The Vanishing Evidence
When a program crashes on a Linux system, it can generate a “core dump”—a file containing a snapshot of the program’s working memory at the exact moment it failed. These dumps are invaluable for developers trying to debug the crash. However, core dumps can be massive (several gigabytes), rapidly consuming hard drive space. Because of this, modern Ubuntu systems use utilities like `apport` or `systemd-coredump` to manage these files. By default, to protect your disk space, Ubuntu often automatically deletes old core dumps or restricts their creation entirely. If you are actively developing software or troubleshooting a persistent system crash, this automatic cleanup deletes the exact evidence you need.
Configuring systemd-coredump
To preserve debugging data and stop Ubuntu from automatically deleting core dumps (or refusing to save them), you must modify the configuration of the systemd-coredump utility.
Open a terminal window (Ctrl+Alt+T). You need to edit the configuration file with root privileges. Type sudo nano /etc/systemd/coredump.conf and press Enter (provide your password). Look through the file for the [Coredump] section. You will likely see settings that are commented out (starting with a #). To ensure dumps are saved and kept, you need to add or modify specific lines. Add Storage=external (to save them to `/var/lib/systemd/coredump`). To stop it from deleting them to save space, you must increase the limits. Add or modify MaxUse= and KeepFree=. For example, setting MaxUse=10G allows it to keep up to 10 gigabytes of dumps before it starts automatically deleting the oldest ones. Press Ctrl+O to save, then Ctrl+X to exit.