Windows Events

varghesesa · Post by **varghesesa** » Wed Jul 28, 2021 6:29 pm

Introduction

Unfortunately, BI can crash on occasion. The Windows Event may provide some hints as to the cause of the instability. The Windows Exception codes article lists all the Windows exceptions.

The Windows Event Viewer section explains how to leverage Windows Event Viewer to identify when BI started crashing. From there, you can use the BI logs to determine which BI version started the instability. Valuable information to share with support.

The Windows Exceptions section explains known errors and what to do next. FYI, there is plenty of documentation regarding different Windows Exception Codes. A simple Google search for "windows exception code <code number>", e.g. "windows exception code 0xc0000005" will bring up many articles on the issue.

Windows Event Viewer

This section explains how to leverage Windows Event Viewer to identify when BI started crashing. From there, you can use the BI logs to determine which BI version started the instability. Valuable information to share with support.

Sort the Application log by errors and determine which version introduced the crash.
Right click on Application -> Filter Current Log

: windows events_filter.png (101.63 KiB) Viewed 20758 times

Scroll down until you find the first time BI crashed.

: windows events_first crash.png (37.47 KiB) Viewed 20758 times

Look in BI logs to determine which version was running.

In this example, the crashes started for you on Oct. 29 at 3.53 pm. Find the corresponding version that was running. All I did was search for Stopped.
0 10/29/2021 4:18:19.589 PM App Stopped

A few lines after I see the version that was started.
0 10/29/2021 4:18:26.869 PM App Started version 5.5.1.18

Since 4:18 PM was after 3:35 PM I went to the previous stopped event.

0 10/29/2021 7:47:50.688 AM App Stopped
0 10/29/2021 7:47:56.454 AM App Intel video hardware detected
0 10/29/2021 7:47:56.454 AM App Nvidia video hardware detected
0 10/29/2021 7:47:56.454 AM App Graphics hardware vendorID 1414
0 10/29/2021 7:47:56.457 AM App Started version 5.5.1.18

So from my logs I know the version that was running at 3:35 PM was 5.5.1.18 since the next Stopped event was at 4:18 PM.

Windows Exceptions

Exception code: 0xc0000005

Code: Select all

Faulting application name: BlueIris.exe, version: 5.4.9.1, time stamp: 0x60d742f2
Faulting module name: BlueIris.exe, version: 5.4.9.1, time stamp: 0x60d742f2
[b]Exception code: 0xc0000005[/b]
Fault offset: 0x0000000000d188d6
Faulting process id: 0x27d8
Faulting application start time: 0x01d76ac5acaea843
Faulting application path: C:\Program Files\Blue Iris 5\BlueIris.exe
Faulting module path: C:\Program Files\Blue Iris 5\BlueIris.exe
Report Id: ffeed7ef-7251-46c9-a157-111a0085cb3a

Exception code: 0xc0000005 means BI is accessing a memory location that is not assigned to it. But because BI is constantly creating / reading / writing / deleting memory, it's impossible to know the underlying cause. In addition, it could be bad storage or memory hardware that is causing the issue. Again, in and of itself, these errors never point to the root cause.

However, the Faulting module path is the BI executable and it may be possible to use the fault offset to get to the underlying code causing the crash. Therefore, good to report the problem to Support.

If you search on the web, many articles regarding the Windows 0xc0000005 error (example below).
https://www.ionos.com/digitalguide/serv ... 05-errors/

Exception code: 0xc0000374

Code: Select all

Faulting application name: BlueIris.exe, version: 5.4.7.3, time stamp: 0x60afe6e9
Faulting module name: ntdll.dll, version: 10.0.19041.964, time stamp: 0xbd2c3c23
Exception code: 0xc0000374
Fault offset: 0x00000000000ff199
Faulting process id: 0x113c
Faulting application start time: 0x01d75389be095104
Faulting application path: C:\Program Files\Blue Iris 5\BlueIris.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: ec002b2f-6043-41af-9421-471eb677ca83

The 0xc0000374 exception code only states there is a heap issue, which if you are not a programmer, means an error occurred accessing memory. BI accesses memory many, many times per second so this by itself will not result in resolution. Furthermore, these errors can also be due to many other reasons like Antivirus software is in conflict with the BI application.

What makes this particular event more challenging is the Faulting module path is a Windows library (ntdll.dll) and thus using the offset to get to the underlying code is not possible.

Faulting module path: unknown

: windows events_module unknown.png (91.21 KiB) Viewed 20154 times

A crash in "unknown" is almost always a problem with antivirus. Run through the Windows Tuning article just to make sure Windows is not in conflict with BI. Pay attention to Anti-virus and Firewall sections.
https://blueirissoftware.com/forum/view ... =23&t=2426

It could also be a problem with hardware decoding drivers. Turn off hardware acceleration and see if stability returns.