segfaulted there was this line in /var/log/kern.log:

a.out[534]: segfault at 0 ip 08048432 sp bfaec8c0 error 6 in a.out[8048000+1000]
3

In Ubuntu if you are launching your application from a .desktop launcher file, add the option Terminal=true to your .desktop file.

0

Run the daemon exec barely in the command line, instead of being taken over by systemd, then you will get the full crashing stack info from the stdout when the crash is reproduced. It will save lots of time to blindly adding trace log everywhere.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .