Finding useful crash data and Windows Error Reporting (WER)


Also check out http://blogs.msdn.com/wer/pages/faq.aspx#weronpc


Application Log


Whenever an application crashes (faulting application) you should get the message <application name> stopped working. Once that occurs the crash details get logged in the Application Log as an Error event. If the report is sent to Microsoft the Application Log will also have an Information event that contains a Bucket ID.


 


On Windows Vista, you can open Event Viewer by clicking the Start button Picture of the Start button, clicking Control Panel, clicking System and Maintenance, clicking Administrative Tools, and then double-clicking Event Viewer.? Administrator permission required If you are prompted for an administrator password or confirmation, type the password or provide confirmation.


Expand Windows Logs and select Application to select the Application log:

image

Look on the right, a crash in an Office application should be an Error under the Level column, Application Error under the Source column, and 1000 under the Event ID column.

Crash

image

Example: crash from Outlook

image

Fault Bucket (bucket ID)

If the report was sent to us (Microsoft) there should be an Information event with Windows Error Reporting under the Source column and event ID 1001, with all the data gathered in the details.

On support calls, the piece of data that’s most important to me is the Fault bucket that’s reported. I’ll usually refer to it as the bucket ID.

image

Problem Reports and Solutions (new in Vista)

A new feature in Windows Vista is Problem Reports and Solutions in the Control Panel under the System and Maintenance category (if you don’t have Classic View turned on). This will contain all the crash and hang events that occurred on a computer along with settings to configure reporting to Microsoft.


 


To open Problem Reports and Solution in Windows Vista (not in previous versions of Windows:


1. Open Problem Reports and Solutions by clicking the Start button Picture of the Start button, clicking Control Panel, clicking System and Maintenance, and then clicking Problem Reports and Solutions.

2. In the left pane, click View problem history.

3. To view problems by product, date, problem type, or solution status, click the column name.

image  image 


image


Bucket ID is the same as the Fault bucket in the application log event. I prefer using Problem Reports and Solutions versus Application Log to get crash details.


image 


 


image image


image


 


More info:


Where it’s stored:


http://blogs.msdn.com/wer/pages/faq.aspx#weronpc


See problem reports for this computer


http://windowshelp.microsoft.com/Windows/en-US/Help/74274b33-52ea-40a4-bed5-9444c2a178a31033.mspx


Windows Error Reporting and the Problem Reports and Solutions Feature in Windows Vista

http://technet.microsoft.com/en-us/library/cc709644.aspx


Choose the information to send when a problem occurs


http://windowshelp.microsoft.com/Windows/en-US/Help/15d43eb3-45fd-4248-8bd5-2ed92ee298961033.mspx


Open Event Viewer (Windows Vista)


http://windowshelp.microsoft.com/Windows/en-US/Help/a99f69c1-935f-4116-ba5f-33d8800ef9da1033.mspx


How to create a user-mode process dump file in Windows Vista


http://support.microsoft.com/kb/931673


How to use ADPlus to troubleshoot “hangs” and “crashes”


http://support.microsoft.com/kb/286350

Comments (0)