Splunk AppDynamics

iOS crash reports are not symbolicated fully

CommunityUser
Splunk Employee
Splunk Employee

We upload dSYM zip and are able to verify that UUIDs of our dSYMs are accepted.

E.g. for crash-symbol-file-query/dsym I see something like this:

... {"uploadTime":"12/22/2017 13:50:34","UUID":"CB337DD0-E73F-3FC2-9C4E-91A3C880B573"} ...

 

In a crash log I'd see this UUID for the binary image of our app:

 

... <cb337dd0e73f3fc29c4e91a3c880b573> ...

So they are matching.

dwarfdump of the dSYM also shows:

UUID: CB337DD0-E73F-3FC2-9C4E-91A3C880B573 (arm64) ...

However I can observe the following in the crash log.

1. Symbolicated field in Crash Snapshots screen shows "false" for all crash logs.

2. In the actual crash logs, OS symbols are symbolicated. E.g.

7   UIKit                          0x000000018a7e6a7c -[UIControl touchesEnded:withEvent:] + 572

2. Symbols of our own app are not symbolicated (binary image with UUID: CB337DD0-E73F-3FC2-9C4E-91A3C880B573)

3. Some symbols are symbolicated incorrectly. E.g. for one of our frameworks, base address + offset that have different offset values are always resolved to the same symbol, and that symbol does not make sense.

When I download the raw crash log from the controller and the dSYM zip from the build server - I am able to symbolicate the crash log locally on my mac, using Xcode's symbolicatecrash script.

Note that we include several frameworks so all dSYMs are zipped up together into a single zip file.

Please advise why AppDynamics controller is not able to symbolicate when it works fine locally.

Labels (1)
Tags (1)
0 Karma

Mohammed_Rayan
Contributor

Denis,

Can you let us know what's the exact version of your controller and the Mobile IOS Agent being used 

Regards,

Mohammed Rayan

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

Hi Mohammed,

Our controller is Version 4.2.9.2, build 48.

Our agent is 4.3.3.0.

I also tried 4.4.0.675.

Thanks

Denis

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

I have now also tried iOS Agent 4.2.15.0 - same results.

This is an example of symbols not making much sense. In the same stack trace (as viewed in the controller) we'd have something like:

...
0x0000000104a1d790 ADEumSetFullLogging + 15000
...
0x0000000104a1db10 ADEumSetFullLogging + 15896
...

When I download the crash log, replace the symbol back with a base address and symbolicate using Xcode's script I'd see something like:

...
0x0000000100bff1ec -[UIApplication+ 18088 (instrumentation) ADEumSendAction:to:from:forEvent:] + 316
...
0x0000000100bff5ac -[UIApplication+ 19048 (instrumentation) ADEumSendEvent:] + 896
...
0 Karma

Mohammed_Rayan
Contributor

Denis,

Can you attach the crash report from your controller and dsym list api output to check this further

Regards,

Mohammed Rayan

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

Hi Mohammed,

Do you have an email I can send the details to?

Thanks

Denis

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...