Application crash recurrence
Per-executable crash recurrence: which applications keep crashing on a host, and how often.
Topic id: app_crashes.
Full inventory every 8 hours. Supported changes are reported when the agent observes them.
Fields
One row per application with recurring crashes, counted over trailing windows. Separate from the crashes topic's per-crash occurrences: this tracks whether the SAME executable keeps crashing.
| Field | Type | Unit | Meaning |
|---|---|---|---|
sparklogs.data.app_crashes.app_name | string | The crashed executable's file name, lowercase: what the row counts. | |
sparklogs.data.app_crashes.process_classified | bool | Whether the pack's process class table names this executable. An unlisted one is graded no higher than Notice; a classified one climbs to its row's crash ceiling. | |
sparklogs.data.app_crashes.app_path | string | The newest crash's executable path. | |
sparklogs.data.app_crashes.app_version | string | The newest crash's executable file version. | |
sparklogs.data.app_crashes.failure_name | string | What ended the newest crash, by name. Windows: the .NET exception type when the runtime reported one, otherwise the exception code's NTSTATUS name from the pack's status-code table. Linux: the signal name. macOS: the Mach exception name. Absent when no name is known. | |
sparklogs.data.app_crashes.failure_space | string | The code table failure_code belongs to: ntstatus. Present whenever the code is, named or not; a .NET exception type in failure_name is not from that table. | |
sparklogs.data.app_crashes.failure_code | string | The newest crash's raw code. Windows: the exception code, 0x and 8 hex digits. Linux: the signal number. macOS: the Mach exception code. | |
sparklogs.data.app_crashes.fault_module | string | The module the newest crash record reports the fault in. Reported, not a cause. | |
sparklogs.data.app_crashes.fault_module_version | string | The fault module's file version. | |
sparklogs.data.app_crashes.blame_module | string | The module the newest analyzed dump blamed: the first on the crashing stack outside the operating system's own directories (Windows: not under the Windows directory; Linux and macOS: outside the system library directories). Where a debugger's first look points; not a proven cause. | |
sparklogs.data.app_crashes.blame_offset | string | The blamed frame's offset in blame_module, as hex. | |
sparklogs.data.app_crashes.managed_frame | string | The first line of the managed stack the runtime reported for the newest crash: on Windows the first at line of the .NET Runtime 1026 record; a Java or Python runtime's top frame where one reports it. Untrusted text. | |
sparklogs.data.app_crashes.count_1d | integer | count | Crashes of this application in the last day. Counts are kept per hour for the last day and per UTC day beyond it, so a crash in the hour the day began may be left out. |
sparklogs.data.app_crashes.count_5d | integer | count | Crashes of this application in the last five days, counted per hour for the last day and per UTC day beyond it: a crash on the day the window began may be left out. |
sparklogs.data.app_crashes.count_10d | integer | count | Crashes of this application in the last ten days, counted per hour for the last day and per UTC day beyond it, like count_5d. Rows are the 64 with the most. |
sparklogs.data.app_crashes.days_since_last | float | days | How long since this application's newest crash. |
sparklogs.data.app_crashes.quiet_awake_days | float | days | Host-awake quiet days since the later of this app's newest crash and uninterrupted Application-log reading. Sleep and low-power idle count zero; settle counts. Floored to 0.01 day, delaying a clear by less than 0.01 day. Absent when clock accounting is unknown. |
sparklogs.data.app_crashes.first_seen_ts | string | timestamp | The oldest crash of this application in the thirty-day history. |
sparklogs.data.app_crashes.last_crash_ts | string | timestamp | The newest crash of this application. |
sparklogs.data.app_crashes.last_analysis | string | What the newest crash's dump analysis did, as the occurrence's analysis says it. Absent for a crash reported before the agent kept it. | |
sparklogs.data.app_crashes.analyzed_count | integer | count | Crashes of this application in the history whose dump analysis completed. |
Conditions
A condition is a state that holds for a while. The agent opens it when the host enters it, keeps it open while it lasts, and closes it when the host comes back out, so one episode answers for the whole stretch instead of one alert per sample.
Example
Inventory (every 8 hours)
2 applications.
sparklogs.data.app_crashes.app_name: contoso.worker.exe
sparklogs.data.app_crashes.process_classified: false
sparklogs.data.app_crashes.count_1d: 2
sparklogs.data.app_crashes.count_5d: 2
sparklogs.data.app_crashes.count_10d: 2
SparkLogs: CONTEXT, Info, app_crashes: INVENTORY: 2 applications.
Inventory (every 8 hours)
0 applications.
SparkLogs: CONTEXT, Info, app_crashes: INVENTORY: 0 applications.
Signal details
app_crash_recurring
One application is crashing repeatedly on this host.
Impact: Users or services depending on this application lose work or availability each time it crashes. Compare crash details across the individual crash records for the same executable to narrow the cause.
Example
started; executable "contosohelper.exe" crashed 3 times in the last 5d (threshold 3)
sparklogs.instance: executable:contosohelper.exe
sparklogs.data.app_crashes.app_name: contosohelper.exe
sparklogs.data.app_crashes.process_classified: false
sparklogs.data.app_crashes.count_1d: 1
sparklogs.data.app_crashes.count_5d: 3
sparklogs.data.app_crashes.count_10d: 3
SparkLogs: app_crash_recurring, Display, app_crashes: app_crash_recurring: NOTABLE: started; executable "contosohelper.exe" crashed 3 times in the last 5d (threshold 3)
| Case | Severity | Ticket class |
|---|---|---|
onset | Trace to Fatal | app_stability |
held | Trace to Fatal | app_stability |
recovered | Trace to Fatal | app_stability |
Where to look next:
- Check whether the application was recently updated or changed around when the recurrence began.
- A single crashy helper process can be excluded from escalation by its own class and tier in the process classification table.
Related reasons:
kernel_crash_recurring: the host-wide sibling: recurring crashes of the OS itself rather than one applicationprocess_crash: one row per crashed process; this condition tracks the same application's crash rate over time