none
location of WER mdump and .wer file

    Question

  • Hi,
    I wanted to collect all the *.mdmp and wer file programatically for Windows 7 and Windows vista machine.
    I need to know is there a registry key or some settings I have to do in order to get this information?
    I tried ForceQueue to 1 and DefaultConsent to 4 ( I don't want to send these report anywhere but wanted to preserve them locally)

    Now when my application crash. I don't see the dump file at C:\Users\XXX\AppData\Local\Microsoft\Windows\WER\ReportArchive or ..\WER\ReportQueue

    But I do see *.wer file at C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_xxxx

    Am I missing something here?

    Below are the registry settings on my machine:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\
    Disabled =0
    LoggingDisabled =0
    ForceQueue =1



    • Moved by Max Wang_Chinasoft Tuesday, April 26, 2011 2:00 AM forum consolidation (From:Windows Error Reporting for ISVs)
    Wednesday, September 30, 2009 10:05 PM

Answers

  • If the crashing application is elevated, the dumps will be located at C:\ProgramData\Microsoft\Windows\WER\ReportArchive or C:\ProgramData\Microsoft\Windows\WER\ReportQueue depending on whether queue mode is set or not.
    If the application is LUA, it will be at the location you mentioned C:\Users\XXX\AppData\Local\Microsoft\Windows\WER\ReportArchive or ..\WER\ReportQueue

    One thing to note that in Win7, there has been an improvement on how dumps are collected. If the same application is crashing repeated, Win7 optimizes so that it does not collect the dumps for the same type of crash more than once, This behavior is different from Win Vista /win2008 where this was not the case. See http://msdn.microsoft.com/en-us/library/bb513628(VS.85).aspx and check out WER_SUBMIT_BYPASS_DATA_THROTTLING flag which changed the behavior in Win7.

    Reply back if you are not able to see dumps at the above mentioned locations.


    This posting is provided "AS IS" with no warranties, and confers no rights.
    • Marked as answer by BabiDesai Tuesday, May 11, 2010 1:07 PM
    Thursday, October 01, 2009 4:41 AM

All replies

  • If the crashing application is elevated, the dumps will be located at C:\ProgramData\Microsoft\Windows\WER\ReportArchive or C:\ProgramData\Microsoft\Windows\WER\ReportQueue depending on whether queue mode is set or not.
    If the application is LUA, it will be at the location you mentioned C:\Users\XXX\AppData\Local\Microsoft\Windows\WER\ReportArchive or ..\WER\ReportQueue

    One thing to note that in Win7, there has been an improvement on how dumps are collected. If the same application is crashing repeated, Win7 optimizes so that it does not collect the dumps for the same type of crash more than once, This behavior is different from Win Vista /win2008 where this was not the case. See http://msdn.microsoft.com/en-us/library/bb513628(VS.85).aspx and check out WER_SUBMIT_BYPASS_DATA_THROTTLING flag which changed the behavior in Win7.

    Reply back if you are not able to see dumps at the above mentioned locations.


    This posting is provided "AS IS" with no warranties, and confers no rights.
    • Marked as answer by BabiDesai Tuesday, May 11, 2010 1:07 PM
    Thursday, October 01, 2009 4:41 AM
  • Thanks for the reply.

    I still did not see the mdmp or hdmp file. But I see 1 wer file .

    I have cleared all old problem reports from Action Center. Then I created a winform application to simulate the crash for Null Pointer exception.
    When I execute this application, the application silently kills but I don't see any entry created.
    For this application I even tried "Application.SetUnhandledExceptionMode(UnhandledExceptionMode.ThrowException);" before Application.Run

    Where as I was running my existing application and that crashed I saw 1 entry in wer file
     at C:\Users\XXX\AppData\Local\Microsoft\Windows\WER\ReportArchive .

    I am running as an Admin group.

    Thanks again for helping me with this.

    Thursday, October 01, 2009 9:09 PM
  • Can you share more information like the .NET runtime you are running your application against?
    This posting is provided "AS IS" with no warranties, and confers no rights.
    Thursday, October 01, 2009 9:23 PM
  • I am using VS2008 with .net 3.5
    I tried to execute the application using Debug/Release mode.

    Let me know if you need some more information

    Thursday, October 01, 2009 9:30 PM
  • If I am creating a C++ application with the the same pointer exception code. I see wer file getting generated at
    C:\Users\XXX\AppData\Local\Microsoft\Windows\WER\ReportArchive folder. But I still don't see the mdmp or hdmp file.

    Sorry for these chain of postings. But I really need to figure out a way to capture all these dmp files
    Thursday, October 01, 2009 9:55 PM
  • Hi,

    Is there any registry key I can set to get the behavior same as Windows Vista?
    I mean rather than changing the WER_SUBMIT_BYPASS_DATA_THROTTLING  flag, can I set some registry key so that I still get the crash dump even if the crashing app is same?
    Tuesday, October 20, 2009 4:04 PM
  • Why hasn't there been a response to this?  I'm seeing the same problem with Win2k8 R2.

    Tuesday, December 01, 2009 1:56 AM
  • Hi,

    I think you should be able to get the dumps if you set the registry key described in the below post.

    http://blogs.iis.net/webtopics/archive/2009/11/25/how-to-collect-a-crash-dump-of-an-iis-worker-process-on-iis-7-0-and-above.aspx
    Tuesday, May 11, 2010 1:07 PM