4.1 Application Fault Example
An application fault occurs while running TestApplication.exe.
The system creates an error report.
The CER client checks to see whether a CER file share has been configured as specified in section 3.1.1. The following value is set:
DWFileTreeRoot = "\\MyCerServer\CERFileShare\"
The CER client checks for the existence of a policy.txt file at the location specified by DWFileTreeRoot. No policy.txt file exists.
The CER client constructs the following folder structure based on the information specified in section 2.2.3:
\\MyCerServer\CERFileShare\status\TestApplication\1.0.0.0\TestModule\ 1.0.0.0\00000000\status.txt
A status.txt file exists at this location. The CER client parses the status.txt file, which includes the following parameters and values:
Tracking=YES Response=http://www.microsoft.com/ms.htm Crashes per bucket=100 NoSecondLevelCollection=NO NoFileCollection=NO RegKey=HKLM\Software\Microsoft\PCHealth\ErrorReporting;HKLM\Software\ Microsoft\PCHealth\Test iData=1 fDoc=0 WQL=select * from Win32_logicaldisk GetFile=%WINDIR%\system32\notepad.exe;%WINDIR%\system32\faultrep.dll GetFileVersion=%WINDIR%\system32\notepad.exe;%WINDIR%\system32\ faultrep.dll
This status.txt file has specified a "Crashes per bucket" value of 100, so the CER client checks to make sure that 100 error reporting files have not already been collected for this problem. It does this by looking at the count.txt file for the error:
\\MyCerServer\CERFileShare\counts\TestApplication\1.0.0.0\TestModule\1.0.0.0\00000000\count.txt
The count.txt file has the following contents:
Cabs Gathered=5 Total Hits=10
Since 5 is fewer than 100, the CER client continues the data collection process.
This status.txt file has specified that additional data be added to the error report, in the form of two registry key values, a WMI query, two files, and version information for two files. The CER client collects this information and compresses all of the report files into a single file with the randomly generated name of "d5je031w.cab".
The CER client copies the error reporting files to the CER file share:
\\MyCerServer\CERFileShare\cabs\TestApplication\1.0.0.0\TestModule\ 1.0.0.0\00000000\d5je031w.cab
The CER client updates the following file on the CER file share to increment the number of hits and the number of copied error reporting files:
\\MyCerServer\CERFileShare\counts\TestApplication\1.0.0.0\TestModule\ 1.0.0.0\00000000\count.txt
The count.txt file now has the following contents:
Cabs Gathered=6 Total Hits=11
The status.txt file for this error signature has enabled internal tracking, so the CER client opens the crash.log file on the CER file share for this problem:
\\MyCerServer\CERFileShare\crash.log
The CER client appends the following text to the crash.log file:
"15:32:23 04-23-2007 TestMachine TestUser TestApplication\1.0.0.0\TestModule\1.0.0.0\00000000"
The CER client also opens the hits.log file on the CER file share:
\\MyCerServer\CERFileShare\cabs\TestApplication\1.0.0.0\TestModule\ 1.0.0.0\00000000\hits.log
The CER client appends the following text to the hits.log file:
"15:32:23 04-23-2007 TestMachine TestUser d5je031w.cab"