I have a system (Windows 10, version 20H2, OS Build 19042.1052) that locks up regularly for a few minutes. It doesn't crash/blue screen, but a live kernel dump is logged in the Application event log:
Windows Error Reporting event id 1001:
Fault bucket , type 0 Event Name: LiveKernelEvent Response: Not available Cab Id: 0 Problem signature: P1: 1a1 P2: ffffe08a2d98c540 P3: 0 P4: 0 P5: 0 P6: 10_0_19042 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\LiveKernelReports\PoW32kWatchdog\PoW32kWatchdog-20210615-0615.dmp \\?\C:\WINDOWS\TEMP\WER-417554453-0.sysdata.xml \\?\C:\WINDOWS\LiveKernelReports\PoW32kWatchdog-20210615-0615.dmp \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER76C9.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER76DA.tmp.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER76E8.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER7709.tmp.txt These files may be available here: \\?\C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_1a1_b56071bcde394c864256bb672ce88048e33283f_00000000_cab_23199732-b72b-44e5-b26f-f179c6892d31 Analysis symbol: Rechecking for solution: 0 Report Id: 23199732-b72b-44e5-b26f-f179c6892d31 Report Status: 4 Hashed bucket: Cab Guid: 0 I would like to view the PoW32kWatchdog-20210615-0615.dmp file in WinDbg.exe so I can see the stack trace of the faulting thread. However, the .dmp file is nowhere to be found:
C:\WINDOWS\LiveKernelReports\ -> the file is no longer there, presumably because Windows Error Reporting attached it to its report C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_1a1_b56071bcde394c864256bb672ce88048e33283f_00000000_cab_23199732-b72b-44e5-b26f-f179c6892d31 -> does no longer exist, presumably because the report has been sent to Microsoft before I am able to access it C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_1a1_b56071bcde394c864256bb672ce88048e33283f_00000000_cab_23199732-b72b-44e5-b26f-f179c6892d31 -> I find a report.wer file here, but it is an name-value-pair file of a few kb, not the .dmp file I'm looking for.
How do I prevent Windows Error Reporting from deleting the .dmp file? Or is there another way to make a copy / backup of the .dmp file before it is deleted by Windows Error Reporting?
1 Reset to default
