How to use Windows Error Reporting to diagnose and troubleshoot APPCRASH errors?

Question

Hi,

I'm trying to troubleshoot why my Explorer service hangs and then crashes?  I have found the logs in event viewer, but I wanted to know how to use the error reports that are produced?  I did a google search but couldn't find any guides on how to use WER or read the dump files for windows 8.1, only thing I found was how to disable WER or for Vista or Server 2008.  Nothing relating to Win 8.1.

I just need to know how to use these files and how to read them so I can try to troubleshoot these logs in my event viewer, does anyone know any sites that can guide me through it or show me what to do?

Normally pretty good with the Event logs but I've never been able to understand these APPCRASH logs and the WER files.  So I'm eager to learn.

Thanks

Answer 1

Hi,

You can refer to the following steps to read the Event Viewer Logs.

1. When the Event Viewer window opens, you'll see 2 panes. The pane on the left will contain the 3 categories of events (they are Application, Security, and System). The pane on the right will reflect the messages for the category that is selected on the left. They will be listed as Information, Warnings, or Errors. Errors are what will concern us here.
2. Left click once on the Application category in the left hand pane -      then check the right hand pane for errors. Locate an error (example in the      System description below) that occurred around the time of the problem      (there may or may not be one here depending on the type of error). Then,      right click on it and select "Properties". The information in      the resulting window may be able to be used by board members to help      troubleshoot your problem. Here's an example of it:
3. Next, we'll do the same thing for the Security category. You'll left      click on the Security category in the left hand pane, then will check for      errors in the right hand pane. Locate an error (example in the System      description below) that occurred around the time of the problem (there may      or may not be one here depending on the type of error). Then, right click      on it and select "Properties". The information in the resulting      window may be able to be used by board members to help troubleshoot your      problem.
4. Now, we'll do the same thing for the System category. You'll left      click on the System category in the left hand pane, then will check for      errors in the right hand pane
5. Locate an error that occurred around the time of the problem (there      may or may not be one here depending on the type of error). Then, right      click on it and select "Properties". The information in the      window may be used by board members to help troubleshoot your problem.
6. Sometimes there will just be too many errors for you to pick just one      out. In this case, generate a report using the "Action" menu      item. Select "Export list" from the dropdown menu, and save it      as a text file (that's the default). Then, open the text file by double      clicking on it. Select the lines around the time that the error occurred      by highlighting it with your cursor. Then, right click on the blue      highlighting and select "Copy". Now, when you reply to your      post, you can right click on the post and select "Paste" to      insert the lines into your post. With this information, someone will be      able to suggest which errors should be checked in detail.

I would also suggest you to follow the steps from the link below and check if it helps;

What to do if you have problems with an app

In many cases, the Apps will automatically notify if there are problem with any app and try to fix the problem. If the Apps don’t notify the problem you are experiencing problems with an app.

**http://windows.microsoft.com/en-US/windows-8/what-troubleshoot-problems-app**                                

I would suggest you to run the Apps troubleshooter from the mentioned link above.

If you need further assistance regarding Windows, please feel free to post. We will be happy to help you.

---

Answer 2

Hi JK,

You can use the Windows debugging tool to read .dmp files. You can refer to the following link to know more about reading dump files.

http://social.msdn.microsoft.com/Forums/en-US/501f077a-9c0d-48af-a530-83e3de8d0972/windows-dump-file?forum=isv

Hope this helps.

Answer 3

Got it, should of mentioned that im familiar with the event viewer but wanted to learn how to read wer files that are created aswell as logfiles.  You know the ones that say files have been created and are located at ..........

Attached files:

D:\CRITICAL\TEMP\WERA931.tmp.appcompat.txt

D:\CRITICAL\TEMP\WERA970.tmp.WERInternalMetadata.xml

D:\CRITICAL\Users\John\AppData\Local\Microsoft\Windows\WER\ReportQueue\AppCrash_explorer.exe_5be6a453ad657f01790fed427e47415f544df2_55cc7699_cab_135aa98d\memory.hdmp

D:\CRITICAL\Users\John\AppData\Local\Microsoft\Windows\WER\ReportQueue\AppCrash_explorer.exe_5be6a453ad657f01790fed427e47415f544df2_55cc7699_cab_135aa98d\triagedump.dmp

These files may be available here:

D:\CRITICAL\Users\John\AppData\Local\Microsoft\Windows\WER\ReportQueue\AppCrash_explorer.exe_5be6a453ad657f01790fed427e47415f544df2_55cc7699_cab_135aa98d

Analysis symbol:

Rechecking for solution: 0

Report Id: 35c61887-bce4-11e3-834a-485b39621957

Report Status: 4

Hashed bucket:

Thats an example of what I mean.  How would I go about reading the .hdmp & .dmp files?  Also where can I find out what it all means?

Also How long will those files it creates stay in my TEMP dir?  Its just if I look for those files now there not there.

Thanks