Crash dump configuration
Whether this host can produce a usable crash dump, and whether it recently did.
Topic id: crash_dump_config.
This topic is still rolling out. Endpoints on the general release do not send it yet.
Conditions
A condition is a state that holds for a while. The agent opens it when the host enters it, keeps it open while it lasts, and closes it when the host comes back out, so one episode answers for the whole stretch instead of one alert per sample.
| Condition | Severity | How an episode ends |
|---|---|---|
recurring crash dumps (os_bsod_recurring) | Minor to Critical | It closes on a recovery rule written for this condition, which reads more than one measurement together. |
page file too small for the dump (os_dump_pagefile_too_small) | Notice | It closes when the measurement falls back past its recovery point. |
Occurrences
An occurrence is a thing that happened and was discovered, rather than a state that holds. It is announced once and has no closing event.
| Occurrence | What it means |
|---|---|
os_crash_dump_new | new crash dump |
Example
Inventory (every 8 hours)
dump posture.
sparklogs.data.crash_dump_config.dump_type: automatic
sparklogs.data.crash_dump_config.pagefile_max_bytes: 17179869184
sparklogs.data.crash_dump_config.bsod_count_1d: 0
sparklogs.data.crash_dump_config.bsod_count_5d: 0
sparklogs.data.crash_dump_config.bsod_count_10d: 0
sparklogs.data.crash_dump_config.pagefile_shortfall_pct: -6300.0
SparkLogs: CONTEXT, Info, crash_dump_config: INVENTORY: dump posture.
Selected conditions
os_bsod_recurring
The host is bugchecking repeatedly.
Impact: Repeated bugchecks can interrupt users and services and require crash-dump analysis.
Example
started; bugchecks in five days 5 (threshold 5)
sparklogs.data.crash_dump_config.bsod_count_1d: 2
sparklogs.data.crash_dump_config.bsod_count_5d: 5
sparklogs.data.crash_dump_config.bsod_count_10d: 5
SparkLogs: os_bsod_recurring, Severe, crash_dump_config: os_bsod_recurring: NOTABLE: started; bugchecks in five days 5 (threshold 5)
os_dump_pagefile_too_small
The page file is too small for the configured crash dump.
Impact: A future bugcheck may fail to write the expected dump.
Example
started; page file short of the dump 50% (threshold 10%)
sparklogs.data.crash_dump_config.pagefile_shortfall_pct: 50.0
SparkLogs: os_dump_pagefile_too_small, Notice, crash_dump_config: os_dump_pagefile_too_small: NOTABLE: started; page file short of the dump 50% (threshold 10%)
os_crash_dump_new
A new crash dump appeared.
Impact: The host recently bugchecked.
Example
crash dump written. dump="071726-11250-01.dmp" written="2026-07-17T07 00 00Z" size_bytes="291456".
SparkLogs: os_crash_dump_new, Warning, crash_dump_config: os_crash_dump_new: NOTABLE: crash dump written. dump="071726-11250-01.dmp" written="2026-07-17T07 00 00Z" size_bytes="291456".