Reading Apport .crash Files on Ubuntu and WSL
.crash files on Ubuntu are generated by Apport, Ubuntu’s crash reporting system. They use a custom key-value format that’s straightforward to work with once you know the tools. Here’s how to diagnose a .crash file on your WSL Ubuntu installation.
Quick Look at the Structure
The .crash file is essentially a text file with some base64-encoded binary sections. Start by viewing the text portions:
# See all the key names in the file
grep "^[A-Za-z]" /path/to/your_file.crash | head -40
Using apport-retrace
Install the Apport tools on your WSL Ubuntu:
sudo apt update
sudo apt install apport apport-retrace
Then unpack the crash file into a readable directory:
apport-unpack /path/to/your_file.crash /tmp/crash-unpacked
This extracts every field into a separate file under /tmp/crash-unpacked/. You’ll get files like Traceback, ProcStatus, ProcMaps, CoreDump, Stacktrace, etc.
Reading the Most Useful Fields
cd /tmp/crash-unpacked
# What crashed
cat ExecutablePath
# Why it crashed (signal info)
cat Signal
# Python traceback (if it's a Python service)
cat Traceback
# Process status at time of crash
cat ProcStatus
# Memory maps
cat ProcMaps
# Stack trace (if available — may need retrace)
cat Stacktrace
# Any stderr output
cat ProcCmdline
These fields will help you diagnose what caused the crash.