Author Topic: How do you 'capture' a BSOD? (Read 22,874 times)

nosh · « **on:** December 16, 2007, 08:17 AM »

I recently faced some hardware issues with my dual monitor setup. Anytime I ran a graphics intensive program the display would get garbled before completely freezing, forcing me to hit the power button. On one of these occasions when I waited a little longer to reset the PC, a BSOD flashed very briefly and the PC complete froze again with a garbled display. I tried to emulate this a few times with a camera in my hand (feeling like a complete idiot, as you may have guessed) and having absolutely no luck. The problem was finally sorted out

Spoiler (click to show/hide)

by pulling out & reconnecting the RAM and graphics card and also connecting my primary monitor to the non-DVI outlet without the VGA-DVI adapter, I still don't know what exactly was at fault but the PC is running glitchlessly for several days now

but maybe I could have solved the matter a lot earlier if I could have viewed the BSOD. Are these pretty babies recorded somewhere (I looked for error.log or similarly named files to no avail) or is there some other way of getting this info?

Josh · « **Reply #1 on:** December 16, 2007, 08:29 AM »

I cannot seem to find a homepage for it anymore, but bluesave would let you save the blue screen information.

Another solution is that you can use the event viewer, start - run - eventvwr.msc, and look in the system log for "Bug Check" listings. This contains four hex codes. The second hex code can be looked up using the Windows Debugging Tools. This program contains a help file which has a section to lookup all of the bug check codes.

nosh · « **Reply #2 on:** December 16, 2007, 08:54 AM »

Thanks, Josh. I did look at the Event Viewer (thought I mentioned it in my post but apparently it got lost in an edit) and it didn't have any info relating to the crashes. Will look into Bluesave and the debugging tools.

Josh · « **Reply #3 on:** December 16, 2007, 09:05 AM »

Like I said, look for an entry under "System" labeled BugCheck

It should contain information similar to such:

Quote

The computer has rebooted from a bugcheck. The bugcheck was: 0x1000008e (0xc0000005, 0x99621f07, 0xad5ff9a4, 0x00000000). A dump was saved in: C:\Windows\Minidump\Mini121507-02.dmp.

This will tell you the code. The first number 0x10000008e is the bug check code. This one indicates a KMODE_EXCEPTION_NOT_HANDLDED bugcheck. Again, in combination with the bluesave utility and the debugging tools, I feel this could help you.

nosh · « **Reply #4 on:** December 16, 2007, 09:47 AM »

Duly noted. The crashes happened around two weeks back, I cleared out the previous logs between crashes and investigated every single entry in the event viewer thereafter. I'm pretty certain there weren't any 'BugCheck' entries there. Thanks again.

PS: I get the fact that I can't use the Debugging Tools if I don't actually have a bugcheck code to refer, sorry if I wasn't clear earlier.

Josh · « **Reply #5 on:** December 16, 2007, 09:58 AM »

This was more of a tip for you if it happens again

f0dder · « **Reply #6 on:** December 16, 2007, 12:33 PM »

Probably a graphics driver issue, or possible corrupt ram, or an issue with your PSU, or... yes, computers are wonderful. But most definitely not because of VGI->DVA adapter, and not because you're running dual monitors either (except that running two monitors will use more video ram).

If you do get a BSOD, windows should be able to save the BSOD information, as long as you have a paging file on your system drive. Also, it's helpful to not have the system automatically reboot on BSOD, check system properties -> "advanced" tab -> "settings" button in "startup and recovery" group, and remove the tick in "Automatically restart". That'll give you more time to read the BSOD while it happens

tinjaw · « **Reply #7 on:** December 16, 2007, 01:12 PM »

The issue is probably that the default behavior for Windows is to reboot on a BSOD. To change this behavior right-click on My Computer and choose properties. Go to the Startup and Recovery tab and uncheck Automatically Restart. This will allow you to be able to write down the details of the BSOD.

[attachthumb=#][attachthumb=#]

nosh · « **Reply #8 on:** December 16, 2007, 01:42 PM »

Thanks f0dder & Tinjaw (f0dder mentioned the auto restart tip in his post too

) . It was probably a loose connection then - most likely to the gfx card. I thought of swapping the adapter ports coz Dxdiag (esp. directdraw test 2 - the block bouncing in 'normal' mode) was clearly more responsive for the non-DVI output, it started off a bit slow on the DVI port before picking up speed.

Though the PC didn't restart on its own during these freezes, I did have 'Automatically restart' enabled, it obviously makes sense to have that disabled. In my case the BSOD flickered for a split second before the display got garbled again - no restart though. I have been running with a paging file

Spoiler (click to show/hide)

read something on TweakGuides about Windows absolutely needing one, irrespective of mem size

but on another drive so it sucks to enable it on C: too, for the mem dump. I'll know what to do the next time something acts up tho.

PS: The freezes were sporadic but one particular OpenGL screensaver (Euphoria, from the ultramon people) jammed things up every single time. Just out of curiosity: We keep regular DirectX updates but what about OpenGL? How does one go about updating their libraries?

tinjaw · « **Reply #9 on:** December 16, 2007, 01:45 PM »

Quote from: nosh on December 16, 2007, 01:42 PM

How does one go about updating their libraries?

OpenGL libraries are updated with you update your video drivers.

nosh · « **Reply #10 on:** December 16, 2007, 01:47 PM »

D-oh! Thanks.

f0dder · « **Reply #11 on:** December 16, 2007, 02:40 PM »

Quote from: nosh on December 16, 2007, 01:42 PM

read something on TweakGuides about Windows absolutely needing one, irrespective of mem size

Not really true, you can disable it completely on WinXP (and probably later versions as well, meaning win2003 and Vista) and things will run just fine - if you disable paging file on win2k and earlier, the system will generate a minimal paging file and throw a warning on boot, though.

Obviously you'll run into trouble if you exhaust physical memory, and the system might not be able to save crash dump information without a pagefile, but I've been running without for sevaral years on xp32 and now xp64, with 1gig of memory in the beginning and 2gig for quite a while. With 1gig I had problems every now and then with some games, but haven't had any problems since I upgraded to 2gig.

J-Mac · « **Reply #12 on:** December 16, 2007, 05:08 PM »

Nosh - I also run two monitors: a 21" Viewsonic as primary and a 19" WS Viewsonic as seconday. I used UltraMon for a while and loved it but several odd conflicts and many crashes later I finally gave up on it. I discovered that it can have some issues with upscale nVidia cards - particularly if you try to use the nVidia Desktop Manager software that you usually install with your card.

The UltraMon developer - at least the guy who replies for UltraMon on their forum - told me about the nVidia Desktop Manager conflicts but he insisted that there should be no other conflicts with nVidia cards. Yet I have "run into" several folks online who have expereinced similar issues when using UltraMon with nVidia cards. Which is a shame because UM does add plenty to dual monitor setups.

Jim

vegas · « **Reply #13 on:** December 16, 2007, 05:16 PM »

Quote from: nosh on December 16, 2007, 08:17 AM

I recently faced some hardware issues with my dual monitor setup. Anytime I ran a graphics intensive program the display would get garbled before completely freezing, forcing me to hit the power button. On one of these occasions when I waited a little longer to reset the PC, a BSOD flashed very briefly and the PC complete froze again with a garbled display. I tried to emulate this a few times with a camera in my hand (feeling like a complete idiot, as you may have guessed) and having absolutely no luck. The problem was finally sorted out but maybe I could have solved the matter a lot earlier if I could have viewed the BSOD. Are these pretty babies recorded somewhere (I looked for error.log or similarly named files to no avail) or is there some other way of getting this info?

I had a laptop that did this for someone a couple years ago, i pulled out my camera and let it capture video till it BSOD'd. It was just a fraction of a second, but when I looked at the video frame by frame, there was the entire BSOD message. Good luck.

Ralf Maximus · « **Reply #14 on:** December 16, 2007, 05:23 PM »

Quote from: J-Mac on December 16, 2007, 05:08 PM

The UltraMon developer - at least the guy who replies for UltraMon on their forum - told me about the nVidia Desktop Manager conflicts but he insisted that there should be no other conflicts with nVidia cards. Yet I have "run into" several folks online who have expereinced similar issues when using UltraMon with nVidia cards. Which is a shame because UM does add plenty to dual monitor setups.

I'm an UltraMon user with an expensive (though older) nVidia card. In fact, mine's a weird one: Quadro NVS-440. With nVidia's Desktop Management turned off my system's rock solid.

It wasn't always that way -- when I first installed UM things got pretty unstable. It took awhile to discover the conflict between DM and UM, and that disabling nVidia's "enhancements" fixed the problem.

FWIW, there's a new beta of UltraMon 3.0 available on their website. It now relies on GDI+ and has multiple fixes for 64-bit platforms and Vista. Might be worth checking it out, as UM is indeed a superior management system for multiple monitors.

nosh · « **Reply #15 on:** December 16, 2007, 06:37 PM »

I'm running an nVidia card too [FX6200], the Desktop manager acted up very early on and I've had it disabled since.
Ultramon & WinSplit Revolution are more than capable of handling everything I need.

Ralf Maximus · « **Reply #16 on:** December 16, 2007, 09:57 PM »

I just googled WinSplit Revolution. I *think* I get what it does -- turn a bigger monitor into several smaller monitors. But why is this useful?

Is this something you need a widescreen to appreciate?

nosh · « **Reply #17 on:** December 16, 2007, 10:38 PM »

It lets you quickly place windows where you want with a lot more precision than Windows 'tile' function. If you're running one app maximized per monitor at all times it won't be much use.

It uses very intuitive shortcut keys, Ctrl+Alt+Numpad 1-9. The numpad keys apply directionally, for example Ctrl+Alt+9 places the active app to the top right corner (quarter screen occupied), Ctrl+Alt+8 would make it occupy the top half of the screen. Kind of like a game's controls. You'll drag apps around and resize borders manually a lot less once you start using it.

ChalkTrauma · « **Reply #18 on:** December 17, 2007, 01:56 AM »

I had posted this before on another thread... Great post on analyzing crash dump files:

http://forums.majorgeeks.com/showthread.php?t=35246

This can really help you track down a misbehaving driver..

tinjaw · « **Reply #19 on:** December 17, 2007, 02:55 PM »

Thanks for the link ChalkTrauma! That's a keeper.