Application Errors

For every application error uberAgent collects metrics like application name and version, process lifetime as well as the exception code.

Note: processes are auto-grouped into applications, i.e. the application name is determined automatically without requiring any configuration. Information on how this works are available here.

Details

• Source type: uberAgent:Application:Errors
• Used in dashboards: Application Errors, Single Machine Detail, Single Application Detail, Single User Detail
• Enabled through configuration setting: ApplicationErrors
• Related configuration settings: n/a
• Supported platform: all for application crashes, Windows for application hangs

List of Fields in the Raw Agent Data

Field	Description	Data type	Unit	Measurement type	Example	Platform
ErrorType	Error type code. Possible values: 1, 2. Please take a look at the field ErrorTypeName, too.	Number		Snapshot	1	all
ProcName	Process name.	String		Snapshot	chrome.exe	all
ProcPath	Process path.	String		Snapshot	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	all
ProcVersion	Process version.	String		Snapshot	67.0.3396.99	all
ProcTimestamp	Build timestamp of the process binary, embedded PE header information.	String		Snapshot	2017-06-02 11:43:43.000 +0200	Windows
ModuleName	Faulting module name.	String		Snapshot	msvcrt.dll	all
ModulePath	Faulting module path.	String		Snapshot	C:\Windows\system32\msvcrt.dll	all
ModuleVersion	Faulting module version.	String		Snapshot	7.0.9600.17415	all
ModuleTimestamp	Build timestamp of the faulting module, embedded PE header information.	String		Snapshot	2014-10-29 04:04:30.000 +0200	Windows
ProcID	Process ID.	Number		Snapshot	456	all
ProcLifetimeMs	Process lifetime.	Number	ms	Sum	82744165	all
ExceptionCode	Exception code.	String		Snapshot	0xc0000005	all
FaultOffset	An address offset relative to the base address of the crashed image.	String		Snapshot	0x0000b5f0	all
AppPackageFullName	Microsoft UWP app full name. More information.	String		Snapshot	Microsoft.XboxGameCallableUI_1000.17134.1.0_neutral_neutral_cw5n1h2txyewy	Windows
AppPackageRelativeId	Microsoft UWP app relative ID. More information.	String		Snapshot	xbox	Windows
AppId	Associated application ID. Used by uberAgent to lookup application names and populate field AppName.	String		Snapshot	GglChrm	all
ProcUser	Process user.	String		Snapshot	Domain\JohnDoe	all
SessionGUID	Unique identifier that is generated by uberAgent when the session is created. Valid for this session only.	String		Snapshot	00000002-f295-9109-e7c7-c964011dd401	all
ProcGUID	Unique identifier that is generated by uberAgent when the process is started.	String		Snapshot	00000000-0599-6955-eb63-a00bb127d401	all
AppVersion	Application version.	String		Snapshot	67.0.3396.99	all
HangType	Hang type. Requires Windows 10 1903. Possible values: Cross-process, Cross-thread, Quiesce, Top level window is idle, Unknown.	String		Snapshot	Cross-process	Windows
ProcImageUUID	A unique identifier of the binary image that was executed.	String		Snapshot	D61D3713-69F9-32C3-B001-E509C0A8EE0A	macOS
ModuleImageUUID	A unique identifier of the binary image in which the crash occurred.	String		Snapshot	D61D3713-69F9-32C3-B001-E509C0A8EE0A	macOS

List of Calculated Fields

Field	Description	Data type	Unit	Measurement type	Where available	Example
ErrorTypeName	Display name of the ErrorType field. Possible values: Crash, Hang.	String		Snapshot	Splunk data model, Splunk SPL	Hang
User	User name.	String		Snapshot	Splunk data model	Domain\JohnDoe
AppName	Associated application name.	String		Snapshot	Splunk data model, Splunk SPL	Google Chrome