Understanding macOS Crash Reporting in ControlUp 2.18 through the Windows Event Log Data Source

Starting with version 2.18, the ControlUp agent introduced a new feature that captures macOS crash reports in a manner similar to how Windows crash events are reported. Specifically, macOS crash events are logged into the `win_event_log` data source. Despite the name suggesting Windows-specific logs, the `win_event_log` was retained for these macOS crash reports to maintain compatibility with existing dashboards, reports, and other analytics tools that use this data source.

In the `win_event_log`, macOS events can be identified by the `platform` column, which uses the value 2 to represent macOS. This mechanism allows users to distinguish between Windows and macOS crash events within the same log. It’s important to note that prior to version 2.18, the `platform` column was either absent or not used for such differentiation because macOS crash reporting was not implemented in this way. If the `platform` column is missing in your index, it likely means no macOS crash reports from version 2.18 or later have been collected yet.

When creating dashboards or queries to analyze these logs, you cannot filter on `os_name` with the expectation that macOS events will appear under Windows Event Log sources. Instead, you should query the `win_event_log` but use the `platform` column to separate macOS crash events from Windows ones. This approach leverages the backward compatibility of the log source naming while correctly distinguishing between operating systems in your monitoring views.

For more detailed guidance on working with macOS crash reports and the implications of their integration in the `win_event_log`, refer to ControlUp’s official documentation and the release notes for version 2.18. These resources offer comprehensive information about this feature and best practices for its usage.

Read the entire ‘Understanding macOS Crash Reporting in ControlUp 2.18 through the Windows Event Log Data Source’ thread below:

Clarity question – I recently noticed MacOS events are being written to win_event_log. Was that by design and introduced in MacOS beta? More so, how do you retrieve those fields in dashboards or other? Seems I cannot use Windows Event Log as a source with an os_name containing macOS

Hello Robert – if you are on 2.18, the new MacOS crash report feature reports crashes just like the Windows version, by creating a record in `win_event_log`. Even though that name implies Windows event log, it was chosen for dashboard, report, etc backwards compatibility.

MacOS crashes are distinguished by their platform column. This would be a 2 for MacOS.
Before 2.18 at least, Windows didn’t even report the platform column. So if the column doesn’t exist in the index, it is probably because no 2.18 MacOS app crash has been reported yet

This is great, appreciate the info. Gotta learn what these errors are that I’m seeing. Whole other ballgame that macOS is.

Continue reading and comment on the thread ‘Understanding macOS Crash Reporting in ControlUp 2.18 through the Windows Event Log Data Source’.  Not a member? Join Here!