Add WTI rule to detect usermode crashes (#13574)

This commit is contained in:
Blue 2025-10-07 15:52:56 -07:00 committed by GitHub
parent 05d6129c4f
commit 8540b2b6f5
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194

View File

@ -211,6 +211,15 @@ rules:
capture:
field1: error
- logline:
provider: Microsoft.Windows.Lxss.Manager
task: LinuxCrash
set:
name: linux-crash
capture:
field3: linux-crash-path
field6: linux-crash-process
- logline:
provider: Microsoft.Windows.Lxss.Manager
set: wsl-service-logs
@ -256,6 +265,11 @@ actions:
debug_message: 'Detected user visible error: $error'
skip_similar_issues: false
- foreach:
var: linux-crash
debug_message: 'Found evidence of linux crash: $linux-crash-process (dump: $linux-crash-path)'
skip_similar_issues: false
- foreach:
var: disk-attach-error
debug_message: 'Found evidence of disk failing to attach. Error: $error, Path: $vhdpath'