# Use Event Viewer to Find Why Your PC Crashed

URL: https://www.mytechnician.tech/tips/how-to-read-event-viewer-find-crash-cause/
Published: 2026-07-27 | Author: Ankit Kumar
Tags: Windows 11, Troubleshooting, System, BSOD, Maintenance
Summary: Event Viewer records what failed before a crash, freeze, or blue screen. Learn which logs matter, how to filter out the noise, and how to read a minidump for the driver at fault.
Recommended app: PC-Troubleshooter — https://www.mytechnician.tech/apps/windows-troubleshooter/ (Microsoft Store: https://apps.microsoft.com/detail/9N7RWKW8SP24?hl=en-us&cid=mytechnician-web). Optional; every step below uses built-in Windows tools.

## The Problem
When a PC crashes, freezes, or restarts on its own, Windows writes down what happened. The trouble is that Event Viewer shows tens of thousands of entries, most of them meaningless warnings that appear on perfectly healthy machines.

The skill is not reading the logs — it is knowing which four or five event sources actually matter and how to filter to them. With that, a crash usually points at a specific driver, service, or piece of hardware in about five minutes.

> **Already have a stop code on screen?** Search for it directly — start at [how to fix a BSOD](https://www.mytechnician.tech/tips/how-to-fix-bsod-blue-screen/). **PC restarting with no blue screen at all?** See [fix Windows 11 freezing and crashing randomly](https://www.mytechnician.tech/tips/fix-windows-11-freezing-crashing-randomly/).

## Symptoms
Use this guide when:

* The PC restarts on its own with no message.
* A blue screen appears and vanishes too fast to photograph.
* One app crashes repeatedly and its own error tells you nothing.
* You need to know whether a fault is hardware or software before spending money.

## Step 1: Open Event Viewer
1. Press **Windows + R**, type `eventvwr.msc`, press Enter. (Or right-click **Start** → **Event Viewer**.)
2. In the left pane, expand **Windows Logs**. Five logs live here; only two matter for crashes:
   * **System** — drivers, services, hardware, shutdowns and boots. This is where crash evidence lives.
   * **Application** — program crashes and .NET errors.
3. Ignore Security, Setup, and Forwarded Events for this purpose.

## Step 2: Start with Reliability Monitor Instead
Before wading into raw logs, use the friendly view built on top of them.

1. Press **Windows + R**, type `perfmon /rel`, press Enter.
2. You get a timeline with one column per day and red X marks for failures.
3. Click a red mark to see what failed, then **View technical details** for the underlying event.
4. This is the fastest way to answer "when did this start?" — look for the day the crashes begin and what was installed or updated immediately before.

## Step 3: Find the Crash Itself with Event 41 and 1001
Two event IDs tell you a crash happened and what kind.

1. In Event Viewer, click **Windows Logs** → **System**.
2. In the right pane, click **Filter Current Log**.
3. In **Event sources**, tick **Kernel-Power** and **BugCheck**, then click **OK**.
4. Read the results:
   * **Event ID 41, Kernel-Power** — "The system has rebooted without cleanly shutting down first." This means power loss, a hard hang, or a crash where the dump could not be written. Check `BugcheckCode` in the details: **0** means no blue screen was recorded, which points at power, overheating, or hardware.
   * **Event ID 1001, BugCheck** — an actual blue screen, with the stop code and parameters recorded.
5. Note the **timestamp** of the crash. Everything useful happened in the 60 seconds before it.

## Step 4: Read What Happened Just Before the Crash
1. Clear the filter (**Filter Current Log** → **Clear**), then click the **Date and Time** column to sort.
2. Scroll to the crash timestamp and read **upwards** through the minute before it.
3. Look for these sources in particular:
   * **disk** / **Ntfs** / **volmgr** — storage errors. Event ID 7 ("bad block") or 51 means a failing drive: [check SSD and hard drive health](https://www.mytechnician.tech/tips/check-ssd-hard-drive-health-windows-11/).
   * **WHEA-Logger** — hardware reported an error directly: [fix WHEA_UNCORRECTABLE_ERROR](https://www.mytechnician.tech/tips/fix-whea-uncorrectable-error-windows-11/).
   * **Display** — a graphics driver reset: [fix "display driver stopped responding"](https://www.mytechnician.tech/tips/fix-display-driver-stopped-responding-windows-11/).
   * **Service Control Manager** — a service crashed or hung.
   * **Application Error** / **Application Hang** (in the Application log) — the faulting module name is the important field.
4. Ignore isolated warnings such as DistributedCOM 10016 and Kernel-EventTracing errors — they appear on healthy PCs and mislead more people than any other entries in the log.

## Step 5: Filter to Errors Only and Save a Custom View
Rather than repeat the filtering each time, save it.

1. Right-click **Custom Views** → **Create Custom View**.
2. Set **Logged** to **Last 7 days**.
3. Tick **Error** and **Critical**.
4. Set **Event logs** to **Windows Logs** → **System** and **Application**.
5. Click **OK** and name it "Crashes". It now sits at the top of the tree, one click away.

## Step 6: Make Sure Crash Dumps Are Being Written
A minidump names the driver that crashed — far more useful than any event entry.

1. Press **Windows + R**, type `sysdm.cpl`, press Enter.
2. **Advanced** tab → **Startup and Recovery** → **Settings**.
3. Under **Write debugging information**, choose **Small memory dump (256 KB)**.
4. Untick **Automatically restart** so the blue screen stays on screen long enough to read.
5. Confirm the dump path is `%SystemRoot%\Minidump` and click **OK**.
6. Dumps only get written if the page file is on C: and large enough — leave virtual memory on **System managed size**.

## Step 7: Read the Minidump to Name the Faulting Driver
1. Browse to `C:\Windows\Minidump`. Each crash produces one `.dmp` file named by date.
2. The quickest reader is **BlueScreenView** from NirSoft — it lists each crash with the stop code and highlights the driver in red.
3. For a proper analysis, install **WinDbg** from the Microsoft Store, open the dump, and run:
   ```
   !analyze -v
   ```
   Read the `MODULE_NAME` and `IMAGE_NAME` lines.
4. A named third-party `.sys` file is your answer. Common offenders are GPU drivers, network drivers, antivirus filter drivers, and RGB or fan-control utilities.
5. `ntoskrnl.exe` or `hal.dll` being named means the crash was reported by the kernel on behalf of something else — usually RAM, storage, or an unstable overclock, not Windows itself.

## Step 8: Act on What You Found
1. **A named driver** — roll it back in **Device Manager** → device → **Properties** → **Driver** → **Roll Back Driver**, or reinstall from the vendor: [how to update outdated drivers](https://www.mytechnician.tech/tips/how-to-update-outdated-drivers/).
2. **Disk or Ntfs errors** — run `chkdsk C: /f /r` and check SMART data: [fix NTFS_FILE_SYSTEM BSOD](https://www.mytechnician.tech/tips/fix-ntfs-file-system-bsod-windows-11/).
3. **Kernel-Power 41 with BugcheckCode 0** — power, heat, or PSU. See [fix CPU overheating and thermal throttling](https://www.mytechnician.tech/tips/fix-cpu-overheating-thermal-throttling/) and [fix a PC that will not turn on](https://www.mytechnician.tech/tips/fix-pc-wont-turn-on/).
4. **Memory-related codes** — run `mdsched.exe`, then MemTest86: [fix MEMORY_MANAGEMENT BSOD](https://www.mytechnician.tech/tips/fix-memory-management-bsod-windows-11/).
5. **Nothing conclusive** — repair Windows: [how to run SFC and DISM](https://www.mytechnician.tech/tips/how-to-run-sfc-dism-repair-windows-11/), then test in Safe Mode: [how to enter Safe Mode](https://www.mytechnician.tech/tips/how-to-enter-safe-mode-windows-11/).

## What Not to Do
* **Don't chase every red entry.** A working PC logs errors constantly. Only entries within a minute of the crash matter.
* **Don't clear the logs** before you have finished reading them — the history is the evidence.
* **Don't paste event text into a search engine and install whatever a forum recommends.** Match the *source* and *event ID*, not the wording.
* **Don't pay for a "log cleaner".** Nothing in Event Viewer slows a PC down.

## Still Not Working?
If dumps are not being created, check that C: has several GB free and that no cleanup tool is deleting `Minidump`. If crashes leave no events at all, the machine is losing power instantly — suspect the PSU, a thermal shutdown, or a loose connection rather than Windows.

Related: [fix Windows 11 not shutting down or restarting](https://www.mytechnician.tech/tips/fix-windows-11-not-shutting-down-restarting/) and [fix CLOCK_WATCHDOG_TIMEOUT](https://www.mytechnician.tech/tips/fix-clock-watchdog-timeout-windows-11/).

---
Source: https://www.mytechnician.tech/tips/how-to-read-event-viewer-find-crash-cause/ — My Technician, free Windows 10/11 troubleshooting guides.
Related tool: PC-Troubleshooter (PC-Troubleshooter is a system diagnostic and repair tool for Windows 10 and Windows 11—hardware, drivers, network, and common fixes in one app.) — https://www.mytechnician.tech/apps/windows-troubleshooter/
More guides: https://www.mytechnician.tech/llms.txt