I posted this question to StackOverflow a little while ago, but just now found this community, and felt like this is at least an equally appropriate site for this question:

I've been led to understand that if abrt-ccpp.service is installed on a Linux PC, it supersedes/overwrites (I've read both, not sure which is true) the file /proc/sys/kernel/core_pattern, which otherwise specifies the location and filename pattern of core files.


When I execute systemctl, why does abrt-ccpp.service report exited under the SUB column? I don't understand the combination of active and exited: is the service "alive"/active/running or not?

> systemctl
UNIT                 LOAD   ACTIVE SUB
abrt-ccpp.service    loaded active exited ...


Where are core files generated? I wrote this program to generate a SIGSEGV:

#include <iostream>

int main(int argc, char* argv[], char* envz[])
  int* pInt = NULL;
  std::cout << *pInt << std::endl;
  return 0;

Compilation and execution as follows:

> g++ main.cpp
> ./a.out
Segmentation fault (core dumped)

But I cannot locate where the core file is generated.

What I have tried:

  • Looked in the same directory as my main.cpp. Core file is not there.
  • Looked in /var/tmp/abrt/ because of the following comment in /etc/abrt/abrt.conf. Core file is not there.


# Specify where you want to store coredumps and all files which are needed for
# reporting. (default:/var/tmp/abrt)
# Changing dump location could cause problems with SELinux. See man_abrt_selinux(8).
#DumpLocation = /var/tmp/abrt


  • Looked in /var/spool/abrt/ because of a comment at this link. Core file is not there.
  • Edited /etc/abrt/abrt.conf and uncommented and set DumpLocation = ~/foo which is an existing directory. Followed this by restarting abrt-hook-ccpp (sudo service abrt-ccpp restart) and rerunning a.out. Core file was not generated in ~/foo/
  • Verified that ulimit -c reports unlimited.

I am out of ideas of what else to try and where else to look.

In case helpful, this is the content of my /proc/sys/kernel/core_pattern:

> cat /proc/sys/kernel/core_pattern
|/usr/libexec/abrt-hook-ccpp %s %c %p %u %g %t e

Can someone help explain how the abrt-hook-ccpp service works and where it generates core files? Thank you.

2 Answers 2


One possibility is the need to change the line in the config file /etc/abrt/abrt-action-save-package-data.conf

ProcessUnpackaged = no

to yes, otherwise abrtd will only capture corefiles from programs installed by the package manager (dnf, apt, or whatever). Use abrt-gui or abrt-cli to look for core dumps.

  • Brilliant! Thank you! I'm newish to Linux and am frequently overwhelmed by the multiple of config files associated with many programs, and would likely not have found my way to this file without your guidance. Thanks again.
    – StoneThrow
    Feb 7, 2017 at 20:10

Apart of what meuh said, once the crash information has been collected by the abrt daemon (after restarting it once you modify the mentioned configuration file) you can use abrt-cli or abrt-gui to see where is that information.

# abrt-cli -a ls
id xxxxxxxxxxxxxxxxxx
reason:         MYPROGRAM killed by SIGABRT
time:           Thu 10 Jan 2019 11:48:07 AM CET
cmdline:        ./myExecutable
uid:            1001
Directory:      /var/spool/abrt/ccpp-2019-01-10-11:48:07-17559
Run 'abrt-cli report /var/spool/abrt/ccpp-2019-01-10-11:48:07-17559' for creating a case in Red Hat Customer Portal

In the provided directory you will find the coredump file.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .