StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>Note: this is a good question for a <strong><a href="https://stackoverflow.com/questions/172184">code-challenge</a></strong></p> <p>Here are some executable codes, but feel free to add other solutions, in other languages:</p> <hr> <p>The uptime might be a good indication:</p> <pre><code>net stats workstation | find /i "since" </code></pre> <p>Now link that information with a way to read the windows event logs, like, say in PowerShell:</p> <pre><code>Get-EventLog -list | Where-Object {$_.logdisplayname -eq "System"} </code></pre> <p>And look for the last "Save Dump" messages</p> <p>As <a href="https://stackoverflow.com/users/23897/michael-petrotta">Michael Petrotta</a> <a href="https://stackoverflow.com/a/170815/6309">said</a>, <a href="http://msdn.microsoft.com/en-us/library/aa389290(VS.85).aspx" rel="nofollow noreferrer">WMI</a> is a good way to retrieve that information.</p> <p>Based on the update time, you can make a query like:</p> <pre><code>Set colEvents = objWMIService.ExecQuery _ ("Select * from Win32_NTLogEvent Where LogFile = 'System' AND TimeWritten >= '" _ & dtmStartDate & "' and TimeWritten < '" & dtmEndDate & "'") </code></pre> <p>to easily spot an event log with a "<code>Save Dump</code>" message in it, confirming the crash.</p> <p>More in the <a href="http://msdn2.microsoft.com/En-US/library/aa394226.aspx" rel="nofollow noreferrer"><code>Win32_NTLogEvent</code> Class</a> WMI class.</p> <hr> <p>Actually, this Microsoft article <strong><a href="http://www.microsoft.com/technet/scriptcenter/guide/sas_cpm_klll.mspx?mfr=true" rel="nofollow noreferrer">Querying the Event Log for Stop Events</a></strong> does give it to you (the complete request):</p> <pre><code>strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colLoggedEvents = objWMIService.ExecQuery _ ("SELECT * FROM Win32_NTLogEvent WHERE Logfile = 'System'" _ & " AND SourceName = 'Save Dump'") For Each objEvent in colLoggedEvents Wscript.Echo "Event date: " & objEvent.TimeGenerated Wscript.Echo "Description: " & objEvent.Message Next </code></pre>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload