How to get Event Log Crash Browser

Navigation: »No topics above this level«

How to get Event Log Crash Browser

 Return to chapter overview

Event Log Crash Browser is free for commercial use. Event Log Crash Browser can be downloaded for Software Verify's website at https://www.softwareverify.com/product/event-log-crash-browser/.

This help manual is available in Compiled HTML Help (Windows Help files), PDF, and online.

Windows Help | https://www.softwareverify.com/documentation/chm/eventLogCrashBrowser.chm
PDF | https://www.softwareverify.com/documentation/pdfs/eventLogCrashBrowser.pdf
Online | https://www.softwareverify.com/documentation/html/eventLogCrashBrowser/index.html

Whilst Event Log Crash Browser is free for commercial use, Event Log Crash Browser is copyrighted software and is not in the public domain.

You are free to use the software at your own risk.

You are not allowed to distribute the software in any form, or to sell the software, or to host the software on a website.

Contact Software Verify at:

Software Verify Limited

Suffolk Business Park

Eldo House

Kempson Way

Bury Saint Edmunds

IP32 7AR

United Kingdom

email | sales@softwareverify.com
web | https://www.softwareverify.com
blog | https://www.softwareverify.com/blog
twitter | http://twitter.com/softwareverify

Visit our blog to read our articles on debugging techniques and tools.

Follow us on twitter to keep track of the latest software tools and updates.


What does Event Log Crash Browser do?

What does Event Log Crash Browser do?

 Return to chapter overview

Event Log Crash Browser allows you to easily identify crash information in the Windows Event Log.

Once the crash information has been identified you can launch various tools to convert the crash address into symbols, filenames and line numbers that you can use for debugging.


Menu

Menu

The main menu contains four menus, File, Settings, Software Updates and Help.


File

Navigation: Menu >

File

 Return to chapter overview

The File menu controls the scanning and display of event log crash information.

File menu instructionStep Scan Event Log instructionStep scans the event log for crashes. Any crashes found are shown on the user interface.

File menu instructionStep Stop scanning instructionStep stops scanning the event log for crashes.

File menu instructionStep Clear scan results instructionStep the user interface contents are reset to show no crashes.

File menu instructionStep Load crash log... instructionStep crash data is loaded from a log file.

File menu instructionStep Save crash log... instructionStep crash data is saved to a log file.

File menu instructionStep Exit instructionStep closes Event Log Crash Browser.


Settings

Navigation: Menu >

Settings

 Return to chapter overview

The settings menu provides access to the settings.

Settings menu instructionStep Edit Settings... instructionStep displays the settings dialog.


Software Updates

Navigation: Menu >

Software Updates

 Return to chapter overview

The Software Updates menu controls how often software updates are downloaded.

If you've been notified of a new software release to Event Log Crash Browser or just want to see if there's a new version, this feature makes it easy to update.

menu Software Updates menu instructionStep Check for software updates instructionStep checks for updates and shows the software update dialog if any exist

An internet connection is needed to be able to make contact with our servers.

note Before updating the software, close the help manual, and end any active session by closing target programs.

If no updates are available, you'll just see this message:

Software Update dialog

If a software update is available for Event Log Crash Browser you'll see the software update dialog.

·Download and install instructionStep downloads the update, showing progress

Once the update has downloaded, Event Log Crash Browser will close, run the installer, and restart.

You can stop the download at any time, if necessary.

·Don't download... instructionStep Doesn't download, but you'll be prompted for it again next time you start Event Log Crash Browser

·Skip this version... instructionStep Doesn't download the update and doesn't bother you again until there's an even newer update

·Software update options... instructionStep edit the software update schedule

Problems downloading or installing?

If for whatever reason, automatic download and installation fails to complete:

·Download the latest installer manually from the software verify website.

Make some checks for possible scenarios where files may be locked by Event Log Crash Browser as follows:

·Ensure Event Log Crash Browser and its help manual is also closed

·Ensure any error dialogs from the previous installation are closed

You should now be ready to run the new version.

Software update schedule

Event Log Crash Browser can automatically check to see if a new version of Event Log Crash Browser is available for downloading.

menu Software Updates menu instructionStep Configure software updates instructionStep shows the software update schedule dialog

The update options are:

·never check for updates

·check daily (the default)

·check weekly

·check monthly

The most recent check for updates is shown at the bottom.

Software update directory

It’s important to be able to specify where software updates are downloaded to because of potential security risks that may arise from allowing the TMP directory to be executable. For example, to counteract security threats it's possible that account ownership permissions or antivirus software blocks program execution directly from the TMP directory.

The TMP directory is the default location but if for whatever reason you're not comfortable with that, you can specify your preferred download directory. This allows you to set permissions for TMP to deny execute privileges if you wish.

menu Software Updates menu instructionStep Set software update directory instructionStep shows the Software update download directory dialog

An invalid directory will show the path in red and will not be accepted until a valid folder is entered.

Example reasons for invalid directories include:

·the directory doesn't exist

·the directory doesn't have write privilege (update can't be downloaded)

·the directory doesn't have execute privilege (downloaded update can't be run)

note When modifying the download directory, you should ensure the directory will continue to be valid. Updates may no longer occur if the download location is later invalidated.

·Reset instructionStep reverts the download location to the user's TMP directory

The default location is c:\users\[username]\AppData\Local\Temp


Help

Navigation: Menu >

Help

 Return to chapter overview

The Help menu controls displaying this help document and displaying information about Event Log Crash Browser.

Help menu instructionStep About Event Log Crash Browser... instructionStep displays information about Event Log Crash Browser.

Help menu instructionStep Readme and Version History... instructionStep displays the readme and version history.

Help menu instructionStep Help Topics... instructionStep displays this help file.

Help menu instructionStep Help PDF... instructionStep displays this help file in PDF format.

Help menu instructionStep Help on softwareverify.com... instructionStep display the Software Verify documentation web page where you can view online documentation or download compiled HTML Help and PDF help documents.

Help menu instructionStep Blog... instructionStep display the Software Verify blog.

Help menu instructionStep Library... instructionStep display the Software Verify library - our best blog articles grouped by related topics.

Help menu instructionStep Contact customer support... instructionStep displays the options for contacting customer support.

Click a link to contact customer support.

Help menu instructionStep How do I?... instructionStep displays the options for asking us how to do a particular task.


The user interface

The user interface

The Event Log Crash Browser user interface is shown below.

Event Log Crashes

The display shows one event log crash per line. The most recent event is shown first.

Each line displays the process id, the crash executable, the crash exception code, a text version of the exception code, the crash offset and the crash DLL (the DLL that the crash occurred inside of) and the name of the company that build the DLL. The DLL field will be empty if the crash does not occur inside a DLL. The processor architecture is displayed if the DLL can be read (it may not be on disk any more). The company name will only be displayed if there is a DLL name specified with a full path (some DLL names are specified without a path).

The display can be sorted by each column. Click the column header to choose which column to sort. Click the same column header again to reverse the sorting direction.

The display is colour coded according to the type of exception. This colour coding can be enabled or disable from the settings.

EXE and DLL paths are shown with full paths by default, but path information can be hidden if you wish - use the show full path checkbox.

Event Log Kernel Dumps

If the display of BugCheck events is enabled, there may be entries in the display corresponding to kernel dumps.

The displayed data for these events is different, listing the process id, computer name, user, time, bugcheck code, bugcheck name, and the name of the kernel dump file.

Filters

Three filters are provided: Exception, EXE and DLL.

Exception

Any Exception allows any event to be displayed, whereas other selections will only display an event that has that exception type.

EXE

Any EXE allows any event to be displayed, whereas other selections will only display an event that has that executable.

DLL

Any DLL allows any event to be displayed, whereas other selections will only display an event that has that crash DLL.

The filters combine with each other, so that you can go from displaying all events to displaying only a specific exception that happens in a specific DLL when used as part of a specific EXE.

Context Menu

There is a context menu which you can access by right clicking on any crash event. This provides options for various Software Verify debugging tools that can turn the crash offset into a symbol, filename and line number.

·Lookup crash location

·DbgHelp Browser...

DbgHelp Browser is launched to open the PDB symbols associated with the crash DLL. The symbol at the crash offset is then highlighted.

·DWARF Browser...

DWARF Browser is launched to open the DWARF symbols in the crash DLL. The symbol at the crash offset is then highlighted.

·TDS Browser...

TDS Browser is launched to open the TDS symbols associated with the crash DLL. The symbol at the crash offset is then highlighted.

·MAP File Browser...

Map File Browser is launched to open the MAP file associated with the crash DLL. The symbol at the crash offset is then highlighted.

If a tool is chosen that is not installed a prompt will be displayed to download the tool.

·Minidump Browser...

Minidump Browser is launched to view the Kernel dump.

If a tool is chosen that is not installed a prompt will be displayed to download the tool.

The first four options relate to application crashes, the last option relates to kernel dumps. Different options will be enabled depending upon which event was clicked upon.

·Properties...

Windows explorer is used to open a properties dialog for the crash DLL.

·Open folder location...

Windows explorer is used to open a folder view at the location of the crash DLL.

·Copy to clipboard

Crash information is copied to the clipboard in an XML format that can be used with DbgHelp Browser, TDS Browser and Map File Browser.

The format is similar to the event log XML format for Windows Error Reporting "APPCRASH", but with some of the fields left blank because we don't use them.

For example:

<Event>
<System>
<Provider Name="Windows Error Reporting">
</System>
<EventData>
<Data></Data>
<Data></Data>
<Data>APPCRASH</Data>
<Data></Data>
<Data></Data>
<Data>E:\om\c\testApps\testDeliberateCrash\x64\Debug\testDeliberateCrash.exe</Data>
<Data></Data>
<Data></Data>
<Data>E:\om\c\testApps\testDeliberateCrash\x64\Debug\testDeliberateCrash.exe</Data>
<Data></Data>
<Data></Data>
<Data>0xc0000005</Data>
<Data>0x00001e6c</Data>
<Data></Data>
<Data></Data>
<Data>STATUS_ACCESS_VIOLATION</Data>
<Data>OK</Data>
<Data>TODO: <Company name></Data>
</EventData>
</Event>


SettingsDialog

SettingsDialog

The Settings dialog allows you to change what event types are searched for and how those events are displayed.

Reset

If you make a mess of the settings and wish to go back to the defaults, you can always Reset the settings.


Events

Navigation: SettingsDialog >

Events

 Return to chapter overview

The Events settings allows you to change what event types are searched for.

Event types

Five types of events can be searched for in the event log.

·Application Error

·Windows Error Reporting

·Application Popup

·.Net Profiler Errors

·Kernel Dump BugCheck. This event is generated in the unlikely event that your computer fails and creates a kernel dump, also known as the Blue Screen of Death.

Reset

If you make a mess of the settings and wish to go back to the defaults, you can always Reset the settings.


Behaviour

Navigation: SettingsDialog >

Behaviour

 Return to chapter overview

The Behaviour settings allows you to change how events are displayed.

Behaviour

Colour

Colour is used to highlight different event types. By default this is enabled. If you don't want this you can turn it off.

Auto Clear

Typically we clear the display when a new event log scan is started, but if you're performing multiple searches with different event criteria you may wish to keep the results from previous scans by not enabled auto clearing of the display.

Automatic Scan

Scans are normally manually initiated, but if you always want to scan automatically you can do that. This is useful if you're using Event Log Crash Browser to quickly see what the most recent crash value is.

Filter Persistence

If you're interested in a particular crash that is repeating you may wish to set up a specific filter configuration to go with the automatic scan.

Reset

If you make a mess of the settings and wish to go back to the defaults, you can always Reset the settings.


Command Line

Command Line

The command line support in Event Log Crash Browser is very simple.

/export

The /export command takes one argument, a filename.

/export e:\crash.elcbl

Example command line

eventLogCrashBrowser.exe /export e:\crash.elcbl

The above command line will cause the list of events normally displayed on the user interface to be written to the file e:\crash.elcbl

This file could then be inspected at a later date, on the same computer or a different computer.


Crash Logs

Crash Logs

Event log crash information can be saved to a log file which can then be inspected at a later date on the same computer or a different computer. The Save crash log and Load crash log menu items provide support for this.

A scenario we imagine is using Event Log Crash Browser on a customer machine to save all the events to a crash log which is sent to customer support where the crash log is inspected for information related to the application under development.

There is also command line support for this style of usage.