Add WTI rule to detect usermode crashes (#13574)
Blue committed
Oct 7, 2025 at 15:52 UTC
8540b2b6f5f39d0d36bf1c35fcc2d742787db16a
1 file changed
+14
triage/config.yml
+14
@@ -211,6 +211,15 @@ rules:
211
capture:
212
field1: error
213
214
+ - logline:
215
+ provider: Microsoft.Windows.Lxss.Manager
216
+ task: LinuxCrash
217
+ set:
218
+ name: linux-crash
219
+ capture:
220
+ field3: linux-crash-path
221
+ field6: linux-crash-process
222
+
223
- logline:
224
provider: Microsoft.Windows.Lxss.Manager
225
set: wsl-service-logs
@@ -256,6 +265,11 @@ actions:
265
debug_message: 'Detected user visible error: $error'
266
skip_similar_issues: false
267
268
+ - foreach:
269
+ var: linux-crash
270
+ debug_message: 'Found evidence of linux crash: $linux-crash-process (dump: $linux-crash-path)'
271
+ skip_similar_issues: false
272
+
273
- foreach:
274
var: disk-attach-error
275
debug_message: 'Found evidence of disk failing to attach. Error: $error, Path: $vhdpath'