6

Possible Duplicate:
PC Blue Screens and then instantly reboots. How do I stop this or find the error later?

Sometimes I get a BSOD screen for a split second and I have no chance to see the cause of it. It also happens when I am not at the computer. The event log doesn't have enough information. Is there a way or tool that captures the screen when it happens so I can look at the cause later.

I already did a memory diagnostics test so that's not the problem.

3
  • 1
    thats what cell phone cams are for are they not?
    – user33788
    Jul 21 '10 at 19:27
  • Sure. I will sit infront of the computer for hours holding a camera and when the BSOD shows up for a split second, I will be quick enough to capture it!! Jul 22 '10 at 16:59
  • @user: Good luck then afterwards trying to decipher what's written on the screen. In my experience cell phone cameras hardly have any optical qualities you might describe as "good".
    – Joey
    Oct 5 '10 at 10:04
8

All BSODs are stored on your computer. The freeware BlueScreenView not only recreates the BSOD display as-it-was, but also tries to analyze the dumps and find the guilty program/driver for you:

BlueScreenView scans all your minidump files created during 'blue screen of death' crashes, and displays the information about all crashes in one table. For each crash, BlueScreenView displays the minidump filename, the date/time of the crash, the basic crash information displayed in the blue screen (Bug Check Code and 4 parameters), and the details of the driver or module that possibly caused the crash (filename, product name, file description, and file version).
For each crash displayed in the upper pane, you can view the details of the device drivers loaded during the crash in the lower pane. BlueScreenView also mark the drivers that their addresses found in the crash stack, so you can easily locate the suspected drivers that possibly caused the crash.

image

0

In the advanced system properties, in the startup and recovery options there's a checkbox to automatically restart (upon system failure). Uncheck this checkbox. The next time the machine has a BSOD, it will be left on the BSOD screen and you'll be able to write down or take a picture of the info and Google it for more answers (or post it here).

0

You could disable the auto restart on error but this is not always the safest practice. Another option would be to get windows (assuming this is XP) to write a dump to the harddisk. These can then be analysed later (preferably using something like winDBG).

Right click My Computer -> Properties. Click Advanced tab. Click Settings under Startup and Recovery. The exact next step escapes me but I think it is tick the Write Debug Log info to hard disk. This should right a dmp file to %SYSTEMROOT%\Minidumps the next time you get a BSOD. Instructions on how to use WinDBG can be found over at Tech Republic though you could probably post a link here and someone will help.

2
  • Why is it not safe to disable the automatic restart upon system failure? What's going to happen other than it will stop on the BSOD instead of rebooting?
    – joeqwerty
    Jul 21 '10 at 18:15
  • I suppose if the system needs to be up for some reason, leaving it on the blue screen would be undesirable, but I wouldn't consider it unsafe. Jul 21 '10 at 19:22
0

Every bluescreen gets logged in the Event log, so even if you don't catch it as it happens you can still find out the STOP code and its parameters.

3
  • Not true. A BSOD is an unexpected event and therefore won't be logged. The event log will log the startup after the BSOD with an event that states that the previous system shutdown was unexpected. The best you could do would be to configure a memory dump in the advanced system options and analyze the dump file after the fact.
    – joeqwerty
    Jul 21 '10 at 18:18
  • 1
    @joeqwerty: Only a very few BSODS depending on type and when they happen will not make it into the event log, though the computer needs to be set to write an event to the log. Jul 21 '10 at 19:23
  • @Tofystedeth: That's the default setting, so unless they fiddled with it I would assume it's still set.
    – Joey
    Jul 22 '10 at 8:53

Not the answer you're looking for? Browse other questions tagged or ask your own question.