Abrt sometimes deleting all crashes
by Christian Stadelmann
Lately, I'm seeing a weird behavior of abrt happening over and over again:
Although I have just a few (say, 4) smaller crashes (not WebKit or Firefox), which take up little space on my disk, when a new crash happens, some or even all crashes are deleted. abrtd then reports to syslog:
abrtd[896]: Size of '/var/spool/abrt' >= 25000 MB (MaxCrashReportsSize), deleting old directory 'ccpp-2016-12-…
This way, I never get more than 6 crashes listed by gnome-abrt or abrt-cli. Sometimes, abrt even deletes all my crash directories, including small python backtraces with just a few megabytes.
I don't understand why this happens. Can you please tell me? Is this a bug?
After the last crash happened (firefox, https://bugzilla.redhat.com/show_bug.cgi?id=1404439), all crashes were deleted. This is the filesystem state of abrt directories after that crash:
/var/cache/abrt-di is 800 MB although there is no crash present any more.
/var/spool/abrt-upload is empty.
/var/spool/abrt and /var/lib/abrt and /var/run/abrt just contain some very small files.
This is all abrt-related stuff in my syslog from last boot, where abrt deleted all my crashes (19:25:58): https://gist.github.com/anonymous/348e3101aa18c5f0d862f8396a3f97f0
I already tried to purge/delete all the files listed above and reinstall all of abrt, but there is no change, the issue doesn't go away.
Two probably unrelated questions:
1. I know that the "firefox" package is signed with a proper key, but I installed it from command line after manually downloading it from koji. Abrt throws away this crash and logs:
Dez 13 21:13:14 hostname abrt-hook-ccpp[3199]: Process 30672 (firefox) of user 1000 killed by SIGSEGV - dumping core
Dez 13 21:13:15 hostname abrt-hook-ccpp[3199]: Failed to create core_backtrace: PTRACE_SEIZE (tid 30766) failed: Operation not permitted
Dez 13 21:13:15 hostname abrt-server[3202]: Package 'firefox' isn't signed with proper key
Dez 13 21:13:15 hostname abrt-server[3202]: 'post-create' on '/var/spool/abrt/ccpp-2016-12-13-21:13:14-30672' exited with 1
Dez 13 21:13:15 hostname abrt-server[3202]: Deleting problem directory '/var/spool/abrt/ccpp-2016-12-13-21:13:14-30672'
What am I doing wrong?
Because of abrt deleting my crashes, I get these a lot: "ignoring (repeated crash)". How can I reset abrt's behavior about crashes it has seen before?
7 years, 4 months
Re: Fwd: Abrt sometimes deleting all crashes
by Miroslav Suchý
> Lately, I'm seeing a weird behavior of abrt happening over and over again:
>
> Although I have just a few (say, 4) smaller crashes (not WebKit or
> Firefox), which take up little space on my disk, when a new crash
> happens, some or even all crashes are deleted. abrtd then reports to
> syslog:
> abrtd[896]: Size of '/var/spool/abrt' >= 25000 MB
> (MaxCrashReportsSize), deleting old directory 'ccpp-2016-12-…
>
> This way, I never get more than 6 crashes listed by gnome-abrt or
> abrt-cli. Sometimes, abrt even deletes all my crash directories,
> including small python backtraces with just a few megabytes.
>
> I don't understand why this happens. Can you please tell me? Is this a bug?
See /etc/abrt/abrt.conf:
# Max size for crash storage [MiB] or 0 for unlimited
#
MaxCrashReportsSize = 1000
--
Miroslav Suchy, RHCA
Red Hat, Senior Software Engineer, #brno, #devexp, #fedora-buildsys
7 years, 4 months