Windows event log

Post by **GORDON** » Sat Apr 05, 2014 11:55 am

Had a couple hard freezes last night, and am looking at my event viewer, but it is 90% greek to me.

I see both instances where I had to do a hard-powerdown because of lockup. They look like this:

Code: Select all

Log Name:      System
Source:        Microsoft-Windows-Kernel-Power
Date:          4/5/2014 2:03:37 AM
Event ID:      41
Task Category: (63)
Level:         Critical
Keywords:      (2)
User:          SYSTEM
Computer:      Steve-PC
Description:
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />
    <EventID>41</EventID>
    <Version>2</Version>
    <Level>1</Level>
    <Task>63</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000002</Keywords>
    <TimeCreated SystemTime="2014-04-05T06:03:37.236015300Z" />
    <EventRecordID>142294</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="8" />
    <Channel>System</Channel>
    <Computer>Steve-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="BugcheckCode">0</Data>
    <Data Name="BugcheckParameter1">0x0</Data>
    <Data Name="BugcheckParameter2">0x0</Data>
    <Data Name="BugcheckParameter3">0x0</Data>
    <Data Name="BugcheckParameter4">0x0</Data>
    <Data Name="SleepInProgress">false</Data>
    <Data Name="PowerButtonTimestamp">0</Data>
  </EventData>
</Event>

So.... what?[/color]

Post by **GORDON** » Sat Apr 05, 2014 12:04 pm

Here's an overview of problems, apparently. The lockup events happened on 20140405 at 12:27:41am and 2:00:31am. Not sure what a trained eye would need to see.

Post by **Leisher** » Sat Apr 05, 2014 12:12 pm

Wow, that is a mess.

Go under "Windows Logs" on the left. There will be one for System and one for Application. Look in those and see where the Critical, Errors, and Warnings are occurring.

It'll help identify if we're looking at a hardware or software issue.

Malcolm · Post by **Malcolm** » Sat Apr 05, 2014 12:18 pm

How to make a crash dump file.

You seem to be scenario 3.

EDIT: Got better link for crash dump file.

Edited By Malcolm on 1396715066

Malcolm · Post by **Malcolm** » Sat Apr 05, 2014 12:22 pm

The bit I'd be most interested in is the "SleepInProgress" value. Is it 0 both times?

Malcolm · Post by **Malcolm** » Sat Apr 05, 2014 12:26 pm

Wait. Are those events referring to your HDD hang or your hard boot? Nm. PowerButton value excludes the possibility of the hard boot event. HDD hang it is.

Edited By Malcolm on 1396715225

Post by **GORDON** » Sat Apr 05, 2014 12:32 pm

There were no errors that I saw at the appropriate time in applicatins. I can screenshot that anyway if you want. Here is system stuff:

Edited By GORDON on 1396715552

Post by **GORDON** » Sat Apr 05, 2014 12:34 pm

Malcolm wrote:Wait. Are those events referring to your HDD hang or your hard boot? Nm. PowerButton value excludes the possibility of the hard boot event. HDD hang it is.

Could be, but I had to hard boot by holding the power button 7 seconds. No keyboard control. Even cursor was locked.

Malcolm · Post by **Malcolm** » Sat Apr 05, 2014 12:42 pm

If the events were referring to the hard boot, the PowerButtonTimestamp value would be non-zero because the system's bright enough to record when you do such things.

The PowerButtonTimestamp is listed as zero. Circumstances can prevent writing the PowerButtonTimestamp information before the computer restarts or shuts down. In this case, a value of zero is logged. This can occur if the power button is pressed and held for at least four seconds when Windows has an operation running that prevents writing the event to disk.

Unless you had something pegging your I/O calls so badly that the system couldn't even squeeze a timestamp write in there, then I'd say a zero value here could be due to the HDD not moving.

From what I can glean around ye olde webe, the fact that you've got a zero there and in the BugcheckCode generally indicates the computer being unresponsive to any input.

The Stop error BugcheckCode value is listed as zero. Circumstances can prevent writing the Stop error BugcheckCode information before the computer restarts or shuts down. In this case, a BugcheckCode value of zero is logged. Also, perhaps no Stop error occurred, and the shutdown resulted from a power loss. For example, on a portable computer, this could mean that the battery is removed or completely drained. Or, on a desktop computer, this could mean that the computer was unplugged, or a power outage occurred.

You'd notice your power going out, I hope. This is a desktop and obviously restarted, so your power supply is at least functioning somewhat. The fact remains that WinBlows would go to great efforts to log all kinds of error info if it had the chance. It's hard for the OS to do that work if the HDD doesn't want to play ball.

Malcolm · Post by **Malcolm** » Sat Apr 05, 2014 12:44 pm

Here's the craptacular MS checklist:

This scenario usually indicates a problem with the hardware. To help isolate the problem, check the following items:

Overclocking: Disable overclocking to see whether the issue occurs when the system is run at the correct speed.

Check the memory: Verify the memory by using a memory checker. Verify that each memory chip is the same speed and that it is configured correctly in the system.

Power supply: Make sure that the power supply has enough wattage to appropriately handle the installed devices. If you added memory, installed a newer processor, installed additional drives, or added external devices, such devices can require more energy than the current power supply can provide consistently.

Overheating: Check whether the system is overheating
by examining the internal temperature of the hardware.

Defaults: Reset the system back to the system defaults to see whether the issues occur when the system is running in its default configuration.

If none of these apply to you, then your best option is making a crash dump file, which isn't the most fun thing in the world the first time. It might not even help.

You could also experiment if you've got a spare HDD. Swap in that one as the master, slave out the other, move important info. Fdisk the slave. That might clue you in since the formatter has to cover the entire HDD. If you suspect failure will be frequent, you can set some background jobs that write/read/delete data from it. See how long it takes between failures.

Edited By Malcolm on 1396716506

Post by **GORDON** » Sat Apr 05, 2014 12:46 pm

I see.

I have a beefy UPS here, I didn't hear any beeping.

It would be pretty easy to replace a hard drive, even in RAID 0, so fingers crossed for that being the only problem. I already keep all things I wanna save on the server with backups, so a reload would be sorta painless.

Post by **GORDON** » Sat Apr 05, 2014 12:47 pm

Also, not overclocking, and haven't added new hardware since I built the system. I will open it up and blow out any dust today, in case it is overheating in my 68 degree basement.

Post by **GORDON** » Sat Apr 05, 2014 12:48 pm

But yeah, as far as I can see, there is nothing getting written to the event log prior to the lockup. All I see is "unexpected reboot 3 minutes ago," but nothing to show what was happening within 30 seconds prior to the lockup.

Edited By GORDON on 1396716552

Malcolm · Post by **Malcolm** » Sat Apr 05, 2014 12:50 pm

If it happens again, tap the num/caps/scroll lock key. If the light doesn't toggle, then your HDD is most likely locked.

Post by **GORDON** » Sat Apr 05, 2014 12:54 pm

I almost bragged in that other thread recently about hard drive boot failure rates... that in 15 years of building my own systems, I had never had a HD fail over the 5 year lifespan I expect from a PC. Didn't want to jinx myself.

The second lockup I had at 2am, it sounded like there was a fan whining in my system. You know how it can be hard to ID that kind of white noise, I was checking my UPS and stuff first. Finally narrowed it down to inside the case. Powered down at that point. It was either a fan I have never heard before, or a seriously spinning hard drive making a sound I have also never heard before.

Malcolm · Post by **Malcolm** » Sat Apr 05, 2014 1:02 pm

With the exception of one, of the last half dozen machines that I've seen fail, desktop and laptop alike, it's been the HDD. But since SSDs cost 12x more for the same amount of storage, looks like a completely solid memory base is still a few years off. Wait for those 1TB SSDs to drop in price, though. Soon as they get $100-ish.

Malcolm · Post by **Malcolm** » Sat Apr 05, 2014 1:05 pm

Stupid question: have you scanned your disk for errors or bad sectors?

Post by **GORDON** » Sat Apr 05, 2014 1:06 pm

From what I have read recently I already decided my next HD would be a 250GBish SSD for less than $100, and then a 250GB HDD in RAID 0 for when I need more room. I keep all my music and files and shit on a server... I absolutely do not need more than 500GM of storage on my production/gaming system. Right now I have 600GB of HDD space on this PC, and I am only using 360GB of it, and I haven't reloaded this system in something like 2.5 years.

Post by **GORDON** » Sat Apr 05, 2014 1:07 pm

Malcolm wrote:Stupid question: have you scanned your disk for errors or bad sectors?

Not recently. Didn't have any problems til 2am last night, and i slept for 8 hours between then and now.

Does chkdsk still work in win7? Wait, that was a thing that ran before windows laoded.

Like I said, I haven't had HDD problems for 15 years, and I haven't worked a help desk for that long.

Post by **GORDON** » Sat Apr 05, 2014 1:09 pm

Running chkdsk now in admin mode