none
How to configure CER with no dialog?

    Question

  • I just tried to configure my XP SP2 workstation to send crash reports to a CER file share such that no dialog box would be presented. It didn't work as expected. ReportFault returned frrvErrNoDW and no crash report showed up in the file share. I have the 'Configure Error Reporting' policy enabled and a corporate file path entered. This works fine when I elect to 'send report' through the dialog box. But when I set the 'Display Error Notification' policy to 'disabled' I get frrvErrNoDW returned rather than the successful crash report that I expected. What am I forgetting?

     

    BTW the CER file share was created with CER 1.5 - I don't have access to CER 2.0.

    • Moved by Max Wang_Chinasoft Tuesday, April 26, 2011 5:08 PM forum consolidation (From:Windows Error Reporting for ISVs)
    Tuesday, May 29, 2007 1:51 AM

Answers

  • I am sure we can help!

     

    John,  there is some public documentation found at http://www.microsoft.com/resources/satech/cer but it does not go into detail on setting headless reporting to a CER file share. I offer the link anyway because it discusses how to manually create the CER share with the right set of permissions.

     

     I'll take a look at the policy file and the values they set in the registry to give you guidance on using headless CER reporting and post what I find.  I'll also talk to the WER Client PM and lead dev to see if there is a caveat when calling ReportFault in headless mode for CER.  (We may need a day or two to look this over).  Does the error only happen when you call ReportFault or does it repro if you crash a process and let the exception go to the UEF?  Also, can you tell me if the same behavior happens when reporting to a local folder on the reporting machine (no share ...for example; 'c:\testcer\root')?

     

    Overall, the policy keys of interest to you are...

    HKLM\Software\Policies\Microsoft\PCHealth\ErrorReporting\DW

    • DWAllowHeadless (DWORD): If this value is 1, Error Reporting will allow silent reports (only with DWFileTreeRoot)
    • DWFileTreeRoot (SZ): This value is the valid UNC path to a Corporate Error Reporting shared directory. The error report will be aborted if this path is not valid
    • DWTracking (DWORD): If this value is 1, Error Reporting will write out tracking information to log files in the tree

    Kind Regards,

    -Jason

    Wednesday, May 30, 2007 4:54 PM
  • John,

     

    let's give this a try; Copy and past this into notepad, save it to your desktop, and then rename the extention to '.reg'. Then double click on the reg file.

    Code Snippet

    Windows Registry Editor Version 5.00

     

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting]
    "DoReport"=dword:00000001
    "ShowUI"=dword:00000000

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\DW]
    "DWAllowHeadless"=dword:00000001
    "DWFileTreeRoot"="\\\\servername\\sharename"

     

    Just be sure to replace the value of DWFileTreeRoot with the path to your CER directory using the format above. 

    Let us know how this works out for you.

     

    Thanks,

    -Jason

     

    Friday, June 01, 2007 3:57 PM
  • That’s right…

    In Windows Vista, the protocol changed to redirect Error Reports.  The effect is that you cannot use CER (Corporate Error Reporting) with Vista since it is a deprecated product.  You need to use AEM (Agentless Event Management) with is part of 'Operation Manager 2007'.

    You can configure the server location, and add SSL encryption to the communication between the Vista machine and the Operations Manager server.  You can also specify a custom port and additional authentication.  These settings are saved in the registry…

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting:

    "CorporateWerServer"                                    REG_SZ

    "CorporateWerUseSSL"                                  REG_DWORD

    "CorporateWerPortNumber"                          REG_DWORD

    "CorporateWerUseAuthentication"               REG_DWORD

     

    Using these settings through AEM are documented in the AEM section of Operations Manager 2007.  More information can be found at http://technet.microsoft.com/en-us/library/bb309443.aspx.

    Kind regards,

    -Jason

    Tuesday, June 19, 2007 8:02 PM
  • Microsoft's Application Verifier tool might be helpful here:

     

    http://www.microsoft.com/technet/prodtechnol/windows/appcompatibility/appverifier.mspx

     

    Claus

     

    http://www.clausbrod.de/Blog

     

    Friday, July 27, 2007 4:07 PM
  •  

    Hi Robert,

     

    I have seen folks do this in a number of ways... from killing notepad after opening an extremely large (http://support.microsoft.com/kb/311800/en-us) to using the Office Application Recovery tool to force a crash in an Office application (ships with Office XP and higher ...see http://support.microsoft.com/kb/294933/en-us).  Folks can also use the Application Verifier with Fault Injection (http://www.microsoft.com/downloads/details.aspx?FamilyID=d2dd7ee0-aaa2-402a-821d-43795d6cf139&DisplayLang=en).

     

    Kind regards,

    -Jason

     

    Monday, August 20, 2007 4:16 PM

All replies

  • I am sure we can help!

     

    John,  there is some public documentation found at http://www.microsoft.com/resources/satech/cer but it does not go into detail on setting headless reporting to a CER file share. I offer the link anyway because it discusses how to manually create the CER share with the right set of permissions.

     

     I'll take a look at the policy file and the values they set in the registry to give you guidance on using headless CER reporting and post what I find.  I'll also talk to the WER Client PM and lead dev to see if there is a caveat when calling ReportFault in headless mode for CER.  (We may need a day or two to look this over).  Does the error only happen when you call ReportFault or does it repro if you crash a process and let the exception go to the UEF?  Also, can you tell me if the same behavior happens when reporting to a local folder on the reporting machine (no share ...for example; 'c:\testcer\root')?

     

    Overall, the policy keys of interest to you are...

    HKLM\Software\Policies\Microsoft\PCHealth\ErrorReporting\DW

    • DWAllowHeadless (DWORD): If this value is 1, Error Reporting will allow silent reports (only with DWFileTreeRoot)
    • DWFileTreeRoot (SZ): This value is the valid UNC path to a Corporate Error Reporting shared directory. The error report will be aborted if this path is not valid
    • DWTracking (DWORD): If this value is 1, Error Reporting will write out tracking information to log files in the tree

    Kind Regards,

    -Jason

    Wednesday, May 30, 2007 4:54 PM
  • Hi Jason,

     

    If I let an exception go to the UEF I get an ancient-looking dialog box. It looks like a relic from NT4. When an AeDebug/Debugger key is defined it says

     

    The instruction at "0xNNNNNNNN" referenced memory at "0xNNNNNNNN". The memory could not be "written".

     

    Click on OK to terminate the program

    Click on CANCEL to debug the program

     

    and those two buttons are on the dialog box. Clicking OK does not result in a CER cab being saved. If there is no AeDebug/Debugger key defined, only the OK button appears. Getting rid of the AeDebug/Debugger key didn't help the ReportFault() case any either.

     

    I set up a local folder for CER and it didn't change anything.

     

    DWAllowHeadless is 1

    DWFileTreeRoot was set (earlier to a corporate file share and at your request to a local dir) Cab files go to both locations just fine if not in headless mode, so I don't think a permissions problem is involved, unless the permissions need to be different in a headless scenario.

    DWTracking did not exist, but I added it and set it to 1.

     

    I also tried renaming the AeDebug key itself to something else, but that didn't improve matters beyond getting rid of just the AeDebug/Debbuger key.

     

     

     

    Thursday, May 31, 2007 2:59 PM
  • John,

     

    let's give this a try; Copy and past this into notepad, save it to your desktop, and then rename the extention to '.reg'. Then double click on the reg file.

    Code Snippet

    Windows Registry Editor Version 5.00

     

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting]
    "DoReport"=dword:00000001
    "ShowUI"=dword:00000000

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\DW]
    "DWAllowHeadless"=dword:00000001
    "DWFileTreeRoot"="\\\\servername\\sharename"

     

    Just be sure to replace the value of DWFileTreeRoot with the path to your CER directory using the format above. 

    Let us know how this works out for you.

     

    Thanks,

    -Jason

     

    Friday, June 01, 2007 3:57 PM
  • Indeed, that works. Thanks.
    Saturday, June 02, 2007 10:29 AM
  • I'm also trying to set up a CER server now. Using the instructions in this thread, I was able to send crash reports from an XP system to the CER server. Vista clients, however, don't work as expected.

    I'm guessing that this is because the new WER infrastructure in Vista doesn't check the old PCHealth\ErrorReporting registry keys, and instead wants to see proper configuration values in HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting.

    The documentation at http://msdn2.microsoft.com/En-US/library/aa363489.aspx lists a new set of registry keys, such as CorporateWERDirectory and CorporateWERServer. However, I'm not sure how to set those keys correctly and what registry keys such as CorporateWERPortNumber or CorporateWERUseSSL mean, and whether I actually need them or not. Does anyone have an example of how to set those keys?

    BTW, when logging registry accesses using procmon, I found that the WER code actually checks for key names like "CorporateWerDirectory" (i.e. not CorporateWERDirectory), so the docs seem to b slightly off (although this probably doesn't matter in practice).

    Thanks,

    Claus

    http://www.clausbrod.de/Blog

    Thursday, June 14, 2007 12:24 PM
  • I am using Vista and unable to get the report with minidump attached - although i used the requiresd APIs.

     

    What is CER server and where to configure it ? Can you provide some more light in this area ? Till now, other than coding I configured WER in control panel and getting a report without having any minidump. Do I need to configure CER ? If so then how ?

     

    Monday, June 18, 2007 4:36 AM
  • CER = Corporate Error Reporting. It's a mechanism to direct the crash reports to one of your own servers instead to Microsoft's (with the option to sending them on later).

    I used the instructions Jason provided in this thread to set up a working CER server connection for XP clients. I could not yet get Vista clients to talk to the CER server.

      Claus

    http://www.clausbrod.de/Blog



    Monday, June 18, 2007 7:08 AM
  • I think whatever Jason has mentioned is with respect to XP - not Vista.

    In Vista registry, I can't see the path he mentioned in his solution.

     

    One more query :

                                   a) Can I configure the CER server in the same machine where my client exists ? or it has to be a separate machine.

                                        I am using Vista - enterprise.

     

                                   b) Without having Versign id, can I send the crash reports to Winqual server ? If there is a crash in Microsoft Word,

                                        then   does the report goes to Winqual server, even though I do not have Versign id ?

     

                                  c) If my company has a Verisign id, then all the crash reports (any product )will be reported to Winqual or only the 

                                      product for which  I received the verisign id will be reported to Winqual ?

    Monday, June 18, 2007 9:05 AM
  • The Vista registry entries for setting up a CER connection are documented at http://msdn2.microsoft.com/En-US/library/aa363489.aspx. I'm still struggling to get them working, though.

    Crash reports on the Winqual site will become visible to you if a) your app has a Verisign ID and has been signed with it and b) the app has been explicitly registered ("mapped") on the Winqual site and c) you've got an account for the Winqual site and d) the user agrees to send the crash report. At least that's the theory which I am aware of. The online help pages at the Winqual site have more details.

    Your Verisign ID is only relevant for your own apps. If some other app crashes on your system, the crash report will go to the Winqual site if that app is signed with its own ID and if the app has been explicitly registered with Winqual by its vendor.

    Claus

    http://www.clausbrod.de/Blog


    Monday, June 18, 2007 9:15 AM
  • Registry entry in  HKEY_LOCAL_MACHINE\ path does not have all the properties mentioned in the documentation.

    Also, HKEY_CURRENT_USER does not have the path at all as mentioned in the documentation.

     

    Do you think the CER server concept is replaced in Vista by Problem Reports and Solutions inside control panel ?

    We can Queue up the reports and can be sent later on - if required by someone like an administartor.

     

     

     

    Monday, June 18, 2007 10:07 AM
  • I ran some more experiments today using WER-aware code on my Vista system, and made minor progress.

    After setting HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\CorporateWERServer (using the name of some system in our network), a Vista system apparently no longer tries to contact the Microsoft servers. Instead, it tries to talk to port 1273 on the specified server machine and send crash information to it.

    If communication with the specified server fails (for example, because no process is listening to port 1273 on the CER server system), it seems that the crash report is queued, meaning that the crash data are archived locally, probably in the hope that a connection to the server can be made sometime in the future, at which point the crash data will be transmitted. To be prepared for this eventuality, the local WER code stores both the crash report summary and minidump information (which then also becomes visible and accessible in the Problem History window).

    If my interpretation of the sequence of events is correct, it probably means that my WER code may actually be mostly correct, and the only reason why minidump data isn't generated while talking to the Microsoft servers is that those servers for some reason don't request additional crash data (such as minidumps) from the client. This would be in line with Jason's recent description in the thread on ReportFault() vs. WerReportCreate/WerReportSubmit() on Vista

    The other conclusion from my findings is that a special process must be running on the CER server, or else Vista clients won't be able to push crash data to the server. This is different from XP, where it was sufficient to specify the UNC path of a directory on the server (and to create a certain directory structure in that directory).

    Cheers,

      Claus

    http://www.clausbrod.de/Blog

    Tuesday, June 19, 2007 7:02 PM
  • That’s right…

    In Windows Vista, the protocol changed to redirect Error Reports.  The effect is that you cannot use CER (Corporate Error Reporting) with Vista since it is a deprecated product.  You need to use AEM (Agentless Event Management) with is part of 'Operation Manager 2007'.

    You can configure the server location, and add SSL encryption to the communication between the Vista machine and the Operations Manager server.  You can also specify a custom port and additional authentication.  These settings are saved in the registry…

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting:

    "CorporateWerServer"                                    REG_SZ

    "CorporateWerUseSSL"                                  REG_DWORD

    "CorporateWerPortNumber"                          REG_DWORD

    "CorporateWerUseAuthentication"               REG_DWORD

     

    Using these settings through AEM are documented in the AEM section of Operations Manager 2007.  More information can be found at http://technet.microsoft.com/en-us/library/bb309443.aspx.

    Kind regards,

    -Jason

    Tuesday, June 19, 2007 8:02 PM
  • Hi Guys,
     
    Im hoping someone can help me here. I have installed and configured CER within a virtual environment (MS virtual server2005 sp2). Client installation and group policy configuration has been implemented without any problems but what i cant do is force an error from an application so i can test that my implementation has worked. This is probably a novice question and apologies in advance but your help would really be appreciated.
    Thanks in advance.
     
    Robert
     
    Thursday, July 26, 2007 10:12 AM
  • Microsoft's Application Verifier tool might be helpful here:

     

    http://www.microsoft.com/technet/prodtechnol/windows/appcompatibility/appverifier.mspx

     

    Claus

     

    http://www.clausbrod.de/Blog

     

    Friday, July 27, 2007 4:07 PM
  •  

    Hi Robert,

     

    I have seen folks do this in a number of ways... from killing notepad after opening an extremely large (http://support.microsoft.com/kb/311800/en-us) to using the Office Application Recovery tool to force a crash in an Office application (ships with Office XP and higher ...see http://support.microsoft.com/kb/294933/en-us).  Folks can also use the Application Verifier with Fault Injection (http://www.microsoft.com/downloads/details.aspx?FamilyID=d2dd7ee0-aaa2-402a-821d-43795d6cf139&DisplayLang=en).

     

    Kind regards,

    -Jason

     

    Monday, August 20, 2007 4:16 PM
  •  

    Wednesday, June 04, 2008 10:21 PM