/var/crash/* disappear after reboot

[Michal Toman]

On 2012/10/04 09:48, Cong Wang  wrote:
> On 04/09/2012 05:32 PM, Dave Young wrote:
>> On 04/09/2012 04:55 PM, Nikola Pajkovsky wrote:
>>
>> From kdump side of view, the vmcore should be there instead of being
>> deleted, It's the default behaviour. Could the abrt keep them?
>>
>> I can not think out why it will delete them if user/customer intend to
>> capture and save them vmcore there.
>>
>
> Me neither. vmcore should be stored for further kernel debugging.

 From kdump side of view nothing changes. It really writes the vmcore to 
/var/crash.

The "disappearing" happens after reboot, when abrt-vmcore service 
processes it. The vmcore itself is not deleted, but moved to 
/var/spool/abrt/vmcore-{whatever}/vmcore so that it can be processed 
like any other ABRT problem. You can still access it there, nothing is 
lost. In addition, ABRT provides tools to automatically install 
appropriate kernel debuginfo, extract the oops message and report it to 
Bugzilla.

If you still want the old behavior, you can simply disable the 
abrt-vmcore service and ABRT will not touch the vmcore at all.

Michal