Reducing as much as possible the rate of software crashes is crucial especially in medical applications. In this paper, we make the assumption that crashes result from the user workflow, that is to say the sequence of user actions. Our objective is thus to identify root causes of crashes and to anticipate them in real-time, based on the analysis of the sequences of user actions. For these purposes, we introduce two methods. The first one consists in using graph-based representations to detect combinations of user actions having a high probability to provoke a software crash, thus identifying crash signatures and helping for problem resolution. The second one, based on clustering of user sessions, is a real-time monitoring method, computing a crash probability at each new user action. Test cases show promising results for both methods. Our representation of user session as 'Graph-of-Actions' enabled the identification of some significant crash signatures while revealing the impact of successive actions dependence on crash causes. Likewise, our clustering based method for session monitoring resulted in promising values of sensitivity and specificity for some specific clustering configurations.