1

My computer recently froze out of the blue wwhile I was browsing the web. Ctrl-Alt-Delete didn't work so I had to resort to killing the power and rebooting.

Now I'm wondering what I could have done to diagnose and determine the cause of why it hung.

I read you can force a system crash, but after I get a kernel memory dump, what could I do in windbg to figure out why it was hanging?
Would that even work if I couldn't use ctrl-alt-delete? Are there any other options to figure this out?

3
  • It would not have worked, because you have to set the registry value and then reboot. So you should have made that change before the hang even occurs. Feb 13, 2013 at 20:14
  • If the kernel locked up there isn't much you can do. Did you actually get a memory dump. Is this an actual problem you face currently?
    – Ramhound
    Feb 13, 2013 at 20:14
  • @OliverSalzburg I know. I'm wondering for next time something like this happens.
    – Josh
    Feb 13, 2013 at 20:18

2 Answers 2

1

When your system freezes there is nothing you can do to analyze the situation. Usually, you won't even be able to do any post-mortem analysis, because no information about the hang is recorded.

The method described in the article you linked is intended to be used by driver developers that have to cause a crash for testing purposes. It would not have helped you in your situation, primarily because you didn't have the registry key set when it happened. If you had it set, you could have caused a crash and would have a memory dump for post-mortem analysis.

What could I do with it?

Probably nothing. When you collected such a dump through a regular crash, it would usually contain easily obtainable information regarding who or what caused the crash. You can get that information by loading the dump into windbg and executing:

!analyze -v

However, if you had enabled the registry option to cause a crash, windbg would indicate that the keyboard driver caused the bug check.

You could check the other processes and threads that were recorded in the dump to find what actually caused the hang. But you should really know what you're doing and/or looking for.

So, what should I do?

The problem with random hangs is that they're random. As long as they appear random, there's nothing you can do. You can observe the behavior long enough until it doesn't appear random anymore.

Once you realize that the problem happens due to a certain pattern, you can start troubleshooting the issue.

0

Once you forced a dump file to be generated - which may not even work depending on the problem you encounter - you can use WinDbg to look for possible causes. The first thing to do in such a case would be:

!analyze -hang -v

... but the specifics are determined by the outcome of this and it requires a lot of experience to analyze this kind of stuff. You may not even have all data available to you to track this down to the very end (after all you don't have all symbols).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .