Set whenever the stage 2 exchange with Windows Error Reporting fails: Network connectivity was detected according to System Event Notification Services (SENS), but the actual exchange failed for whatever reason (for example, it could not resolve the DNS name,Ĭould not connect, or the request timed out).Īny other failure in the Windows HTTP (WinHTTP) network stack. For example, if the server returned 500, stage 1 is considered a failure. The HTTP exchange succeeded, but the server returned a response other than 200 or 404. Set whenever the stage 1 exchange with Windows Error Reporting fails: This is True if the current computer time is before the time that is recorded in HKLM\SOFTWARE\Microsoft\Reliability\Analysis\RAC\RacWerSampleTime. Set whenever the computer is in the rights account certificate (RAC) sample for data collection. Set whenever the server requests data to be collected. This flag is not set if the report was in the queueĪnd then it was reported out of the queue (such as service process crashes). The report was queued for whatever reason,įor example, for policy settings, lack of network The following table breaks down all possible flags. It flags significant events and states relevant to The report status bitmap is Field 21 in the 1001 event, and it is writtenĪs a decimal string. The bitmap is broken down in the following section. For application crashes, you can use this value to correlate the 1001 event with the 1000 event or the 1002 event.įor kernel reports, this is a minidump-style time stamp.ģ2-bit integer bitmap, as a decimal string If the report is being resubmitted from the archive (it was submitted before and the user is resubmitting it to check for a response or solution), then this value is 1. ![]() This should be the same as Field 1 (fault bucket) for kernel ![]() It only exists for blue-screen and live kernel reports (they go to OCA, not to Windows Error Reporting). The content of these strings depends on the report.įield 16: List of full paths to all files that are attached to the report.įield 17: Path to the directory (somewhere in WER's report store) potentially housing these files. The message can report up to ten strings. Report signature strings (that is, bucketing parameters). This is 0 if the server did not ask for a cabinet (.cab) file or did not return a. Windows Error Reporting back-end iCab field number. Response string from the Windows Error Reporting server, or the string "Not available" if no response was received. The Windows Error Reporting bucket table that houses the bucket. The bucket table (that is, the Fault bucket type) for phony error bucket numbers is 5. If there was an error submitting the event, the Windows Error Reportingservers will return a phony bucket value from the following list:īucket=3: S2_SelectBucket returned blank/null iBucket (all tables)īucket=4: S2_SelectBucket has nonzero return code (all tables)īucket=5: S2_SelectBucket err'ed twice (all tables)īucket=6: Can't open SQL connection failure (all tables)īucket=7: BucketGeneric, unregistered EventType (generic only)Bucket=8: BucketGeneric, no parms (P1 is missing) (generic only)īucket=10: Generic bucket NetworkDiagnosticsFramework/aspnet (generic only) The Windows Error Reporting bucket number (32-bit integer) or an OCA bucket string. The following table explains the event message contents. This eventĮvent 1001 is logged at any time the report transitions state (that is, goes to ![]() The event contains a summary of the report's signatures, Windows Error Reportingīucket information, and other fields that describe the state of the report. Reports (for example, application crashes, hangs, and generic reports). The 1001 event is logged by the Windows Error Reporting infrastructure
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |