Error Reporting
The Error Reporting component is used to report kernel faults, program errors or crashes, system hang-ups, and unplanned system shutdowns. The data is collected by Microsoft to track and resolve these issues, and to provide solutions for these issues to customers.
Services
This component provides the Error Reporting Service, which runs as a part of Svchost.exe. Svchost.exe is a generic host process that supports Windows services.
Associated Components
This component relies on the Primitive: Dbghelp component for gathering application error information in the form of mini-dump files that are attached to a report.
Settings
The configurable settings for this component are described in the following table.
| Setting | Default setting | Description |
|---|---|---|
| Enable error reporting | On | Enables error reporting. |
| Enable notification when errors occur | On | Enables notification to take place after an error occurs. |
| Force error reports to queue to disk | Off | Enables forced queuing of program crash error reports to disk for later reporting. |
| Do not collect additional machine data | Off | Disables the collection of second-level data, specifically, any data in addition to the error signature and crash dump. |
| Replace instances of the word 'Microsoft' in the error reporting dialog box | <Report Destination name> | Replaces the word "Microsoft" in the error reporting notification dialog boxes with the specified entry. |
| Corporate upload file path | \\Report Server | Enables corporate error reporting to a file share instead of using HTTP to send reports to Microsoft. This setting requires a Universal Naming Convention (UNC) path to the file share. If no value is specified for this setting, HTTP reporting to Microsoft is used. |
Notes
Corporate error reporting (CER) is designed for organizations that want to review error reports before they are sent to Microsoft. Organizations can then use the corporate reporting tool to send the approved reports to Microsoft.
Force-queue mode is a special mode that causes the error reporting mechanism to create an error report and store it on disk for later reporting. Only the 10 most recent error reports are kept. Reporting is then offered the next time an administrator logs on to the computer after the last error occurs.
This setting affects reporting for all program crash errors. The setting is most useful for server devices that have infrequent logons and services that are self-restarting in the event of a crash.
CER can only be configured by using the Group Policy feature. To configure Windows Error Reporting (WER) to report to CER, an operating system must include certain default WER settings, registry keys, and values:
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting] "DoReport"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\DW] "DWFileTreeRoot"="\\\\Server\Share"
The "DWFileTreeRoot" value can be set to any UNC path. For example, set this value to \\Server\Share if you want error reports to be sent, or set it to C:\MyErrorReports if you want the reports to remain on the local system. Any organization using the CER reporting feature in Windows must use the CER 2.0 tool to send error reports to Microsoft. For more information about this tool and instructions about how to configure a CER share, see this Microsoft website.
Last updated on Wednesday, October 18, 2006
© 2006 Microsoft Corporation. All rights reserved.