Correct audit.app.crash to app.crash

[gogolok]

I'm writing a tool that forwards CF audit events to another audit system.
I was checking for all audit types on our CF latform and noticed that I could not find type audit.app.crash, but app.crash instead.

For an example, see an anonymized audit event for type app.crash:

https://github.com/gogolok/cfauditevents-samples/blob/main/app.crash.json

Then I took a look at the cloud_controller_ng code base and found similar proof:

https://github.com/cloudfoundry/cloud_controller_ng/blob/2b5ac3a84600354fe1e7aa8033d8b4e41c22b3db/app/repositories/event_types.rb#L149

[beyhan]

I can confirm that a crashed app logs following events:

Getting events for app test in org test / space test as ...
time                          event                       actor                 description
2025-10-20T16:41:34.00+0200   app.crash                   test                  index: 0, reason: CRASHED, cell_id: fe8b9046-393f-4985-b152-6d2186834c13, instance: de9cff15-12f7-480c-6f65-7361, exit_description: APP/PROC/WEB: Exited with status 1
2025-10-20T16:41:34.00+0200   audit.app.process.crash     web                   index: 0, reason: CRASHED, cell_id: fe8b9046-393f-4985-b152-6d2186834c13, instance: de9cff15-12f7-480c-6f65-7361, exit_description: APP/PROC/WEB: Exited with status 1

I don't know the full history around audit events and can't comment whether this changed at some point or was wrongly documented and no one noticed.

[akop]

I've just verified that app.crash event is in the api docs in the special events section: https://v3-apidocs.cloudfoundry.org/version/3.205.0/index.html#audit-events

I would vote to merge this PR.

[stephanme]

app.crash is what the CC generates today.

I find app.crash and audit.app.process.crash inconsistent. I don't know about the history. Maybe all events should be prefixed with audit or the intention was to have an audit prefix for user initiated events only.

But this is a separate discussion. Let's first document the reality.