You could try passing a core file to apport when there is not a graphical shell running via a command like the following:
/usr/share/apport/apport <pid> <signal number> <core file ulimit> <dump mode> < $my-pretend.core With that you should get a .crash file in /var/crash. Here's an example where 11736 was a running xeyes process and core was real crashdump file. $ /usr/share/apport/apport 11736 11 0 1 < /etc/X11/core ERROR: apport (pid 11743) Fri Feb 2 14:47:35 2018: called for pid 11736, signal 11, core limit 0, dump mode 1 ERROR: apport (pid 11743) Fri Feb 2 14:47:35 2018: executable: /usr/bin/xeyes (command line "xeyes") ERROR: apport (pid 11743) Fri Feb 2 14:47:35 2018: debug: session gdbus call: (true,) ERROR: apport (pid 11743) Fri Feb 2 14:47:49 2018: wrote report /var/crash/_usr_bin_xeyes.1000.crash Keep in mind that if you stop the apport service /proc/sys/kernel/core_pattern will revert back to the default which is just core. $ cat /proc/sys/kernel/core_pattern core So it's likely apport wasn't running on the system and is not the issue. ** Changed in: apport (Ubuntu) Status: Confirmed => Incomplete -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to mutter in Ubuntu. https://bugs.launchpad.net/bugs/1746874 Title: gnome-shell and Xwayland sometimes leave $HOME/core files (should be /var/crash files) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1746874/+subscriptions -- desktop-bugs mailing list desktop-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/desktop-bugs