Today we are releasing a report showing the companies Windows 7 beta crash data, and now the Windows 7 Release Candidate crash data! This reports’ focus is to help companies see how well their applications are performing on the Windows 7 beta. The report has two section, one highlights the top user-mode issues and the other highlights the top kernel-mode issues. The data between the two of these sections are slightly different I will explain what each data point is trying to communicate.
Navigate to: Windows Error Reporting > Software > My Reports
Note: Download !analyze to help in debugging the problems shown in this report.
User-mode: What is a user-mode failure?
A failure is chosen based on analysis of the cab by !analyze, a debugger extension that is part of the Debugging Tools For Windows. A Failure is a unique combination of Symbol, Problem Class and Exception code. The failure may aggregate multiple Buckets (EventID’s). The results of the analysis can be dependent on the availability of symbols (PDB files) for the modules related to the failure.
Note: Since we Microsoft does not have private symbols for debugging memory dump files failures are based on the best available analysis of memory dump files. In order to get the most accurate depiction of what the failure is using private symbols in debugging will quickly show where the precise origin of a failure occurs.
Kernel-mode: What is a kernel-mode bucket?
In kernel mode, the debugger walks the stack of the crashing thread and determines where to place the blame for the crash. Typically, a crash bucket name is derived from the debugger's choice of bugcheck stopcode + the blamed driver + the function name (if any, symbols are needed for this) + the function offset. All crashes assigned to a given bucket name can usually be considered as failing for the same reason.