ABRT Replacement: Collect and Analyse Crashes with systemd-coredump

Updated: 28 September 2026 · Applies to: systemd-coredump (systemd 252 to 259) on AlmaLinux and Rocky Linux 9 and 10, RHEL 9 and 10, Ubuntu 24.04 and 26.04, Debian 13

ABRT (Automatic Bug Reporting Tool) collected crash reports on CentOS 7. It is no longer available: the abrt packages are not in the AlmaLinux, Rocky Linux or RHEL 9 and 10 repositories, nor in Ubuntu or Debian. Its job is now done by systemd-coredump, which catches every crashing program, stores a compressed core dump, and logs a short stack trace to the journal. coredumpctl lets you list and examine the crashes.

1. Check that it is active

cat /proc/sys/kernel/core_pattern

It should start with |/usr/lib/systemd/systemd-coredump. On AlmaLinux, Rocky Linux and RHEL this is the default. On Ubuntu and Debian, install it: apt install systemd-coredump.

2. List crashes

coredumpctl list
coredumpctl list nginx          # one program
coredumpctl list --since today

Each line shows the time, process ID, user, signal (for example SIGSEGV) and whether the core dump is still stored.

3. Look at a crash

coredumpctl info PID

This prints the program, command line, signal and a stack trace of the crashing thread, which is often enough to find the cause or to search for a known bug.

4. Debug it or send it to a developer

coredumpctl debug PID                 # opens gdb with the core dump (install gdb first)
coredumpctl dump PID -o /tmp/core.dump  # save the core dump to a file

For readable stack traces, install the debug symbols of the program. On AlmaLinux, Rocky Linux and RHEL, gdb suggests the exact dnf debuginfo-install command when you open the core dump.

5. Storage and limits

Core dumps are stored in /var/lib/systemd/coredump/ and cleaned up automatically. To change where and how much is kept, create /etc/systemd/coredump.conf.d/custom.conf:

[Coredump]
Storage=external
MaxUse=2G
ProcessSizeMax=4G

Storage=none keeps only the journal message, without the dump itself, which saves disk space on busy servers.

Privacy

Core dumps contain the memory of the crashed program, which can include passwords, keys and customer data. Keep them readable only by root, and share them only with people you trust.

Official documentation: coredumpctl and coredump.conf.