If you own a Windows PC, you have probably familiar with the blue screen. A blue screen occurs when your PC experiences a serious issue. The issue is so serious that Windows has to immediately stop running and generates an error message to notify the end user. Blue screens can be caused by a range of different issues including both hardware, software, and device drivers. Every blue screen includes a set of parameters. These parameters tell you what type of blue screen has occurred and the reasons why.
When a blue screen occurs, Windows will generate diagnostic information to assist in troubleshooting the issue. Here are the two main sources to check:
1) Event ID
2) Memory.dmp file
Event ID:
When a blue screen occurs, an event is written to the Windows event log. Here is an example:
Event ID: 1001
Source: BugCheck
Description:
The computer has rebooted from a bugcheck. The bugcheck was : 0xc00000E2 (0xffffffffffffffff, 0x0000000000000001, 0x0000000000000000, 0x0000000000000000). A dump was saved in: C:WINDOWSMEMORY.DMP.
Reviewing the event log is a great way to determine if there are trends and patterns to the type and regularity of the blue screens. Is the blue screen a one-off or a regular occurrence? Is the PC experiencing the same blue screen over and over? Or is each blue screen completely different? The event log is a great way to answer these types of questions.
Memory.dmp file:
Following a blue screen, Windows will write the contents of its memory to a single file. By default, the file is written to C:WindowsMEMORY.DMP. This file is the most useful tool available to troubleshoot the blue screen. The dump file is a record of what was happening on the machine which led to the blue screen.
If you need help resolving a blue screen error on your PC, please contact H Tech Solutions using the URL below. Please have your Windows Event Log and Memory dump file available for analysis.
H Tech Solutions Blog by Harris Schneiderman is licensed under a Creative Commons Attribution 4.0 International License.