Finding useful crash data and Windows Error Reporting (WER) – Aaron... https://blogs.technet.microsoft.com/arykhus/2008/12/11/finding-useful-c...

This site uses cookies for analytics, personalized content and ads. By continuing to browse this site, you agree to this use.
Learn more (https://go.microsoft.com/fwlink/?linkid=845480)

| TechNet Search
(http://technet.microsoft.com/)
Sign in (https://blogs.technet.microsoft.com/wp-login.php?aadsso_action=login)

Follow Us

Finding useful crash data and Windows

Error Reporting (WER) (https://blogs.technet.microsoft.com
/arykhus/feed/)
Rate this article ★
★★
★★★
★★★★
★★★★★

Aaron Rykhus (https://blogs.technet.microsoft.com/arykhus/author/aaron-rykhus/) December 11, 2008 Popular Tags

0 (https://blogs.technet.microsoft.com/arykhus/2008/12/11/finding-useful- PowerPoint
(https://blogs.technet.microsoft.com
crash-data-and-windows-error-reporting-wer/#respond)
/arykhus/tag/powerpoint/)
Share (https://www.facebook.com/sharer/sharer.php?u=https://blogs.technet.microsoft.com/arykhus/2008/12
Office
/11/finding-useful-crash-data-and-windows-error-reporting-wer/&src=sdkpreparse)
0 0
(https://blogs.technet.microsoft.com
/arykhus/tag/office/)

Hang
(https://blogs.technet.microsoft.com
/arykhus/tag/hang/)

Crash
(https://blogs.technet.microsoft.com
/arykhus/tag/crash/)

v2007
(https://blogs.technet.microsoft.com
/arykhus/tag/v2007/)

Chart
(https://blogs.technet.microsoft.com
/arykhus/tag/chart/)

Errors
(https://blogs.technet.microsoft.com
/arykhus/tag/errors/)

Troubleshooting
(https://blogs.technet.microsoft.com
/arykhus/tag/troubleshooting/

Activation
(https://blogs.technet.microsoft.com
/arykhus/tag/activation/)

Visio
(https://blogs.technet.microsoft.com
/arykhus/tag/visio/)

Archives
June 2010
(https://blogs.technet.microsoft.com
/arykhus/2010/06/) (1)

1 of 6 9/28/2018, 4:10 PM
Finding useful crash data and Windows Error Reporting (WER) – Aaron... https://blogs.technet.microsoft.com/arykhus/2008/12/11/finding-useful-c...

as an Error event. If the report is sent to Microsoft the Application Log will also have an Information event May 2010
that contains a Bucket ID. (https://blogs.technet.microsoft.com
/arykhus/2010/05/) (3)
August 2009
 
(https://blogs.technet.microsoft.com
/arykhus/2009/08/) (1)
On Windows Vista, you can open Event Viewer by clicking the Start button , clicking Control Panel, May 2009
clicking System and Maintenance, clicking Administrative Tools, and then double-clicking Event (https://blogs.technet.microsoft.com
Viewer.? If you are prompted for an administrator password or confirmation, type the password or /arykhus/2009/05/) (1)
provide confirmation. April 2009
(https://blogs.technet.microsoft.com
/arykhus/2009/04/) (1)
Expand Windows Logs and select Application to select the Application log:
January 2009
(https://blogs.technet.microsoft.com
/arykhus/2009/01/) (1)
December 2008
(https://blogs.technet.microsoft.com
(https://msdnshared.blob.core.windows.net/media/TNBlogsFS /arykhus/2008/12/) (2)
October 2008
(https://blogs.technet.microsoft.com
/arykhus/2008/10/) (4)
All of 2010
/BlogFileStorage/blogs_technet/arykhus/WindowsLiveWriter (https://blogs.technet.microsoft.com
/FindingusefulcrashdataandWindowsErrorRep_ABDC/image_22.png) /arykhus/2010/) (4)
Look on the right, a crash in an Office application should be an Error under the Level column, Application All of 2009
Error under the Source column, and 1000 under the Event ID column. (https://blogs.technet.microsoft.com
/arykhus/2009/) (4)
Crash All of 2008
(https://blogs.technet.microsoft.com
/arykhus/2008/) (6)

(https://msdnshared.blob.core.windows.net/media/TNBlogsFS/BlogFileStorage/blogs_technet/arykhus
/WindowsLiveWriter/FindingusefulcrashdataandWindowsErrorRep_ABDC/image_20.png)

Example: crash from Outlook

(https://msdnshared.blob.core.windows.net/media/TNBlogsFS/BlogFileStorage/blogs_technet/arykhus
/WindowsLiveWriter/FindingusefulcrashdataandWindowsErrorRep_ABDC/image_26.png)

Fault Bucket (bucket ID)

If the report was sent to us (Microsoft) there should be an Information event with Windows Error
Reporting under the Source column and event ID 1001, with all the data gathered in the details.

On support calls, the piece of data that's most important to me is the Fault bucket that's reported. I'll
usually refer to it as the bucket ID.

2 of 6 9/28/2018, 4:10 PM
Finding useful crash data and Windows Error Reporting (WER) – Aaron... https://blogs.technet.microsoft.com/arykhus/2008/12/11/finding-useful-c...

(https://msdnshared.blob.core.windows.net/media/TNBlogsFS/BlogFileStorage/blogs_technet/arykhus
/WindowsLiveWriter/FindingusefulcrashdataandWindowsErrorRep_ABDC/image_30.png)

Problem Reports and Solutions (new in Vista)

A new feature in Windows Vista is Problem Reports and Solutions in the Control Panel under the System
and Maintenance category (if you don't have Classic View turned on). This will contain all the crash and
hang events that occurred on a computer along with settings to configure reporting to Microsoft.

To open Problem Reports and Solution in Windows Vista (not in previous versions of Windows:

1. Open Problem Reports and Solutions by clicking the Start button , clicking Control Panel, clicking
System and Maintenance, and then clicking Problem Reports and Solutions.

2. In the left pane, click View problem history.

3. To view problems by product, date, problem type, or solution status, click the column name.

(https://msdnshared.blob.core.windows.net/media/TNBlogsFS/BlogFileStorage/blogs_technet/arykhus
/WindowsLiveWriter/FindingusefulcrashdataandWindowsErrorRep_ABDC/image_2.png) 

(https://msdnshared.blob.core.windows.net/media/TNBlogsFS/BlogFileStorage/blogs_technet/arykhus
/WindowsLiveWriter/FindingusefulcrashdataandWindowsErrorRep_ABDC/image_8.png) 

(https://msdnshared.blob.core.windows.net/media/TNBlogsFS/BlogFileStorage/blogs_technet/arykhus

3 of 6 9/28/2018, 4:10 PM
Finding useful crash data and Windows Error Reporting (WER) – Aaron... https://blogs.technet.microsoft.com/arykhus/2008/12/11/finding-useful-c...

/WindowsLiveWriter/FindingusefulcrashdataandWindowsErrorRep_ABDC/image_10.png)

Bucket ID is the same as the Fault bucket in the application log event. I prefer using Problem Reports and
Solutions versus Application Log to get crash details.

(https://msdnshared.blob.core.windows.net/media/TNBlogsFS/BlogFileStorage/blogs_technet/arykhus
/WindowsLiveWriter/FindingusefulcrashdataandWindowsErrorRep_ABDC/image_12.png) 

(https://msdnshared.blob.core.windows.net/media/TNBlogsFS

/BlogFileStorage/blogs_technet/arykhus/WindowsLiveWriter
/FindingusefulcrashdataandWindowsErrorRep_ABDC/image_14.png)

(https://msdnshared.blob.core.windows.net/media/TNBlogsFS/BlogFileStorage/blogs_technet/arykhus
/WindowsLiveWriter/FindingusefulcrashdataandWindowsErrorRep_ABDC/image_16.png)

(https://msdnshared.blob.core.windows.net/media/TNBlogsFS/BlogFileStorage/blogs_technet/arykhus
/WindowsLiveWriter/FindingusefulcrashdataandWindowsErrorRep_ABDC/image_24.png)

4 of 6 9/28/2018, 4:10 PM
Finding useful crash data and Windows Error Reporting (WER) – Aaron... https://blogs.technet.microsoft.com/arykhus/2008/12/11/finding-useful-c...

More info:

Where it's stored:

http://blogs.msdn.com/wer/pages/faq.aspx#weronpc (http://blogs.msdn.com/wer/pages
/faq.aspx#weronpc)

See problem reports for this computer

http://windowshelp.microsoft.com/Windows/en-US/Help/74274b33-52ea-40a4-
bed5-9444c2a178a31033.mspx (http://windowshelp.microsoft.com/Windows/en-US/Help
/74274b33-52ea-40a4-bed5-9444c2a178a31033.mspx)

Windows Error Reporting and the Problem Reports and Solutions Feature in Windows Vista

http://technet.microsoft.com/en-us/library/cc709644.aspx (http://technet.microsoft.com/en-us/library
/cc709644.aspx)

Choose the information to send when a problem occurs

http://windowshelp.microsoft.com/Windows/en-US/Help/15d43eb3-45fd-
4248-8bd5-2ed92ee298961033.mspx (http://windowshelp.microsoft.com/Windows/en-US/Help
/15d43eb3-45fd-4248-8bd5-2ed92ee298961033.mspx)

Open Event Viewer (Windows Vista)

http://windowshelp.microsoft.com/Windows/en-US/Help/a99f69c1-935f-4116-
ba5f-33d8800ef9da1033.mspx (http://windowshelp.microsoft.com/Windows/en-US/Help/a99f69c1-935f-
4116-ba5f-33d8800ef9da1033.mspx)

How to create a user-mode process dump file in Windows Vista

http://support.microsoft.com/kb/931673 (http://support.microsoft.com/kb/931673)

How to use ADPlus to troubleshoot "hangs" and "crashes"

http://support.microsoft.com/kb/286350 (http://support.microsoft.com/kb/286350)

Tags Office (https://blogs.technet.microsoft.com/arykhus/tag/office/)

Comments (0)

Name *

Email *

Website

5 of 6 9/28/2018, 4:10 PM
Finding useful crash data and Windows Error Reporting (WER) – Aaron... https://blogs.technet.microsoft.com/arykhus/2008/12/11/finding-useful-c...

Save my name, email, and website in this browser for the next time I comment.

Post Comment

Privacy (https://privacy.microsoft.com) (https://www.microsoft.com

Terms of Use (https://msdn.microsoft.com/cc300389) © 2018 Microsoft
Trademarks (https://www.microsoft.com/en-us/legal/intellectualproperty/Trademarks/EN-U

6 of 6 9/28/2018, 4:10 PM