I have a system (Windows 10, version 20H2, OS Build 19042.1052) that locks up regularly for a few minutes. It doesn't crash/blue screen, but a live kernel dump is logged in the Application event log:
Windows Error Reporting event id 1001:
Fault bucket , type 0
Event Name: LiveKernelEvent
Response: Not available
Cab Id: 0
Problem signature:
P1: 1a1
P2: ffffe08a2d98c540
P3: 0
P4: 0
P5: 0
P6: 10_0_19042
P7: 0_0
P8: 256_1
P9:
P10:
Attached files:
\\?\C:\WINDOWS\LiveKernelReports\PoW32kWatchdog\PoW32kWatchdog-20210615-0615.dmp
\\?\C:\WINDOWS\TEMP\WER-417554453-0.sysdata.xml
\\?\C:\WINDOWS\LiveKernelReports\PoW32kWatchdog-20210615-0615.dmp
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER76C9.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER76DA.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER76E8.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER7709.tmp.txt
These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_1a1_b56071bcde394c864256bb672ce88048e33283f_00000000_cab_23199732-b72b-44e5-b26f-f179c6892d31
Analysis symbol:
Rechecking for solution: 0
Report Id: 23199732-b72b-44e5-b26f-f179c6892d31
Report Status: 4
Hashed bucket:
Cab Guid: 0I would like to view the PoW32kWatchdog-20210615-0615.dmp file in WinDbg.exe so I can see the stack trace of the faulting thread. However, the .dmp file is nowhere to be found:
C:\WINDOWS\LiveKernelReports\ -> the file is no longer there, presumably because Windows Error Reporting attached it to its report C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_1a1_b56071bcde394c864256bb672ce88048e33283f_00000000_cab_23199732-b72b-44e5-b26f-f179c6892d31 -> does no longer exist, presumably because the report has been sent to Microsoft before I am able to access it C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_1a1_b56071bcde394c864256bb672ce88048e33283f_00000000_cab_23199732-b72b-44e5-b26f-f179c6892d31 -> I find a report.wer file here, but it is an name-value-pair file of a few kb, not the .dmp file I'm looking for.
How do I prevent Windows Error Reporting from deleting the .dmp file? Or is there another way to make a copy / backup of the .dmp file before it is deleted by Windows Error Reporting?
1 Reset to default