- How to Find Blue Screen Error Logs on Windows 10
- What if Your System Is Always Restarting?
- Creating a Bootable Windows 10 USB Using Rufus
- Using the Windows Media Creation Tool
- Other Ways to Check the Causes of Blue Screen Errors
- Using the Reliability Monitor
- Reading a Dump File
- Here’s a step-by-step guide on how to use the Windows Driver Kit:
- How to view BSOD error log in Event Viewer on Windows 11?
Blue Screen of Death (BSOD) issues are scary Windows errors that can make even professional PC technicians panic. They primarily point to hardware glitches that the operating system can’t resolve by itself. However, software problems, such as a device driver or system file corruption, could also be responsible.
When these glitches happen, Windows has no option but to crash and restart. The blue screen shows up to give a hint of the issue before the system reboots.
BSODs are fairly common in Windows 10 PCs. While some happen due to minor issues, others signal serious underlying problems.
Troubleshooting these kinds of errors can be complicated, especially when you don’t know the cause. With the little information on the blue screen, you can get a fair good amount of help on the Internet. However, you can get more information from the Event Viewer.
The Event Viewer logs events that lead to errors. Even if your PC doesn’t have a single issue that you notice, the program records warning signs of problems that might occur in the future. You don’t necessarily have to always go back to comb through the logs in search of these signs. However, the application becomes important when your system experiences a fatal error such as a blue screen.
In this article, we’ll be showing you how to use the Event Viewer to find out the reason behind a BSOD.
How to Find Blue Screen Error Logs on Windows 10
Follow these steps:
- Click on the magnifying glass in the taskbar to open the search box. You can also press Windows + S to summon the search function.
- Type “Event Viewer” (no quotes) once the search box opens and click on the first search result.
Note: You can also press Win + X or right-click the Start button and select Event Viewer from the Power User menu.
- Once the Event Viewer opens, go to the left pane and expand Windows Logs.
- Under Windows Logs, click on System.
- Go to the right-hand side of the window and click on Create Custom View under System.
- Once the Create Custom View window appears, stay in the Filter tab.
- Go to the Logged drop-down menu and select Custom Range.
- Next, choose the date and time range the BSOD occurred once the Custom Range dialog shows up.
- Click OK in the Custom Range dialog box.
- Go to Event Level in the Create Custom View dialog window and check the boxes for Critical, Warning, and Error.
- Click on OK, enter a name for the Custom View you just created, and then click on OK again.
- In the main Event Viewer window, you’ll now see the list of Warning, Critical, and Error events that occurred in the time range you selected.
- Double-click an event log and refer to the Details tab to check the details of that event.
- Google the Event ID if you don’t understand the description and you’ll find help regarding what needs to be done.
What if Your System Is Always Restarting?
Some blue screen errors will throw your PC into an infinite loop of reboots. Your best course of action in this scenario is to check the Event Viewer in Safe Mode.
You have two ways to get into Safe Mode:
- Going through the Automatic Repair Environment
- Using Bootable Media
Going Through the Automatic Repair Environment
This method involves tricking your computer into believing that something has gone wrong with the boot process to trigger the automatic repair feature. BSODs typically don’t affect the early boot process. So, Windows will likely not realize that anything is wrong until it’s time to load your startup applications.
Follow these steps to enter the Windows recovery environment:
- Press and hold your power button to force your PC to shut down.
- Turn on the computer and force it to shut down again after your system’s manufacturer logo shows up.
- Repeat Step 2 twice and you’ll see the “Please wait” message. If you don’t see the message, repeat the steps. If nothing happens, skip to the next guide to use bootable media.
- When you see the Automatic Repair screen, click on the Advanced Options button.
- On the Choose an Option screen, click on Troubleshoot.
- Now, click on Advanced Options under Troubleshoot, and then click on Startup Settings once the Advanced Options screen opens.
- Click the Restart button on the Startup Settings screen, and when your system reboots to the Startup Options page, hit the number beside Safe Mode or Safe Mode with Networking (if you want to use the Internet).
- Once your PC boots into Safe Mode, open the Event Viewer to check for the cause of the BSOD.
Using Bootable Media
Even the automatic repair feature can be broken. In such a case, you’ll have to use bootable media.
Bootable media allow you to load the Windows installation and repair environment even if your system isn’t booting. It could be a USB flash drive or DVD. If you don’t have a Windows 10 DVD, you can use another computer to create bootable media. You can either use a third-party tool, known as Rufus, or Microsoft’s Media Creation tool. We’ll be showing you how to use both programs.
Creating a Bootable Windows 10 USB Using Rufus
Rufus is a free-to-use third party program for creating bootable media. All you need is your USB flash drive and the latest ISO image file of Windows 10, which you can download from Microsoft’s website.
Before you use any program, make sure you have downloaded your ISO file from Microsoft’s site.
Follow these steps:
- Download Rufus from the Internet.
- Right-click on the Rufus.exe file and run it as an administrator.
- The application will automatically detect the drive that is connected to your computer.
- Make sure the name of your USB flash drive is displayed under the Device drop-down.
- Choose Disk or ISO image from the Boot selection drop-down and then click on the Select button.
- Navigate to the directory where your ISO file is located, click on the file and then click on the Open button.
- Next, choose MBR from the Partition scheme drop-down, then select BIOS or UEFI under Target system.
- Now, under Advanced Drive Properties, check the box associated with “Add fixes for old BIOSes”.
- Go to the Advanced Format Options in the Format Options segment and tick the Quick Format and “Create extended label and icon files” checkboxes.
- Click on the Start button and follow the progress bar under Status.
- The progress bar will show a Ready message once the process is complete.
Using the Windows Media Creation Tool
Follow these steps to create the bootable media, using the Media Creation tool:
- Head to Microsoft’s website and download the Media Creation Tool.
- Run it on your computer.
- Select the “Create installation media for another PC” radio button when the Windows 10 Setup window opens, and then click Next.
- On the next page, choose your language, Windows 10 edition (Home, Pro, or Enterprise), and operating system architecture (64 Bit or 32 Bit).
- Select the USB flash drive option under “Choose which media to use”, and then click Next.
- Allow the tool to complete the process.
After creating the bootable USB, insert it into your system and reboot. Make sure you change your boot order accordingly. Once your computer comes up, press any key if you’re prompted. When the Windows setup screen appears, click on Repair Your Computer in the lower-left corner.
The “Choose an option” screen should now open. Click on Troubleshoot. Once the Troubleshoot screen appears, click on the Advanced Options tile. Now, click on Startup settings once the Advanced Options screen opens. Click on Restart. After your computer boots into the Startup Options screen, tap the number beside Safe Mode and wait for your PC to reboot into Safe Mode.
You can now use the Event Viewer in Safe Mode to check for the cause of the BSOD.
Other Ways to Check the Causes of Blue Screen Errors
The Event Viewer isn’t the only program that logs the reasons why your system crashes. You can also use the Reliability Monitor and read a dump file.
Using the Reliability Monitor
The Windows Reliability Monitor is an application that tracks software issues and keeps a detailed log of events, especially when a crash occurs. The interface is user-friendly and works quite well on Windows 10. Note that your computer has to boot up normally if you’re going to use the program. If it doesn’t, you can try opening it up in Safe Mode.
There are different ways to open the Windows Reliability Monitor. You can go through the Control Panel, use the Run dialog box, or use Settings.
To open the program via the Control Panel, launch Control Panel, then click on System and Security. Click on “Review your computer’s status and resolve issues” under Security and Maintenance. On the next page, expand the Maintenance section and click on View Reliability History.
To use the Run dialog box, open the program (press Windows + R), type “perfmon /rel” (don’t add the quotes), and then hit Enter.
The easiest way is to search for the application in the Start menu. Click on the magnifying glass in the taskbar or press the Windows and S keys together, then type “reliability history” (no quotes). Click on View Reliability History in the search results.
The Reliability Monitor arranges its findings by days. You can change the log to preview events by weeks, but we recommend that you go for days. The dates on the right column are the most recent. A red circled X mark indicates a system failure that led to a crash. Click on the day’s column where the red mark is on, then check the Reliability Details section to get an overview of what happened. Double-click an event to find out more about it.
Normally, there’ll be a link at the bottom of the main Reliability Monitor window described as “Check for solutions to all problems.” While you can try it out, don’t get your hopes up as the feature doesn’t always help.
Reading a Dump File
Windows traditionally creates a dump file in the system memory that displays applications that were running before the crash occurred. The information you find here could help you troubleshoot the blue screen, especially if a program is triggering it.
There are two main ways to analyze the dump file: Using the Windows Driver kit and using a third-party, free-to-use program. We’ll be covering both methods.
Using the Windows Drivers Kit to Analyze the Dump File
The Windows Driver Kit, or WDK for short, is a toolset used to develop, debug, test, and deploy Windows drivers. One of its debugging functions is reading dump files where driver errors can be discovered. The kit was primarily designed for developers who create drivers for system devices. However, you can use it to check for causes of Blue Screen errors.
Here’s a step-by-step guide on how to use the Windows Driver Kit:
Installing the Windows Driver Kit:
- Go to Microsoft’s website and download the Windows Driver Kit for your operating system. It’ll be a large ISO file that you have to extract.
- Once you’ve downloaded the kit, open the ISO file using File Explorer. You can choose to burn it to a DVD if you wish.
- Navigate to the Debuggers folder to install the debugging tool first. Make sure you download the right one for your system. Go for setup_amd64.exe if you use a 64-bit operating system and setup_x86.exe if your OS is 32-bit.
- Next, run the wdksetup.exe file.
- After the installation is complete, head to the Start menu and search for Command Prompt. Once the program shows up on the results, right-click it and select “Run as Administrator”. Click on Yes in the User Account Control pop-up.
- When the Command Prompt opens, type “C:\Program Files (x86)\Windows Kits\10\Debuggers\x86” (don’t add the quotes) and hit the Enter key to switch to the WDK folder.
- After that, type “windbg.exe -IA” (no quotes) and hit Enter, Then, click on OK in the prompt that shows up. Windows debugger will now open DMP (dump) files automatically.
Setting the symbol path in Windows Debugger:
- Go to the Start menu and search for windbg. Click on WinDbg in the search results to open Windows Debugger.
- Once the Windows Debugger window shows up, go to the upper-left corner and click on “Symbol File Path…”.
- Type “SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols” (no quotes) into the Symbol Path box and click on OK.
Reading the dump file:
- Right-click on the Start button and select Run or tap the Windows and R keyboard buttons together.
- Type “%systemroot%” (no quotes) into the text box of the Run dialog box and hit the Enter keyboard button.
- Once the folder opens, go to the View tab at the top of the window and check the “Hidden items” checkbox.
- You can also open the dump file by going to C:\Windows\Minidump. Another way to open it is to click on File in WinDbg and click on Open Dump Files.
- Once Windows Debugger opens the file, you should see a list of programs that were running before the blue screen struck.
Using the BlueScreenView Utility
This is a third-party program that is free to use. Its sole purpose is finding the causes of blue screen errors by displaying content of dump files. It will show you a list of programs that were running before the Blue Screen error occurred.
The steps below will show you how to use it:
- Go to the taskbar and click on the magnifying glass to open the search function.
- Type “view advanced system settings” (without the quotes) into the search box.
- Click on the first result.
- Once the System Properties dialog window opens in the Advanced tab, go to the Startup and Recovery section. Click on Settings.
- After the Startup and Recovery dialog window opens, go to the “Write debugging information” drop-down menu and select Small Memory Dump.
- Click on OK. This allows lightweight programs such as BlueScreenView to read dump files in the future.
- Now, download BlueScreenView and install it.
- Once the installation is complete, ensure that the “Run NirSoft BlueScreenView” checkbox is selected.
- You should be able to see your dump file in the upper section of the window. The details of each file will appear in the lower half of the window. You’ll find all the applications that were running before the crash occurred.
How to view BSOD error log in Event Viewer on Windows 11?
Now that you know how to get access to your BSOD error logs on Windows 10, you may be wondering how to do the same on Windows 11. After all, the new OS comes with a number of upgrades and changes. For instance, Windows 11 comes with new Designs for the Start Menu and Taskbar. As with most Windows upgrades, you also have fixes for some of the most commonly reported bugs, therefore, a generally smoother performance.
However, when it comes to viewing BSOD error logs, the steps you will need to take on Windows 11 are not essentially different from what you need to do on Windows 10.
But let’s recap and see how to see the event viewer logs in Windows 11 using Event Viewer:
- First, use the Win + S key combo on your PC to bring up the search feature.
- Run a search for “event viewer” and select the first result.
- In the Event Viewer, navigate to the left pane and go to Windows Logs.
- Once here, click System.
- Next, go to the right side of the window and select Create Custom View (you will find this option under System).
- Here you will see the Create Custom View option. Make sure to stay in the Filter tab.
- Next, head to the Logged drop-down menu and click Custom Range.
- Select the date and time range for which you want to see your BSOD logs.
- When ready, press the OK button in the Custom Range dialog box.
- In the Create Custom View dialog, head to Event Level. Make sure to check the voices for the following options: Critical, Warning, and Error.
- Click OK.
- Type in the name for the Custom View you’ve just made.
- Click OK.
- Next, go back to the Event Viewer main window.
- Here, you will see a full list of events that occurred during the period you’ve specified. They will be categorized in Warning, Critical, and Error events.
- Double-click the event log and go to the Details tab to see more information about a specific event.
- Note that these descriptions may be too technical. In this case, you can simply Google the event ID to get a simpler explanation for what happened and what you can do to fix it.
However, just like with Windows 10, in some cases, blue screen errors can throw your computer into a loop of reboots, which will prevent you from using the steps above. If this happens, the best thing to do would be trying to access the Event Viewer in Safe Mode. To take your Windows 11 PC into Safe Mode, you can use Bootable Media or go via Automatic Repair Environment. Blue screen errors generally don’t affect the early boot process — and the methods above will “trick” your computer into launching the automatic repair feature.
To get to the recovery screen, go through the following steps:
- First, force shut down your PC.
- Turn your PC back on and then force shut it down three more times.
- You will then see the “Please wait” message.
- On the Automatic Repair screen, go to Advanced Options.
- Navigate to Troubleshoot.
- Under Troubleshoot, go to Advanced Options and then Startup Settings.
- Press the Restart button.
- Your system will now reboot to the Startup Options page.
- Select Safe Mode and go to the Event Viewer to check the error logs for the blue screen errors.
Once you know what has caused BSOD errors on your Windows 11 PC, you can go on to try different solutions for resolving these problems.
One way to prevent BSODs is keeping malicious programs out of your system. To do that, get an effective security application such as Auslogics Anti-Malware. The great thing about the tool is that it can be used alongside your main antivirus program and even Windows Security.
Check your PC for malware your antivirus may miss and get threats safely removed with Auslogics Anti-Malware
Hopefully, you won’t have to refer to this article in the future. Let us know what you think about BSODs in the comments section below. You’re also welcome to ask us questions.