Windows 10: We have configured WER in Production env as we were seeing crashes for W3WP, Even after WER...

We have configured WER in Production env as we were seeing crashes for W3WP, Even after WER setup, We are not getting Crash Dumps Event logs are pointing to failure modle as w3wp.exe and ucrtbase.dllBut without cfash dumps it is tough to pin point the issue.Event logsFaulting application name: w3wp.exe, version: 10.0.17763.1, time stamp: 0xcfdb13d8Faulting module name: ucrtbase.dll, version: 10.0.17763.6189, time stamp: 0xbc3e3f37Exception code: 0xc0000409Fault offset: 0x000000000006d288Faultin

:)

 

Regarding WER Fault

Hi, Mck Ever Dumaguing

Welcome to the Microsoft Community.



It seems like you’re referring to a Windows Error Reporting (WER) fault. WER is a feature of Microsoft Windows that collects and sends data from software crashes to Microsoft. It helps the company discover and fix issues in their software.

If you’re seeing a WER fault, it means a program on your system has crashed. The fault message should contain information such as the name of the faulty application, the version of the software, and the time of the crash.

Here are a few steps you can take to resolve the issue:

1. Update your software and drivers: Make sure your software, drivers, and Windows itself are up-to-date. Updates often contain fixes for known issues.
   
2. Scan for malware: Run a full system scan using a reputable antivirus program. Malware can cause software to behave unexpectedly and crash.
   
3. Reinstall the faulty software: If a specific software is crashing frequently, try uninstalling and reinstalling it.
   
4. Run a System File Checker (SFC) scan: Open Command Prompt as an administrator, type “sfc /scannow”, and press Enter. This will check for and repair corrupted system files.
   
5. Use Windows’ built-in troubleshooters: Go to Settings > System > Troubleshoot > Other troubleshooters, and run the relevant troubleshooter.
   

If this error occurs again in the future, please try to take a screenshot and share it with me, if you can try to keep the specific error message, I think it will be more effective in solving the problem. Thanks for your understanding and support.

Best Regards

Martin | Microsoft Community Support Specialist

 

Regarding WER Fault

Hello, I have this problem where when I shutdown or restart my laptop before it can even shutdown or restart it's saying that a program is open or something and it's saying that WER Fault is open and that I need to close it so I don't lose work or anything important but I don't even see any WER Fault open it just appears when i try to shut down or restart it. Yes I did make change's I believe I I got a message from Acer sense that if I see the administrator thing where you can choose to allow or don't allow the program to make changes to your device thing I need to click allow then I did click allow then when I go to settings to check for updates it found a Acer incorporated thing and it installed it then I restarted my laptop and I saw the WER Fault thingy. Feel free to ask me anything just know that it's not gonna be exact since my brain doesn't store memories that long.

 

How to avoid WER reports being deleted after transmission?

Usually crashing applications report such by transmitting WER reports.
The "Diagnostic Data Viewer" will show that the application hanged, period.
But checking out the event of that crash (Event Viewer) will show that a number of files have been transmitted.

Like:

\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERAF7B.tmp.WERInternalMetadata.xml\\?\C:\ProgramData\ Microsoft\Windows\WER\Temp\WERAF9B.tmp.xml\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERAF9A.tmp. csv\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERAFBA.tmp.txt\\?\C:\Users\UserName\AppData\Local\ Temp\WER1FDB.tmp.appcompat.txt

These files are, by default, deleted after closing the crashed application.
Wonder though what is actually being reported, i.e. what the contents of these files are. Any privacy stuff?

Wonder, is there a way to avoid these files from being deleted?

Thanks.