Microsoft-Windows-WER-SystemErrorReporting
40 events across 2 channels
Event ID 1000: The computer has rebooted from a bugcheck.
#Event ID 1001: The computer has rebooted from a bugcheck.
#Description
The computer has rebooted from a bugcheck. The bugcheck was: param1. A dump was saved in: param2. Report Id: ReportId.
Message #
Fields #
| Name | Description |
|---|---|
param1 UnicodeString | |
param2 UnicodeString | |
param3 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-WER-SystemErrorReporting",
"guid": "{ABCE23E7-DE45-4366-8631-84FA6C525952}",
"event_source_name": "BugCheck",
"event_id": 1001,
"version": 0,
"level": 2,
"task": 0,
"opcode": 0,
"keywords": 36028797018963968,
"time_created": "2012-04-06T14:07:52.000000Z",
"event_record_id": 13423,
"correlation": {},
"execution": {
"process_id": 0,
"thread_id": 0
},
"channel": "System",
"computer": "WKS-WIN764BITB.shieldbase.local",
"security": {
"user_id": ""
}
},
"event_data": {
"param1": "0x00010001 (0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000)",
"param2": "C:\\Windows\\MEMORY.DMP",
"param3": "040612-50390-01"
}
}
Event ID 1002: The system was unable to convert a saved dump to a minidump
#Event ID 1003: Unable to read system shutdown configuration information from the registry.
#Description
Unable to read system shutdown configuration information from the registry.
Message #
Event ID 1004: Unable to move dump file from the temporary location to the final location.
#Description
Unable to move dump file from the temporary location to the final location.
Message #
Event ID 1005: Unable to produce a minidump file from the full dump file.
#Description
Unable to produce a minidump file from the full dump file.
Message #
Event ID 1006: The computer has rebooted from a bugcheck.
#Description
The computer has rebooted from a bugcheck. A dump was not saved.
Message #
Event ID 1007: Error reporting was unable to report the bugcheck
#Event ID 1008: Error reporting was unable to report a dirty shutdown
#Event ID 1009: Error reporting was unable to check the paging file for a crash dump.
#Description
Error reporting was unable to check the paging file for a crash dump.
Message #
Event ID 1010: Error reporting was unable to check the paging file for a crash dump.
#Description
Error reporting was unable to check the paging file for a crash dump.
Message #
Event ID 1011: Error reporting was unable to read the CrashControl settings.
#Description
Error reporting was unable to read the CrashControl settings.
Message #
Event ID 1012: Error reporting was unable to create a crash dump file as a previous crash dump file already exists.
#Description
Error reporting was unable to create a crash dump file as a previous crash dump file already exists.
Message #
Event ID 1013: Error reporting was unable to query volume information while creating a crash dump file.
#Description
Error reporting was unable to query volume information while creating a crash dump file.
Message #
Event ID 1014: Error reporting ran out of memory while creating a crash dump file.
#Description
Error reporting ran out of memory while creating a crash dump file.
Message #
Event ID 1015: Error reporting was unable to create a temporary file to hold the crash dump.
#Description
Error reporting was unable to create a temporary file to hold the crash dump.
Message #
Event ID 1016: Error reporting ran out of disk space while creating a crash dump file.
#Description
Error reporting ran out of disk space while creating a crash dump file.
Message #
Event ID 1017: Error reporting was unable to copy a crash dump from the paging file.
#Description
Error reporting was unable to copy a crash dump from the paging file.
Message #
Event ID 1018: The dump file at location: param1 was deleted because the disk volume had less than param2 GB free space.
#Event ID 1019: The computer has rebooted from a bugcheck.
#Event ID 1073742824: The computer has rebooted from a bugcheck.
#Event ID 1073742825: The computer has rebooted from a bugcheck.
#Description
The computer has rebooted from a bugcheck. The bugcheck was: param1. A dump was saved in: param2. Report Id: ReportId.
Message #
Fields #
| Name | Description |
|---|---|
param1 UnicodeString | The computer has rebooted from a bugcheck. The bugcheck was |
param2 UnicodeString | . A dump was saved in |
param3 UnicodeString | . Report Id |
Event ID 1073742826: The system was unable to convert a saved dump to a minidump.
#Description
The system was unable to convert a saved dump to a minidump.
Message #
Event ID 1073742827: Unable to read system shutdown configuration information from the registry.
#Description
Unable to read system shutdown configuration information from the registry.
Message #
Event ID 1073742828: Unable to move dump file from the temporary location to the final location.
#Description
Unable to move dump file from the temporary location to the final location.
Message #
Event ID 1073742829: Unable to produce a minidump file from the full dump file.
#Description
Unable to produce a minidump file from the full dump file.
Message #
Event ID 1073742830: The computer has rebooted from a bugcheck.
#Description
The computer has rebooted from a bugcheck. A dump was not saved.
Message #
Event ID 1073742831: Error reporting was unable to report the bugcheck.
#Description
Error reporting was unable to report the bugcheck.
Message #
Event ID 1073742832: Error reporting was unable to report a dirty shutdown.
#Description
Error reporting was unable to report a dirty shutdown.
Message #
Event ID 1073742833: Error reporting was unable to check the paging file for a crash dump.
#Description
Error reporting was unable to check the paging file for a crash dump.
Message #
Event ID 1073742834: Error reporting was unable to check the paging file for a crash dump.
#Description
Error reporting was unable to check the paging file for a crash dump.
Message #
Event ID 1073742835: Error reporting was unable to read the CrashControl settings.
#Description
Error reporting was unable to read the CrashControl settings.
Message #
Event ID 1073742836: Error reporting was unable to create a crash dump file as a previous crash dump file already exists.
#Description
Error reporting was unable to create a crash dump file as a previous crash dump file already exists.
Message #
Event ID 1073742837: Error reporting was unable to query volume information while creating a crash dump file.
#Description
Error reporting was unable to query volume information while creating a crash dump file.
Message #
Event ID 1073742838: Error reporting ran out of memory while creating a crash dump file.
#Description
Error reporting ran out of memory while creating a crash dump file.
Message #
Event ID 1073742839: Error reporting was unable to create a temporary file to hold the crash dump.
#Description
Error reporting was unable to create a temporary file to hold the crash dump.
Message #
Event ID 1073742840: Error reporting ran out of disk space while creating a crash dump file.
#Description
Error reporting ran out of disk space while creating a crash dump file.
Message #
Event ID 1073742841: Error reporting was unable to copy a crash dump from the paging file.
#Description
Error reporting was unable to copy a crash dump from the paging file.
Message #
Event ID 1073742842: The dump file at location: param1 was deleted because the disk volume had less than param2 GB free space.
#Event ID 1073742843: The computer has rebooted from a bugcheck.
#Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID abce23e7-de45-4366-8631-84fa6c525952
Defined in werfault.exe, which carries the event manifest.
Observed on:
- WS2022-20348.4893, schema read from the registered manifest, captured 2026-06-02
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02