Is there an event logger that works?

My Win11/64 Home system freezes intermittently. It happens when I'm using different applications - web browsers as well as stand-alone apps. When it freezes the mouse continues to work, but the system does not respond to clicks anywhere. My only option is to hit the reset button.

Things I've tried with no help: Windows Event Log, checking for outdated device drivers, sfc /scannow, dism /cleanup, multiple different virus/rootkit checkers, reset all system tasks to Windows defaults.. So far nothing has returned any indication of anything wrong. So I think what I need is some sort of real time event logger that will actually capture and save everything the system was doing in say the last 5 minutes. Is there such a program out there?

have you tried Reliability History? It might give you an idea as to whats causing your freezes.

Thanks Scott - it's been a long time since I looked at that. Unfortunately it's no help. The most it says is "The previous system shutdown at 12:35:35 PM on ‎8/‎17/‎2022 was unexpected.."

You could try running memtest86 to see if maybe it is bad RAM causing the freezes, you only really need to run 1 pass as any errors indicates an issue.
Other than that have you checked to see if there are any crash dumps being created.
Are you running the machine with any overclocks for CPU and/ or memory (XMP counts as an overclock), if so try setting everything to stock values for testing stability.
HWInfo64 has very detailed monitoring tools and logging features, you can use it to check temps, voltages, CPU, memory and GPU load etc.
Check the file system on the Windows drive with checkdisk, maybe use CrystalDiskInfo to check the SMART status of the drive as well.
I notice you seem to be using the integrated graphics, have you checked for any updates recently, Intel's graphics drivers can be a bit buggy, depending on the versions.
You don't need to try all the above, they are just suggestions that might help with testing for issues and are free to implement.

I agree that drivers are worth looking into.
I suggest you reinstall your display driver even if it is the up-to-date version because there is no method of establishing that its driver has become corrupted.

Best of luck,
Denis

Thanks for those suggestions. I'll start with re-installing Intel's video driver. I do have the most current one, and it is driving dual monitors. I have noticed that from time to time the normally black background of both screens will suddenly turn white, and then flip back to black immediately. So that tells me there is something not quite right about the video driver.

My boot drive is a Samsung NVMe 970 SSD, and chkdsk says it is OK, but I'm not sure how good chkdsk is with SSDs. Samsung Magician says the disk is OK. I"m not overclocked at all (I learned long ago the weird problems that can cause), and I don't think there are any crash dumps, but I'll check. And I'll try memtest to see what it says.

I reinstalled Intel's video driver with the "replace" option which apparently means it completely deleted the current version and then reinstalls it. That completed OK. Then I remembered a utility called Process Monitor that is from the guy at Sysinternals. That seems to log everything in real time, and I figured out how to have it continuously write the last 5 minutes to a disk file. So I've been running that for a while now but (of course) have not had any problems. SO maybe that Intel video driver was corrupted somehow and reinstalling fixed it.

Here's hoping I don't have to update this post with more info.

Birk, to answer your original question, this small little utility from Nirsoft will show every logged step of everything. All events in chronological or other orders.


It does sound like a possible driver and/or memory issue, mainly due to the quirkiness of it. Also keep in mind you could do an in-place repair, that is easy and quick, non-desstructive, and fixes a lot of odd problems.

Tomcat - would you believe that just as I entered the URL to get the event logger you suggested my system froze. So I figured that was a good time to run memtest86 and (of course) it ran showing no errors. SO I'll try the Nirsoft logger and see if it turns anything up.

I have done in-place upgrades before so I guess that will be my last resort. Thanks for the Nirsoft reference.

Woe is me!

System froze while VSCode was compiling Marlin firmware and ProcessMonitor was running. So I rebooted, completed the compile, and opened the ProcessMonitor data file named PMData.PML. Notepad++ showed it was in some sort of coded format, so I opened it with ProcessMonitor. This is what I got:



So that piece of software is useless in this situation.

Yes, I tried the Nirsoft program too, but I could not find a way for it to save it's data to a disk file. But even if it is somehow capable of doing this, the above experience suggest it would be no help either.

To quote the infamous Ralph Cramden: "What a revolting development this is."

There's some confusion evident here. NirSoft FullEventLogView does not log any data at all. It reads & presents Windows' logs.

I use FullEventLogView during fault investigations and it can be useful because its chronological display allows me to see what happened [in all logs] immediately before & after some event I have previously identified using Event viewer.

In your case, I'd start by looking for the Event log service starting & stopping to give me a timeframe for when the freeze happened. I don't know how helpful this will be because freezing is not an event so there will not necessarily be anything usefully diagnostic recorded in the run-up to the freeze happening.
Log name - System
Source - EventLog
EventID - 6005,6006 {for starts & stops respectively}

I really don't know if event logging is going to progress things or not. If you want to try then I can help.
I can give you a set of Event viewer, Custom view definitions that I would check in the hope of finding something useful.
I can also explain how to import those definitions into your Event viewer.
Do you want to proceed with this?

All the best,
Denis

Birk said:

ProcessMonitor data file named PMData.PML. Notepad++ showed it was in some sort of coded format

Click to expand...

Even if its details were in gobbledygook, could you see any timings there? That might be a start.

Denis

Does Device manager show any warning signs or have anything at all in its Other devices section?


Denis

Denis - I've already spent a fair amount of time looking at the Event Log. I've checked the Windows and Application sections, and anything else that looks applicable. There's just no relevant data there. The only errors I found were "The previous system restart was not scheduled", or words to that effect. So that's why I opted for Sysmon - it's billed as the spiffiest way to see what was going on just before a system crash or hang.

Since there is no way to view anything after the system hangs it was clear to me that the only way I could get any useful data was via a disk log. But that now appears to be impossible. In Notepad++ the Sysmon log looked pretty much like an EXE file - nothing was readable.



Try3: No - Device Manager is A-OK.

I'm still getting the occasional flash of black ==>white ==>black background on both of my screens, which I have never seen before, so I'm going to see if I can find the previous version of Intel's graphics driver. I used to run with an nVidia graphics card, but since I don't game at all I figured I'd try running without one, and even though I do a lot of 3D design work the i7 CPU seems to handle everything OK.

And your Bios? Is it up to date?

Denis

Yes, my BIOS is up to date. Motherboard is an old ASUS B360 which was not able to run Win11 because it lacked the security thingy. But ASUS found a way to emulate that with BIOS microcode. So they updated the BIOS and that's how I've been able to run 11.

I used Device Manager to delete the Intel graphics driver, with the thought that adding it back might install a different driver. But that simply re-installed the same (current) one. The option to install the previous driver was disabled. So I proceeded with PlanB:

I located and downloaded the previous version of Intel's graphics driver. It failed to install - I got the "Something went wrong. Contact support" message. That led me to the installation of the Intel Support Assistant (whatever that is.) But that also failed. So for the moment I'm stuck.

Birk said:

I used Device Manager to delete the Intel graphics driver

Click to expand...

I have not deleted any drivers in Windows 11 yet. In Windows 10, the uninstallation procedure offered you the choice of deleting all driver files. If Windows 11 also offers that choice I think you should take it - it will give you the cleanest possible state for installing the new driver.
Added later - This should be done offline to ensure WU doesn't trip you up halfway by getting a driver of its own choice.

I've seen people recommending DDU for uninstalling display drivers. I have not used it myself.
Display Driver Uninstaller [DDU] Download - Guru3D
@Ghot should be able to give you some guidance about using it.
@OldMike65 once said it should always be used in Safe mode so he seems to know about it as well.
@FreeBooter and @glasskuter also seem to know about it.


Best of luck,
Denis

@Birk

Generally, DDU will remove Video or audio drivers (types shown in pic below).

Basic instructions...

1. Download the new driver and save it to your desktop.
2. Reboot into Safe Mode without networking.
3. Also... manually disable your internet.
4. In Safe Mode, run DDU. When it's finished it will restart in Safe mode again.
.....Other than choosing which driver to uninstall, I leave all the other DDU settings at defaults.....
5. Then, use msconfig to restart in normal mode. (no internet, still)
6. Once back in normal mode... install the new driver, reboot if asked.

Now you can re-enable the internet.
The reason we disable the internet is so Windows Update doesn't try to install "their" driver.
Sometimes, this will corrupt the driver you just installed.

Try3: Wow, I never noticed that option to delete drivers, but it worked in a somewhat peculiar way.

After deleting the Intel display adapter and specifying to delete the driver my system came back with only the primary monitor active. What i had displayed on the secondary one was moved to the primary, and I had no option in Settings to add the 2nd monitor back. So I used the Scan for hardware changes option in Device Manager to see if that would pick up my 2nd monitor. It did, and both screens looked fine.

The magical part was Device Manager now shows the previous Intel driver in place. This is the same one who's installation failed when I tried it before. Needless to say I have no idea how this happened, or where the old driver came from. But it looks OK now. So I guess I'll run like this for a while and see if my problem goes away.

Thanks for that tip - it's a good one.