A week or two ago my wife told me that her computer was occasionally crashing. I installed a program called whocrashed which reads memory dumps and tells you what hardware or software definitely or most likely caused the crash. So after its installed her computer crashes. I run Whocrashed and it says that memory dump isn’t enabled. My wife enables it. The next time her computer crashes I run it again, and again it says memory dump isn’t enabled. I enable it again and have her reboot to make sure that the change sticks. Tonight I ask her if she’s had any more crashes, she says yes, so I run Whocrashed. Guess what, once again it’s telling me that memory dump isn’t enabled.
Does anybody have any idea why it keeps turning off?
Offhand, not knowing about whocrashed, is the right memory dump selected?
Is the target directory okay?
Is WinDbg actually installed and running?
Aside from all of that, when is the computer crashing? During any specific activity? Is the crash related to video? Sound? Anything she can correlate to ? Oh, and during a crash, if she gets the bluescreen, it should actually SAY that it is creating a dump file, if it is. If you aren’t getting that text, it just might be possible that the problem is somewhere in the drivers for the I/O subsystems.
I think so, but I’ll double check tomorrow to make sure.
She says the crashes started happening after her monitor (flat screen) fell to the ground, so it might have something to do with the video card, but I don’t think it is, and I don’t have the money to justify buying a new video card to test it. If I could analyze a crash dump that would be the best way at the moment. And if it turned out to be the video card then at least I cold buy a new card knowing that it will solve the problem rather than being a gamble.
And no, she doesn’t get a blue screen, just a reboot.
Is she definitely not getting a BSOD? Not even a super quick one that does the dump and then reboots? If she’s not getting a BSOD, that’s why you’re not getting a crashdump. It could be that if it’s only writing out a kernel dump, or the computer has a small amount of RAM and very fast disks that the dump is happening fast enough that she doesn’t notice the BSOD, but I’d say that’s unlikely.
I’d check the settings and make sure that full memory dump is set (or kernel, depending on what whocrashed wants) and that auto-reboot is NOT set. At least this way she can confirm whether she’s getting BSODs.
Is there any chance this machine was once subject to group policies? It could be that they’re persisting and overwriting your crashdump settings - the easiest way to confirm this is to make the settings then do a reboot and ensure they’re still there.
If she really isn’t getting a BSOD then I’d be inclined to suggest hardware fault.
I know she isn’t getting a dump (hehe) because when I keep checking the option it keeps getting turned off. And no, it was never part of a group policy. It’s a home PC that was never part of any domain. And I did change the settings and reboot the computer. It obviously didn’t stick.
Sorry. Maybe you should forget about “whocrashed” (who nobody seems to have heard about) and investigate your event logs. Also stop the auto reboot and actually look at the stop screen to get an insight about what crashed. Otherwise good luck disassembling your crash dump!
Well, I think the problem is solved; we’ll see. And I’m sorry that I brought up Whocrashed because that had nothing to do with the problem.
The problem was that I would set Windows to write to the system log and create a 64k dump file in the event of a system failure, but that setting would be gone by next reboot. I changed the settings again last night and rebooted the computer and the settings are still there instead of reverting back to do an automatic restart, don’t write an event to the system log, and don’t write a memory dump.
I’m going to chalk this up to something I’ve seen a few times. A computer problem that seems to have no explanation, and then goes away on its own for no apparent reason.