The Vanishing Evidence
Ubuntu utilizes a robust crash reporting system called “Apport.” When a program crashes (e.g., Firefox segmentation fault or a GNOME shell error), Apport generates a detailed `.crash` file containing a core dump and stack trace, storing it in the `/var/crash/` directory. This data is invaluable for developers attempting to debug the issue. However, by default, Ubuntu runs a daily cron job that automatically clears out this directory, deleting old crash reports to save disk space. If you experience a critical crash late at night and forget to extract the logs, you might wake up to find that Ubuntu has automatically deleted the evidence, making troubleshooting impossible.
Preserving the Core Dumps
To ensure you always have access to historical crash data and stop Ubuntu from automatically purging the `/var/crash/` directory, you must disable or modify the specific cleanup script.
The automatic deletion is handled by a script associated with the `apport` package, usually triggered by `systemd` timers or `cron.daily`. Open your terminal (Ctrl+Alt+T). You need to edit the configuration file that dictates Apport’s behavior. Type: sudo nano /etc/default/apport and press Enter. Look for the configuration line that dictates the maximum age of crash files (this varies by Ubuntu version, but is often handled by a separate cron job). The most foolproof way to stop the automated purge is to disable the `apport-autoreport` service entirely. Type: sudo systemctl disable apport-autoreport.timer and sudo systemctl stop apport-autoreport.timer. Your crash reports will now sit safely in `/var/crash/` until you manually delete them using the `rm` command.