Kernel crash signature recurrence
0readings
0conditions
0themes fed
Livestatus
Which bug check signature is recurring on a host, separate from the overall kernel crash recurrence.
Topic id: kernel_crashes.
Full inventory every 8 hours. Supported changes are reported when the agent observes them.
Fields
One row per bug check signature with recurring crashes, counted over trailing windows. Separate from the crashes topic's host-wide recurrence: this tracks whether the SAME signature keeps recurring.
| Field | Type | Unit | Meaning |
|---|---|---|---|
sparklogs.data.kernel_crashes.signature | string | What the row counts, lowercase: failure_code, then ` | |
sparklogs.data.kernel_crashes.failure_name | string | The crash's name. Windows: the bugcheck name, from the pack's bugcheck table. Linux: the kernel panic string. macOS: the panic string. Absent when no name is known. | |
sparklogs.data.kernel_crashes.failure_space | string | The code table failure_code belongs to: bugcheck. Always present on Windows, named or not. | |
sparklogs.data.kernel_crashes.failure_code | string | The raw stop code. Windows: the bugcheck code, 0x and 8 hex digits. Linux and macOS: a kernel panic carries no numeric code. | |
sparklogs.data.kernel_crashes.failure_params | string_array | The newest crash's four bugcheck parameters, as hex. Windows only: no other system records stop parameters. | |
sparklogs.data.kernel_crashes.blame_module | string | The module the newest dump's analysis, complete or partial, blamed: the first on the crashing stack that is not the operating system's own (Windows: outside the agent's list of in-box kernel modules, so a vendor driver is blamed; Linux and macOS: outside the kernel's own image and module tree). Part of the signature. | |
sparklogs.data.kernel_crashes.blame_offset | string | The blamed frame's offset in blame_module in the newest dump whose analysis, complete or partial, blamed it, as hex. | |
sparklogs.data.kernel_crashes.count_1d | integer | count | Crashes of this signature in the last day, counted from the crash history: distinct crashes, not dump files. |
sparklogs.data.kernel_crashes.count_5d | integer | count | Crashes of this signature in the last five days. |
sparklogs.data.kernel_crashes.count_10d | integer | count | Crashes of this signature in the last ten days. Rows are the 64 with the most. |
sparklogs.data.kernel_crashes.days_since_last | float | days | How long since this signature's newest crash. |
sparklogs.data.kernel_crashes.quiet_awake_days | float | days | Host-awake quiet days since the later of this signature's newest crash and uninterrupted System-log reading. Sleep and low-power idle count zero; settle counts. Floored to 0.01 day, delaying a clear by less than 0.01 day. Absent when clock accounting is unknown. |
sparklogs.data.kernel_crashes.first_seen_ts | string | timestamp | The oldest crash of this signature in the thirty-day history. |
sparklogs.data.kernel_crashes.last_crash_ts | string | timestamp | The newest crash of this signature. |
sparklogs.data.kernel_crashes.last_analysis | string | What the newest crash's dump analysis did, as the occurrence's analysis says it. Absent for a crash reported before the agent kept it. | |
sparklogs.data.kernel_crashes.analyzed_count | integer | count | Crashes of this signature in the history whose dump analysis completed. |
sparklogs.data.kernel_crashes.architecture | string | The newest analyzed dump's architecture: x64, x86, arm64 or other. | |
sparklogs.data.kernel_crashes.os_build | integer | The operating system build the newest analyzed dump was written on. | |
sparklogs.data.kernel_crashes.dump_format | string | The newest analyzed dump's format: kernel_triage, kernel_full or kernel_bitmap. |
This topic reports what the host looks like rather than scoring a condition on it. The values it carries are queryable on their own.
Example
Inventory (every 8 hours)
3 signatures.
sparklogs.data.kernel_crashes.signature: 0x0000009f
SparkLogs: CONTEXT, Info, kernel_crashes: INVENTORY: 3 signatures.
Inventory (every 8 hours)
0 signatures.
SparkLogs: CONTEXT, Info, kernel_crashes: INVENTORY: 0 signatures.