Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My computer recently froze out of the blue wwhile I was browsing the web. Ctrl-Alt-Delete didn't work so I had to resort to killing the power and rebooting.

Now I'm wondering what I could have done to diagnose and determine the cause of why it hung.

I read you can force a system crash, but after I get a kernel memory dump, what could I do in windbg to figure out why it was hanging?
Would that even work if I couldn't use ctrl-alt-delete? Are there any other options to figure this out?

share|improve this question
    
It would not have worked, because you have to set the registry value and then reboot. So you should have made that change before the hang even occurs. –  Oliver Salzburg Feb 13 '13 at 20:14
    
If the kernel locked up there isn't much you can do. Did you actually get a memory dump. Is this an actual problem you face currently? –  Ramhound Feb 13 '13 at 20:14
    
@OliverSalzburg I know. I'm wondering for next time something like this happens. –  Josh Feb 13 '13 at 20:18
add comment

3 Answers 3

up vote 1 down vote accepted

When your system freezes there is nothing you can do to analyze the situation. Usually, you won't even be able to do any post-mortem analysis, because no information about the hang is recorded.

The method described in the article you linked is intended to be used by driver developers that have to cause a crash for testing purposes. It would not have helped you in your situation, primarily because you didn't have the registry key set when it happened. If you had it set, you could have caused a crash and would have a memory dump for post-mortem analysis.

What could I do with it?

Probably nothing. When you collected such a dump through a regular crash, it would usually contain easily obtainable information regarding who or what caused the crash. You can get that information by loading the dump into windbg and executing:

!analyze -v

However, if you had enabled the registry option to cause a crash, windbg would indicate that the keyboard driver caused the bug check.

You could check the other processes and threads that were recorded in the dump to find what actually caused the hang. But you should really know what you're doing and/or looking for.

So, what should I do?

The problem with random hangs is that they're random. As long as they appear random, there's nothing you can do. You can observe the behavior long enough until it doesn't appear random anymore.

Once you realize that the problem happens due to a certain pattern, you can start troubleshooting the issue.

share|improve this answer
add comment

Once you forced a dump file to be generated - which may not even work depending on the problem you encounter - you can use WinDbg to look for possible causes. The first thing to do in such a case would be:

!analyze -hang -v

... but the specifics are determined by the outcome of this and it requires a lot of experience to analyze this kind of stuff. You may not even have all data available to you to track this down to the very end (after all you don't have all symbols).

share|improve this answer
add comment

Memdumps may help you diagnose a problem which caused that memdump to be made. Forcing one won't help you.

Most BSODs are caused by device drivers, try updating those.

share|improve this answer
    
This isn't true. A forced dump will still show lockups just fine. It's the very reason this feature was introduced into the keyboard driver in the first palce. –  0xC0000022L Feb 13 '13 at 20:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.