Windows Error Reporting - Some General Questions from a Newbie

[eldar]

Hey All,

I have a couple of general question with regards to learning how to diagnose errors under 'Windows Error Reporting' section of my MSINFO32 text file.

Q1. Am I correct in thinking that all errors spotted in the 'Windows Error Reporting' section of my MSINFO32 text file export, are also going to show up under 'Event Viewer'? For example, if I have 90 errors in my MSINFO32 text file, then will I also have the same 90 errors in 'Event Viewer'?

Q2. Is it normal to have some errors show up in 'Windows Error Reporting' section of MSINFO32 text file? Also, is it normal to have some errors show up in 'Event Viewer'?

I am concerned that after seeing errors, that my PC is 'broken' when it seems to be working fine.

Thanks in advance for all help,
Eldar

 

[GokAy]

Don't have an answer to all questions but you can check what caused the error if you examine it.

I have only 1 error listed from the other day and I know that application did crash once.

 

[eldar]

Thanks for the reply gokay. Are you checking 'summary of administrative events' in the center of the event viewer when you see that there is only 1 error?

What about if you check custom views ---> administrative events?

For example in mine I have 922 events listed. Some are errors, some are warnings.

Can someone also please help me to answer the questions in the first post? I am really struggling to get the basics down as to how to troubleshoot these errors, and if my PC has issues, imminent or otherwise.

Kind Regards

 

[Tookeri]

1) "Windows Error Reporting is located in the Software Environment category in System Information. It contains information about the faults that are generated in the Event Log, which you can view by using Event Viewer." from here

2) I'd say it's normal to have some errors in Event Viewer. I've managed to solve most but not all. The information in these errors can be difficult to understand and even more difficult to solve but you can try searching for the event id's on a search engine to get help.

App crashes are usually logged in Reliability Monitor where also installations/updates and windows updates are logged. You can find it under Control Panel - Action Center - Maintenance.

 

[eldar]

Thanks for the reply Tookeri. You have cleared up the two original questions, but if I may quiz you a little more that would be great.

For a sanity check on my 922 events listed under Event Viewer ---> Custom Views ---> Administrative Events, could I ask you to list your number (or approximate)?

I am assuming your PC is healthy and you would be a decent reference point to see if I have an unusual number of events listed.

This is for no other reason than to see if I am in a category all on my own with 922 events listed in this section.

Also another question if you wouldn't mind answering:

Q. With the knowledge that 'windows error reporting contains information about the faults that are generated in the event log', would you say that I can troubleshoot the errors directly through event viewer and safely ignore msinfo32 and system information?

Kind Regards,
Eldar

 

[GokAy]

Sometimes errors in event viewer are too generic and hard to diagnose. At least that's my own experience.

My own machine at the moment normally has no errors in event viewer applications and system categories. 1 warning in app and 1 warning in system. So it is possible to have it clean, at least those 2 categories.

But I get errors from adobe reader when you close it you get an error (they are aware and will fix soon). I also started getting the same error (usually in quick succession - 10-20 in a minute, and then stops) from which I believe is my Blu-ray drive. Still need to find what is going on.

Then there are some errors that just happen, like Schannel errors when you visit certain https sites. If you know what to omit you will know the actual errors.

Those errors you have, most probable, some are just the same. Work through each of them, search for event id and source and see if you can find a solution or accept to have them.

I hope I could describe it clearly.

 

[Tookeri]

Sure, I have a total of 7726 error/warning/critical in that view, so you can relax The first one is from 2010, before I even bought this PC!
It sounds as a lot of events but most of the older errors are HP related before I cleaned my PC and uninstalled a lot of the pre-installed HP programs.
Lately most errors are Schannel and Kernel-EventTracing(occurs when I switch user). Both should be safe to ignore.

A. Yes, that's how I interpret it. I tried to do a compare myself but I never get any info on that in msinfo32. Even tried as administrator but no difference.

 

[eldar]

Thanks for the insight guys.


@ GoKay

Yes you described everything very clearly. I also get 'Event 16, Adobe Reader' occuring several times.


@ Tookeri

It is worth noting that my pc is relatively new. Those errors date back to 6th May this year, so exactly 1 month ago (which is approximately when I installed windows 7 and setup the PC). Also worth mentioning that there are many many duplicate errors (they are not all unique errors).

Also worth noting that I can also see errror 'Event 3, Kernel-EventTracing' listed several times as well as a few related warnings all under 'administrative events'.

Another question for you guys:

Q. When should someone turn to event viewer to troubleshoot? When having actual PC issues that are affecting performance or just to prevent potential issues by 'squashing' the errors? (for want of a better word )


Finally, I have started a new thread under 'BSOD Help and Support' with a specific event that I am having no luck finding info on using google. Feel free to check it out if you guys get a spare minute and think it is something you can help with:

http://www.sevenforums.com/bsod-hel...host-exe_diagtrack-ntdll-dll.html#post3082627

Thanks again

 

[GokAy]

It doesn't hurt to check event viewer every so often, and see if everything is going alright. If I am content with what caused the errors/warnings and tracked them all, I just clear the log. And if you set up classic event viewer, it takes 1 minute to go through the event log (as long as it's under control). Normal event viewer takes too long to load for my taste

https://www.sepago.com/blog/2010/11/11/how-to-get-back-windows-xps-fast-event-viewer-in-windows-7

 

[Tookeri]

I check every day so I have a fair chance at fixing any new problems right away. I don't use the Event Viewer though. Here's my solution:

In Event Viewer: create a Custom View. In the Filter tab set Logged = Last 24 hours. Check Critical, warning and error. For Event logs check all Windows Logs. You can additional logs if you want. In Includes/Excludes you can specify common event id's that you don't wanna see, for example -36887,-36888 to hide Schannel errors.
When you're done you switch to the XML tab and copy the XML text and paste it in a new textfile. Then create/save the view for example as "Last 24 hours".

Then create a batch file ( .bat as suffix) with the following content:

@echo off
rem The findstr removes everything but the actual event message
wevtutil qe "c:\path\eventlog24h.txt" /sq:true /rd /f:text | findstr /V /C:"  "
echo.
CHOICE /C YN /M "Start Event Viewer?"
if errorlevel 2 (
  rem echo NO
) else if errorlevel 1 (
  eventvwr.exe
)

Modify c:\path\eventlog24h.txt to where you saved the XML.

Next, create a scheduled task for the batch file to bypass the UAC prompt (ie Run with highest privileges).
Then create a shortcut on the desktop to run that task (change TaskName to the name you chose in Scheduled Task):
C:\Windows\System32\schtasks.exe /Run /TN TaskName

When all this is done you can just run the shortcut on the desktop once a day. If you should see any new events you'd like to take a closer look at, just ask Y to the question "Start Event Viewer?". No UAC prompts and a very fast and easy way to check the event logs
If you get any new errors that you don't wanna see anymore you edit your custom view in Event Viewer and add those event ID's to the exclusion. Then copy the XML to the eventlog24h.txt

 

[eldar]

Thanks for the suggestions guys. Will be sure to give them both a try. So from what I'm gathering, doing a daily check for say the next 7 days, should bring up all current errors & warnings. Then I can work at resolving as many as I can.