anyone have any ideas on queries to detect kernel dump and memory dump events?