Aaron Rykhus - News and info on Office client apps : Finding useful crash data and Windows Error Reporting (WER)

Finding useful crash data and Windows Error Reporting (WER)

Also check out http://blogs.msdn.com/wer/pages/faq.aspx#weronpc

Application Log

Whenever an application crashes (faulting application) you should get the message <application name> stopped working. Once that occurs the crash details get logged in the Application Log as an Error event. If the report is sent to Microsoft the Application Log will also have an Information event that contains a Bucket ID.

On Windows Vista, you can open Event Viewer by clicking the Start button Picture of the Start button , clicking Control Panel, clicking System and Maintenance, clicking Administrative Tools, and then double-clicking Event Viewer.? Administrator permission required If you are prompted for an administrator password or confirmation, type the password or provide confirmation.

Expand Windows Logs and select Application to select the Application log:

Look on the right, a crash in an Office application should be an Error under the Level column, Application Error under the Source column, and 1000 under the Event ID column.

Crash

Example: crash from Outlook

Fault Bucket (bucket ID)

If the report was sent to us (Microsoft) there should be an Information event with Windows Error Reporting under the Source column and event ID 1001, with all the data gathered in the details.

On support calls, the piece of data that's most important to me is the Fault bucket that's reported. I'll usually refer to it as the bucket ID.

Problem Reports and Solutions (new in Vista)

A new feature in Windows Vista is Problem Reports and Solutions in the Control Panel under the System and Maintenance category (if you don't have Classic View turned on). This will contain all the crash and hang events that occurred on a computer along with settings to configure reporting to Microsoft.

To open Problem Reports and Solution in Windows Vista (not in previous versions of Windows:

1. Open Problem Reports and Solutions by clicking the Start button Picture of the Start button , clicking Control Panel, clicking System and Maintenance, and then clicking Problem Reports and Solutions.

2. In the left pane, click View problem history.

3. To view problems by product, date, problem type, or solution status, click the column name.

Bucket ID is the same as the Fault bucket in the application log event. I prefer using Problem Reports and Solutions versus Application Log to get crash details.