Crash Detection Check Reference

Configuration options for the crash detection check

Written By Erdinc Akay

Last updated About 2 months ago

Crash Detection Check Reference

The crash detection check looks for traces of system crashes (BSOD minidumps on Windows, kernel panic logs on Linux) and alerts when the count exceeds a threshold.

Configuration fields

Field	Type	Required	Default	Description
Lookback period (hours)	Hours (1–720)	No	24	How far back the check looks for crash traces. Values outside the range are clamped silently.
Warning count	Integer (1–100)	No	1	Number of crashes that triggers a warning. Values outside the range are clamped silently.
Critical count	Integer (1–100)	No	3	Number of crashes that triggers a critical result. Values outside the range are clamped silently.

Collected metrics

Number of detected crashes within the lookback period
Per-crash details: file name, timestamp, bug-check code (Windows WER events only), and a human-readable description

Platform support

Platform	Supported	Detection method
Windows	Yes	Minidump files in `C:\Windows\Minidump` and Windows Error Reporting events (`Microsoft-Windows-WER-SystemErrorReporting`, Event ID 1001)
Linux	Yes	`/var/crash`, `/var/lib/systemd/coredump/`, and kernel panic log entries
macOS	No	—

Notes

On Windows, minidump generation is enabled by default under System Properties → Startup and Recovery. If minidumps are disabled, the check still detects crashes via the Windows Error Reporting event log (Event ID 1001), which does not depend on minidump generation.
Each detected trace counts individually: every dump file and every Windows Error Reporting event within the lookback period is counted as one crash. A single crash that leaves both a minidump and a WER event can therefore be counted more than once — choose thresholds with that in mind.
The lookback period should match or exceed the check interval to avoid missing crashes between executions.
If the warning count is set higher than the critical count, the check silently swaps the two values so that the critical threshold is always greater than or equal to the warning threshold.