4.1 Application Fault Example

Article
02/14/2019

An application fault occurs while running TestApplication.exe.
The system creates an error report.
The CER client checks to see whether a CER file share has been configured as specified in section 3.1.1. The following value is set:
```
 DWFileTreeRoot = "\\MyCerServer\CERFileShare\"
```
The CER client checks for the existence of a policy.txt file at the location specified by DWFileTreeRoot. No policy.txt file exists.
The CER client constructs the following folder structure based on the information specified in section 2.2.3:
```
 \\MyCerServer\CERFileShare\status\TestApplication\1.0.0.0\TestModule\
 1.0.0.0\00000000\status.txt
```

A status.txt file exists at this location. The CER client parses the status.txt file, which includes the following parameters and values:

 Tracking=YES
 Response=http://www.microsoft.com/ms.htm
 Crashes per bucket=100
 NoSecondLevelCollection=NO
 NoFileCollection=NO
 RegKey=HKLM\Software\Microsoft\PCHealth\ErrorReporting;HKLM\Software\
 Microsoft\PCHealth\Test
 iData=1
 fDoc=0
 WQL=select * from Win32_logicaldisk
 GetFile=%WINDIR%\system32\notepad.exe;%WINDIR%\system32\faultrep.dll
 GetFileVersion=%WINDIR%\system32\notepad.exe;%WINDIR%\system32\
 faultrep.dll

This status.txt file has specified a "Crashes per bucket" value of 100, so the CER client checks to make sure that 100 error reporting files have not already been collected for this problem. It does this by looking at the count.txt file for the error:
```
 \\MyCerServer\CERFileShare\counts\TestApplication\1.0.0.0\TestModule\1.0.0.0\00000000\count.txt
```
The count.txt file has the following contents:
```
 Cabs Gathered=5
 Total Hits=10
  
```
Since 5 is fewer than 100, the CER client continues the data collection process.
This status.txt file has specified that additional data be added to the error report, in the form of two registry key values, a WMI query, two files, and version information for two files. The CER client collects this information and compresses all of the report files into a single file with the randomly generated name of "d5je031w.cab".

The CER client copies the error reporting files to the CER file share:

 \\MyCerServer\CERFileShare\cabs\TestApplication\1.0.0.0\TestModule\
 1.0.0.0\00000000\d5je031w.cab

The CER client updates the following file on the CER file share to increment the number of hits and the number of copied error reporting files:
```
 \\MyCerServer\CERFileShare\counts\TestApplication\1.0.0.0\TestModule\
 1.0.0.0\00000000\count.txt
  
  
```
The count.txt file now has the following contents:
```
 Cabs Gathered=6
 Total Hits=11
  
```
The status.txt file for this error signature has enabled internal tracking, so the CER client opens the crash.log file on the CER file share for this problem:
```
 \\MyCerServer\CERFileShare\crash.log
```
The CER client appends the following text to the crash.log file:
```
 "15:32:23  04-23-2007   TestMachine   TestUser   
 TestApplication\1.0.0.0\TestModule\1.0.0.0\00000000"
```

The CER client also opens the hits.log file on the CER file share:

 \\MyCerServer\CERFileShare\cabs\TestApplication\1.0.0.0\TestModule\
 1.0.0.0\00000000\hits.log

The CER client appends the following text to the hits.log file:

 "15:32:23  04-23-2007   TestMachine   TestUser   d5je031w.cab"

Share via

4.1 Application Fault Example

Additional resources