topic Process Crash event.name change? in Alerting

Process Crash event.name change?

StrangerThing — Mon, 14 Apr 2025 07:16:27 GMT

I had a "Crash Alerter" Workflow that was looking for event.name containing "Process crashed". This trigger used to work just fine and catch all the process crash events I was looking for. However, recently I noticed that the event.name has changed for this event type (and potentially others). Is there a way to be notified when important events like that have a name (or other field) change? I'm assuming this was rolled out with some tenant release, but I haven't checked the release notes yet. This was a breaking change for me and we missed out on some crucial alerting with my event-driven Workflow.

Re: Process Crash event.name change?

m3tomlins — Fri, 11 Apr 2025 17:28:42 GMT

Maybe changes like this were in the release notes, but we missed it?

Re: Process Crash event.name change?

p_devulapalli — Mon, 14 Apr 2025 07:37:58 GMT

@StrangerThing I still see the "event.name: Process crashed" showing up in events , what is that its changed to in your environment ?

Re: Process Crash event.name change?

StrangerThing — Mon, 14 Apr 2025 13:52:39 GMT

It's changed to "<process name> has crashed" in all my tenants.

Re: Process Crash event.name change?

p_devulapalli — Mon, 14 Apr 2025 22:59:06 GMT

@StrangerThing I think these changes could be due to the version of OneAgent used rather than a cluster version. I see older OneAgents are still using the "event.name: Process crashed" but its different for hosts with new OneAgent versions . At least this is what I observed .

You might still be able to use "event.group_label:Process crashed" instead to trigger the workflow as that's available.

Re: Process Crash event.name change?

StrangerThing — Tue, 15 Apr 2025 14:57:21 GMT

I've already changed my workflow to make sure I catch crashes through three different fields. My point is that I don't think this kind of change was very well communicated.

Re: Process Crash event.name change?

p_devulapalli — Tue, 15 Apr 2025 22:26:40 GMT

@StrangerThing Agreed, this should have been better documented