When programs crash in Windows 10, detailed crash logs containing diagnostic information are generated that can help determine why the crashes occurred. Viewing these crash logs can provide valuable insights into resolving program instability issues. This guide will cover where to find crash logs in Windows 10 and how to view them.
What are crash logs?
Crash logs, also known as dump files, are files that contain data about the state of a program at the time it crashed. They record details about the crash such as:
- The sequence of function calls leading up to the crash
- Values of key variables and parameters
- Memory allocated to the program
- Any error messages generated
This information is vital for identifying bugs, memory leaks, and other issues that cause crashes. Without crash logs, it can be extremely difficult or impossible to determine the root cause of a crash.
Where are crash logs located?
In Windows 10, crash dump files are stored in the C:\Windows\Minidump folder by default. Each crash generates a new .dmp file containing the debug information for that specific crash event.
There are a few exceptions to this location:
- For some Windows Store apps, crash dumps may be saved to C:\ProgramData\Microsoft\Windows\WER\ReportArchive instead.
- Kernel memory dumps are stored in %SystemRoot%\Memory.dmp by default.
- Small memory dumps go to %SystemRoot%\Minidump by default.
So in summary, here are some common folders to check for crash logs:
- C:\Windows\Minidump
- C:\ProgramData\Microsoft\Windows\WER\ReportArchive
- C:\Windows\Memory.dmp (for kernel dumps)
The Minidump folder is the most common location for app and program crash logs.
How to view the crash dump files
Once you’ve located the .dmp files, you’ll need a tool to open them and view their contents. Here are some options:
Windows Debugger (WinDbg)
WinDbg is a powerful tool included with the Windows Driver Kit that can analyze crash dumps in great detail. It’s the best free option available but does have a steep learning curve.
To view a crash log with WinDbg:
- Launch WinDbg as administrator
- File > Open Crash Dump and select the .dmp file
- Type !analyze -v and press enter to view analysis
- Review the report for details on the crash
Visual Studio
The standalone Visual Studio installer allows you to install just the debugging tools needed to view crash dumps.
To view a log:
- Launch the Visual Studio debugger
- File > Open > Crash Dump and choose the .dmp file
- In the Diagnostic Tools window, review the analysis
Third-party dump analyzers
There are also various third party dump analysis tools available such as:
- BlueScreenView – Analyzes dump files and highlights key parts of the call stack.
- WhoCrashed – Simple analyzer that reads memory dumps and shows crash details.
- OCCT – Advanced tool that can also test system stability and generate crashes to analyze.
Most of these tools have straightforward interfaces for opening dumps and viewing crash info.
Finding the key details in the crash log
Once you’ve opened up a dump file in an analysis tool, here are some of the key details to look for:
- Exception code – This will indicate the type of crash such as EXCEPTION_ACCESS_VIOLATION.
- Faulting module – The DLL or executable where the crash occurred.
- Faulting address – The memory address that caused the fault.
- Call stack – The sequence of function calls leading to the crash.
- Thread info – Details about the thread where the crash happened.
- Registers – Values in CPU registers at time of crash.
- Loaded modules – List of all DLLs and executables loaded in the process.
By looking at the exception code and faulting module, you can usually get an idea of what kind of issue caused the crash. The call stack will show what code path lead to the failure. Loaded modules can provide insight into any third-party libraries that may be involved.
How to troubleshoot using crash logs
Here are some general tips for effectively troubleshooting and resolving crashes using dump files:
- Reproduce the crash – Try reproducing the same crash so you have a recent log to analyze.
- Search for known issues – Copy key details from the log into a search engine to find related reports.
- Spot patterns – If the same module or address keeps crashing, focus your investigation there.
- Update suspect modules – If a crash implicates a third-party DLL or driver, update it.
- Check parameters – Crashes due to bad input may show up in reports.
- Fix obvious problems – Issues like uninitialized variables may be apparent.
Narrow down the potential causes by finding patterns across multiple crash reports. If a crash only started happening recently after an update, roll back the update as a test. If the crash details aren’t obvious, you may need to contact the vendor for further support.
How to enable kernel crash dumps
Kernel crash dumps record crashes in low level operating system components like drivers. To enable full kernel dumps in Windows 10:
- Open Control Panel > System > Advanced system settings
- Under Startup and Recovery, click Settings…
- Under Write debugging information, select Complete memory dump
- Specify a location such as %SystemRoot%\MEMORY.DMP
- Click OK to save the settings
This will create a complete memory.dmp file that includes all kernel and process memory in the event of a major system crash. The dump file can become very large, so make sure you have sufficient disk space.
How to analyze a kernel crash dump
Kernel crash dumps can be analyzed using the same tools like WinDbg and Visual Studio mentioned earlier. The analysis process is similar:
- Open the memory.dmp file in your analysis tool
- Run !analyze -v for details on the crash
- Review the exception code and bugcheck info
- Examine the call stack, loaded modules, and other details
Key things to look for in the report:
- Bug check code – Identifies the type of kernel crash, like KMODE_EXCEPTION.
- Caused by driver – Points to any driver modules that may have triggered the crash.
- Bugcheck parameters – Additional info like memory addresses.
- Call stack – See what kernel code was executing.
Kernel crashes are usually caused by faulty drivers. Updating drivers, especially GPU, storage, and network drivers, may resolve the issues. Disabling non-essential drivers can also help narrow down the culprit.
How to view crash logs for Windows Store apps
When Windows Store apps crash, their dump files go to a different location than desktop app crashes. For Store apps, logs are stored under:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive
The logs use a different naming format like:
AppName_YYYYMMDD-HHMMSS_XXXXX.wer
To view the crash report:
- Navigate to the ReportArchive folder
- Search for files named with the AppName of interest
- Double-click the .wer file to open in the Windows Problem Steps Recorder
- Expand the Details section to see crash analysis
This will show basic crash details and exception codes. More advanced analysis requires opening the report in WinDbg or Visual Studio and examining the memory dump contained within the .wer file.
How to prevent crashes from happening
While crash logs allow you to respond to crashes after they occur, the ideal solution is preventing unexpected crashes in the first place. Some tips for avoiding crashes:
- Keep systems and software up-to-date to avoid known issues.
- Use validation and error handling code to catch problems early.
- Adopt safe coding practices like bounds checking and limiting resource usage.
- Perform stress testing to catch problems before release.
- Promptly investigate any crashes reported through telemetry.
- Ensure third-party dependencies and drivers are trustworthy and stable.
Well-written and thoroughly tested code is less likely to have unpredictable crashes. Design programs defensively and assume problems can occur anywhere. The most reliable applications understand that crashes are inevitable and handle them gracefully through logging and recovery.
Conclusion
Crash logs contain vital clues for resolving program crashes, but only if you know how to find them and understand their contents. Windows stores app and system crash dumps in the Minidump folder, while kernel and Windows Store app crashes get logged elsewhere. Dedicated tools like WinDbg and Visual Studio can analyze the dump files in detail. The key is to look for patterns across multiple crashes and focus on the exception codes, stack traces, and faulting modules identified in the logs. With patience and persistence, crash logs can guide you to the ultimate fix.
