23 entries

Windows System

Crashes, restarts, services, and disk errors — what Event Viewer shows when something goes wrong.

7 Event 7: The device has a bad block Act now A drive reported a sector it could not read or write reliably. On a mechanical disk this is often the first warning of a failure; on a solid-state drive it is more unusual and more urgent. Back up before doing anything else.
41 Event 41: The system rebooted without shutting down cleanly Worth a look Windows noticed on startup that the previous shutdown never happened properly — the machine lost power, froze, or crashed. The event records the aftermath, not the cause, which is why it so rarely explains anything by itself.
51 Event 51: A paging error on a disk Investigate Windows hit an error while reading or writing the page file area of a drive. It usually means the same thing as a bad block — the storage is not responding reliably — and it is one of the earlier warnings a drive gives before it fails outright.
55 Event 55: NTFS found corruption on a volume Investigate The file system on a drive is damaged. Windows usually schedules a repair automatically, but the corruption itself has a cause — most often failing storage or an unclean shutdown — and repairing without finding that cause means it will come back.
104 Event 104: An event log was cleared Investigate Someone cleared a log other than Security — the System log, the Application log, or an operational channel. It is the counterpart to Event 1102 and carries the same meaning: whatever was in that log is gone, and someone chose to remove it.
129 Event 129: A storage controller reset the drive Investigate A drive stopped responding for long enough that the storage driver reset it. The machine usually freezes briefly when this happens. It points at the drive, the cable, or the controller — and on solid-state drives, often at outdated firmware.
219 Event 219: A driver failed to load for a device Worth a look Windows tried to load a driver for a piece of hardware and could not. Often harmless — a leftover entry for a device that is no longer plugged in — but it is also what a genuinely broken device looks like, and occasionally what blocked malware looks like.
1001 Event 1001 BugCheck: Windows recorded a blue screen Investigate The machine blue-screened and Windows wrote down the stop code afterwards. The bugcheck code in this event is the single most useful piece of information about a crash, because it names the class of fault — and it points at a dump file that names the culprit.
1014 Event 1014: A DNS lookup timed out Worth a look Windows asked for the address behind a name and none of the DNS servers answered in time. Usually a brief network wobble. When it repeats, the DNS settings or the connection itself are the problem — not the website you were trying to reach.
1074 Event 1074: Something asked Windows to shut down or restart Informational A deliberate shutdown or restart was requested, and Windows recorded which program asked, which account it ran as, and the reason given. It is the event that answers the question 'who rebooted this machine'.
4101 Event 4101: Display driver stopped responding and recovered Worth a look Your graphics card stopped answering for a couple of seconds, so Windows reset it. That is the black flicker you just saw. One is nothing. Several a day means the driver, the card, or its power supply needs attention.
6005 Event 6005: The event log service started Informational Windows started logging, which happens very early in boot. In practice this is the marker for 'the machine came up', and it is the standard way to work out when a computer was last started and how long it has been running.
6006 Event 6006: The event log service stopped Informational Windows stopped logging as part of shutting down, which means the shutdown was orderly. Its real value is negative: when this event is missing before a boot, the machine did not shut down cleanly.
6008 Event 6008: The previous system shutdown was unexpected Worth a look Windows is reporting that the last time the machine went down, it was not asked to. The useful part is the timestamp, which tells you exactly when the machine stopped — and that is what you compare the rest of the logs against.
6013 Event 6013: The system uptime, logged daily Informational Windows records how long the machine has been running, once a day. Nothing is wrong — it is a heartbeat. Its practical use is working out how long a machine has been up without touching it, and spotting reboots you did not know about.
7000 Event 7000: A service failed to start Worth a look Windows tried to start a service and it would not start. The error text at the end of the message is the actual answer — the event number tells you nothing that the error does not tell you better.
7009 Event 7009: A service timed out while starting Worth a look A service took longer than Windows was prepared to wait — 30 seconds by default — and the start was abandoned. On slow or heavily loaded machines this is usually a symptom of the boot itself being slow rather than of anything being wrong with the service.
7011 Event 7011: A service stopped responding to Windows Worth a look Windows asked a service to do something and got no reply within the timeout. On a machine that is slow to start or shut down, this is usually the reason — and it is far more often a symptom of overloaded storage than of a broken service.
7023 Event 7023: A service stopped with an error Worth a look A service shut down and reported a reason. Unlike a plain crash, this one tells you what went wrong in its own words — and that error text is more useful than the event number.
7031 Event 7031: A service terminated unexpectedly Worth a look A Windows service crashed rather than stopping cleanly, and Windows is recording what it plans to do about it. The service name is the whole event — everything useful comes from working out why that particular service died.
7034 Event 7034: A service terminated unexpectedly and stayed stopped Worth a look A service crashed and Windows did nothing about it, because no recovery action was configured. That makes it more consequential than the near-identical Event 7031 — whatever the service was doing has simply stopped.
7045 Event 7045: A new service was installed Investigate A service was registered with Windows. It is available by default with no audit policy to configure, which makes it one of the most practical persistence signals you can collect — and remote execution tools give themselves away here constantly.
10016 Event 10016: DCOM permission error you can almost always ignore Informational A program asked to start a Windows component and was refused by the permission settings. Microsoft has stated these entries can be safely ignored in the overwhelming majority of cases, and the registry edits people apply to silence them cause more problems than the error does.