I know when a program crashes, some files creating in /var/crash/. But I don't know what these files are!

Is that error logs?


No, they are crash dumps of the kernel, i.e. files that contains useful information to recover the state of the kernel when it was crashing. These files are for your kernel what core dumps are for ordinary executables. There exists an utility that can be used to analyze those files : crash.

  • 4
    The Debian package corekeeper actually stores normal coredumps in subfolders of /var/crash.
    – jofel
    Jun 25 '14 at 11:40
  • 1
    I think it would be worth to mention, that removing contents of /var/crash can make the System program problem detected popups go away on Ubuntu. Apr 13 '16 at 1:59

Filesystem Hierarchy Standard (FHS) quote

For directory function questions for Linux, you should also check the FHS: /var/crash : System crash dumps (optional) | linuxfoundation.org

It specifies /var/crash as:

/var/crash : System crash dumps (optional)

This directory holds system crash dumps. As of the date of this release of the standard, system crash dumps were not supported under Linux but may be supported by other systems which may comply with the FHS.

But as others mentioned, Debian has extended the standard for user space crashes as well via corekeeper.


In Ubuntu 14.04, it is Apport | Ubuntu Wiki instead of corekeeper that puts user space crashes there (corekeeper is not installed by default, but available on the repositories). Apport is the cause for the (in)famous "System problem detected" startup popup generated by the Apport program: System always start with "System program problem detected" dialog | Ask Ubuntu


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.