Inside a VPN Crash Report: Stack Trace or Memory Dump?

Crash notifications arrive with a file attached and one obvious next move: attach it to the ticket. Before doing that, find out what the file is. Crash artifacts range from a short text summary to a process dump holding whatever the application had in memory when it failed. Walking from the notification to the recipient is the only way to know which one you are holding.

A Dump Is Not a Log

Connection logs record selected events and usually pass through redaction before they are written. A process dump captures memory, and memory contains whatever happened to be there: hostnames, user paths, tokens in flight, fragments of rendered pages. Smaller dump types reduce the amount, and none of them promise to remove credentials. That difference matters because the two artifacts travel through different systems.

The log path may have been reviewed for privacy, while the crash facility uploads automatically to an endpoint nobody documented. Treat file size as a hint rather than a classification. A few hundred kilobytes can still hold a configuration fragment and an account name.

Find Who Owns the Collection

Three candidates can own a crash report: the application, the operating system's error reporting, or a monitoring library embedded in the client. Each has its own policy and its own recipient. Start with the settings page and the install directory, then confirm on the service list. An application that shows a crash dialog may still hand the dump to a system facility, and a library may send a copy without any dialog at all.

Write down what is automatic, what is optional, and where the file lands. That record answers most of what a privacy review will ask later. It also tells you which switch to turn off if the answer is that nothing should be sent.

Inspect the Artifact Before It Leaves

Look at the file on disk before attaching it to anything. Three commands answer different questions about it.

ls -lh ~/.local/share/vpn-client/crash/
file vpn-crash-2026-11-03.dmp
strings -n 8 vpn-crash-2026-11-03.dmp | head -40

The listing gives size and timestamp, which tells you whether this is even the incident you are investigating. The file command separates a minidump from a text report or an archive, and that decides how much review the artifact needs. The strings sample is the cheapest content check available, since paths, hostnames and server names usually appear in the first screen. Stop at sampling, because reading a full dump is forensic work and a partial look is not a redaction.

Choose a Channel You Can Name

Ask the vendor which dump type the investigation needs before collecting one. A full dump for a stack-trace question is more exposure than the case requires, and a small dump may not answer the question at all. Send the artifact through the verified private channel the vendor documents, not a public issue tracker. If a public report is unavoidable, attach only the text summary and quote specific frames with paths and account names removed.

Then clean up: remove temporary full-dump settings when the case closes, delete local copies you no longer need, and note the retention period beside the ticket. The tunnel's privacy promise covers the tunnel. The diagnostic pipeline is a separate promise that has to be read on its own.