Windows Error Reporting
Encyclopedia
Windows Error Reporting (WER) (codenamed Watson) is a crash reporting
technology introduced by Microsoft
with Windows XP
and included in later Windows versions and Windows Mobile
5.0 and 6.0. Not to be confused with the Dr. Watson
debugging tool which left the memory dump on the user's local machine, Windows Error Reporting collects and offers to send post-error debug information (a memory dump
), using the Internet, to the developer of an application that crashes
or stops responding on a user's desktop. No data is sent without the user's consent.
When a dump (or other error signature information) reaches the Microsoft server, it is analyzed and a solution is sent back to the user when one is available. Solutions are served using Windows Error Reporting Responses. Windows Error Reporting runs as a Windows service
and can optionally be entirely disabled. If Windows Error Reporting itself crashes, then an error reports that the original crashed process cannot be sent.
. Most importantly a new set of public APIs have been created for reporting failures other than application crashes and hangs. Developers can create custom reports and customize the reporting user interface. The new APIs are documented in MSDN. The architecture of Windows Error Reporting has been revamped with a focus on reliability and user experience. WER can now report errors even when the process is in a very bad state for example if the process has encountered stack exhaustions, PEB/TEB corruptions, heap corruptions etc. In earlier OSs prior to Vista, the process usually terminated silently without generating an error report in these conditions. A new Control Panel
applet, "Problem Reports and Solutions", was also introduced, keeping a record of system and application errors and issues, as well as presenting probable solutions to problems.
applet was replaced by the Maintenance section of the Windows Action Center on Windows 7 and Server 2008 R2
.
program. In order to ensure that error reporting data only goes to the engineers responsible for the product, Microsoft requires that interested vendors obtain a VeriSign
Class 3 Digital ID. Digital certificates provided by cheaper providers (such as Thawte
, DigiCert
, Comodo, GlobalSign
, GeoTrust
, Cybertrust
, Entrust
, GoDaddy, QuoVadis
, Trustwave, SecureTrust, Wells Fargo
) are not accepted.
Software and hardware manufacturers can also close the loop with their customers by linking error signatures to Windows Error Reporting Responses. This allows distributing solutions as well as collecting extra information from customers (such as reproducing the steps they took before the crash
) and providing them with support links.
noted that error reports enabled the Windows team to fix 29% of all Windows XP
errors with Windows XP SP1. Over half of all Microsoft Office
XP errors were fixed with Office XP SP2. Success is based in part on the 80/20 rule
. Error reporting data reveals that there is a small set of bugs that is responsible for the vast majority of the problems users see. Fixing 20% of code defects can eliminate 80% or more of the problems users encounter. An article in the New York Times confirmed that error reporting data had been instrumental in fixing problems seen in the beta releases of Windows Vista
and Microsoft Office 2007
.
. But in reporting issues to Microsoft, users need to trust Microsoft's partners as well. About 450 partners have been granted access to the error reporting database to see records related to their drivers
, utilities and applications.
Crash reporter
A crash reporter is an application whose function is to report crash data to a third party, usually to the party responsible for the crashed program. Crash reports often include data such as stack traces, type of crash, and version of software...
technology introduced by Microsoft
Microsoft
Microsoft Corporation is an American public multinational corporation headquartered in Redmond, Washington, USA that develops, manufactures, licenses, and supports a wide range of products and services predominantly related to computing through its various product divisions...
with Windows XP
Windows XP
Windows XP is an operating system produced by Microsoft for use on personal computers, including home and business desktops, laptops and media centers. First released to computer manufacturers on August 24, 2001, it is the second most popular version of Windows, based on installed user base...
and included in later Windows versions and Windows Mobile
Windows Mobile
Windows Mobile is a mobile operating system developed by Microsoft that was used in smartphones and Pocket PCs, but by 2011 was rarely supplied on new phones. The last version is "Windows Mobile 6.5.5"; it is superseded by Windows Phone, which does not run Windows Mobile software.Windows Mobile is...
5.0 and 6.0. Not to be confused with the Dr. Watson
Dr. Watson (debugger)
Dr. Watson is an application debugger included with the Microsoft Windows operating system. It may be named drwatson.exe, drwtsn32.exe or dwwin.exe, depending on the version of Windows. It is named after Doctor Watson of Sherlock Holmes fame, the idea being that it would collect error information ...
debugging tool which left the memory dump on the user's local machine, Windows Error Reporting collects and offers to send post-error debug information (a memory dump
Core dump
In computing, a core dump consists of the recorded state of the working memory of a computer program at a specific time, generally when the program has terminated abnormally...
), using the Internet, to the developer of an application that crashes
Crash (computing)
A crash in computing is a condition where a computer or a program, either an application or part of the operating system, ceases to function properly, often exiting after encountering errors. Often the offending program may appear to freeze or hang until a crash reporting service documents...
or stops responding on a user's desktop. No data is sent without the user's consent.
When a dump (or other error signature information) reaches the Microsoft server, it is analyzed and a solution is sent back to the user when one is available. Solutions are served using Windows Error Reporting Responses. Windows Error Reporting runs as a Windows service
Windows Service
On Microsoft Windows operating systems, a Windows service is a long-running executable that performs specific functions and which is designed not to require user intervention. Windows services can be configured to start when the operating system is booted and run in the background as long as...
and can optionally be entirely disabled. If Windows Error Reporting itself crashes, then an error reports that the original crashed process cannot be sent.
Windows Vista
Windows Error Reporting was improved significantly in Windows VistaWindows Vista
Windows Vista is an operating system released in several variations developed by Microsoft for use on personal computers, including home and business desktops, laptops, tablet PCs, and media center PCs...
. Most importantly a new set of public APIs have been created for reporting failures other than application crashes and hangs. Developers can create custom reports and customize the reporting user interface. The new APIs are documented in MSDN. The architecture of Windows Error Reporting has been revamped with a focus on reliability and user experience. WER can now report errors even when the process is in a very bad state for example if the process has encountered stack exhaustions, PEB/TEB corruptions, heap corruptions etc. In earlier OSs prior to Vista, the process usually terminated silently without generating an error report in these conditions. A new Control Panel
Control Panel (Windows)
The Control Panel is a part of the Microsoft Windows graphical user interface which allows users to view and manipulate basic system settings and controls via applets, such as adding hardware, adding and removing software, controlling user accounts, and changing accessibility options...
applet, "Problem Reports and Solutions", was also introduced, keeping a record of system and application errors and issues, as well as presenting probable solutions to problems.
Windows 7
The Problem Reports and Solutions Control PanelControl Panel (Windows)
The Control Panel is a part of the Microsoft Windows graphical user interface which allows users to view and manipulate basic system settings and controls via applets, such as adding hardware, adding and removing software, controlling user accounts, and changing accessibility options...
applet was replaced by the Maintenance section of the Windows Action Center on Windows 7 and Server 2008 R2
Windows Server 2008 R2
Windows Server 2008 R2 is a server operating system produced by Microsoft. It was released to manufacturing on July 22, 2009 and launched on October 22, 2009. According to the Windows Server Team blog, the retail availability was September 14, 2009. It is built on Windows NT 6.1, the same core...
.
Third-party software
Software and hardware manufacturers may access their error reports using Microsoft's WinqualWinqual
Windows Quality Online Services is a Microsoft service provided to qualify user applications and driver components for Microsoft Windows logo programs. Information about products that have been qualified through the appropriate logo program can be listed on the Windows Product Listing sites...
program. In order to ensure that error reporting data only goes to the engineers responsible for the product, Microsoft requires that interested vendors obtain a VeriSign
VeriSign
Verisign, Inc. is an American company based in Dulles, Virginia that operates a diverse array of network infrastructure, including two of the Internet's thirteen root nameservers, the authoritative registry for the .com, .net, and .name generic top-level domains and the .cc and .tv country-code...
Class 3 Digital ID. Digital certificates provided by cheaper providers (such as Thawte
Thawte
Thawte Consulting is a certificate authority for X.509 certificates. Thawte was founded in 1995 by Mark Shuttleworth in South Africa and is the second largest public CA on the Internet.-Origins:...
, DigiCert
DigiCert
DigiCert Inc is a privately held, US based X.509 SSL certificate provider. As a trusted third party, DigiCert verifies the authenticity of secure websites on behalf of a web browser for the purpose of preventing online phishing scams....
, Comodo, GlobalSign
GlobalSign
GlobalSign is a WebTrust certified certificate authority that provides publicly trusted X.509 compliant SSL, including the new EV SSL Extended Validation Certificate, S/MIME and code signing certificates for use on all popular platforms including Mobile...
, GeoTrust
GeoTrust
GeoTrust is a large digital certificate provider.GeoTrust was a restarted company in 2001 that acquired the security business of Equifax. The Equifax business was the basis of its fast growth. The founders of the restarted company were CEO Neal Creighton, CTO Chris Bailey and Principal Engineer...
, Cybertrust
Cybertrust
CyberTrust was a security services company formed in Virginia in November 2004 as a result of a merger of the TruSecure and Betrusted security companies...
, Entrust
Entrust
Entrust Inc. is a $100 million privately-owned software company with 350 employees. It provides identity-based security software and services in the areas of public key infrastructure , multifactor authentication, Secure Socket Layer certificates, fraud detection, digital certificates and mobile...
, GoDaddy, QuoVadis
QuoVadis
QuoVadis is a Certificate Authority, a Trusted Third Party which issues digital certificates for authentication and digital signatures.QuoVadis is a Qualified Certification Services Provider in several countries. This means that QuoVadis is accredited by those countries to issue Qualified...
, Trustwave, SecureTrust, Wells Fargo
Wells Fargo
Wells Fargo & Company is an American multinational diversified financial services company with operations around the world. Wells Fargo is the fourth largest bank in the U.S. by assets and the largest bank by market capitalization. Wells Fargo is the second largest bank in deposits, home...
) are not accepted.
Software and hardware manufacturers can also close the loop with their customers by linking error signatures to Windows Error Reporting Responses. This allows distributing solutions as well as collecting extra information from customers (such as reproducing the steps they took before the crash
Crash (computing)
A crash in computing is a condition where a computer or a program, either an application or part of the operating system, ceases to function properly, often exiting after encountering errors. Often the offending program may appear to freeze or hang until a crash reporting service documents...
) and providing them with support links.
Impact on future software
Microsoft has reported that data collected from Windows Error Reporting has made a huge difference in the way software is developed internally. For instance, in 2002, Steve BallmerSteve Ballmer
Steven Anthony "Steve" Ballmer is an American business magnate. He is the chief executive officer of Microsoft, having held that post since January 2000. , his personal wealth is estimated at US$13.9 billion, ranking number 19 on the Forbes 400.-Early life:Ballmer was born in Detroit, Michigan to...
noted that error reports enabled the Windows team to fix 29% of all Windows XP
Windows XP
Windows XP is an operating system produced by Microsoft for use on personal computers, including home and business desktops, laptops and media centers. First released to computer manufacturers on August 24, 2001, it is the second most popular version of Windows, based on installed user base...
errors with Windows XP SP1. Over half of all Microsoft Office
Microsoft Office
Microsoft Office is a non-free commercial office suite of inter-related desktop applications, servers and services for the Microsoft Windows and Mac OS X operating systems, introduced by Microsoft in August 1, 1989. Initially a marketing term for a bundled set of applications, the first version of...
XP errors were fixed with Office XP SP2. Success is based in part on the 80/20 rule
Pareto principle
The Pareto principle states that, for many events, roughly 80% of the effects come from 20% of the causes.Business-management consultant Joseph M...
. Error reporting data reveals that there is a small set of bugs that is responsible for the vast majority of the problems users see. Fixing 20% of code defects can eliminate 80% or more of the problems users encounter. An article in the New York Times confirmed that error reporting data had been instrumental in fixing problems seen in the beta releases of Windows Vista
Windows Vista
Windows Vista is an operating system released in several variations developed by Microsoft for use on personal computers, including home and business desktops, laptops, tablet PCs, and media center PCs...
and Microsoft Office 2007
Microsoft Office 2007
Microsoft Office 2007 is a Windows version of the Microsoft Office System, Microsoft's productivity suite. Formerly known as Office 12 in the initial stages of its beta cycle, it was released to volume license customers on November 30, 2006 and made available to retail customers on January 30, 2007...
.
Privacy concerns
Although Microsoft has made privacy assurances, they acknowledge that personally identifiable information could be contained in the memory and application data compiled in the 100-200K "minidumps" that Windows Error Reporting compiles and sends back to Microsoft. They insist that in case personal data is sent to Microsoft, it won't be used to identify users, according to Microsoft's privacy policyPrivacy policy
Privacy policy is a statement or a legal document that discloses some or all of the ways a party gathers, uses, discloses and manages a customer or client's data...
. But in reporting issues to Microsoft, users need to trust Microsoft's partners as well. About 450 partners have been granted access to the error reporting database to see records related to their drivers
Device driver
In computing, a device driver or software driver is a computer program allowing higher-level computer programs to interact with a hardware device....
, utilities and applications.