Welcome to MSDN Blogs Sign in | Join | Help

Why is Windows Error Reporting nicknamed "Dr. Watson"?

The nickname for the feature known as Windows Error Reporting is "Dr. Watson". Where did that name come from?

As you have probably guessed, The name Dr. Watson was inspired by the character of Dr. Watson, the assistant to Sherlock Holmes in the stories by Arthur Conan Doyle.

It is my understanding that the doctor was originally developed as part of Windows 3.0 beta testing. His job was to record data about application crashes to a file, so that the file could be uploaded and included with bug reports. The icon was (and continues to be) a friendly doctor using his stethoscope to investigate a problem.

The Doctor has remained true to the "capture information about an error" aspect of his job. In the meantime, the word "Watson" has expanded its meaning to encompass anonymous end-user feedback mechanisms in general, such as "Content Watson". (But if you hear "Watson" by itself, the speaker is almost certainly talking about error reporting.)

Published Wednesday, August 10, 2005 7:00 AM by oldnewthing
Filed under:

Comments

# re: Why is Windows Error Reporting nicknamed "Dr. Watson"?

Wednesday, August 10, 2005 10:11 AM by Anonymous
Is Microsoft not afraid that the SQM stuff which is pronounced Squim might not be nicknamed <a href="http://www.google.co.uk/search?q=define:quim">Quim</a>?

Juvenile I know, but it's the first word that pops to mind every time I hear SQM mentioned.

# re: Why is Windows Error Reporting nicknamed "Dr. Watson"?

Wednesday, August 10, 2005 10:18 AM by Andreas Magnusson
Since I work at a Med-Tech company there's bound to be one at least slightly eccentric MD in the close proximity. Ours is Dr Rosen. So when my colleagues designed an error reporting module for the device we make, it was called Dr Rosen in tribute to him and Dr Watson.
At least I find that funny, but then I know Dr Rosen...

# re: Why is Windows Error Reporting nicknamed "Dr. Watson"?

Wednesday, August 10, 2005 10:30 AM by oldnewthing
My guess is that "SQM" is named after the nearby city of Sequim http://www.ci.sequim.wa.us/ (the "e" is silent).

# re: Why is Windows Error Reporting nicknamed "Dr. Watson"?

Wednesday, August 10, 2005 10:30 AM by Dan
The "Dr. Watson's Clues" dialog in the Windows version was a nice touch.

# re: Why is Windows Error Reporting nicknamed "Dr. Watson"?

Wednesday, August 10, 2005 10:47 AM by nikos
dr watson would be good for remote crash debugging if it wasn't so... well basically useless most of the time.

most Dr's reports from MSVC release (optimized) code come with the warning "WARNING: Stack unwind information not available. Following frames may be wrong", and indeed most of the time they are and you can't figure out where the crash occured

i hope somebody from MS is listening so that they can at least add version information (from the apps resources) or at least the executable modification date so we can know which version of the program crashed?

thanks for listening :)

# re: Why is Windows Error Reporting nicknamed "Dr. Watson"?

Wednesday, August 10, 2005 11:03 AM by Hasani

Well, that solves another ms mystery. With the windows95 cd, why was happy days and the other music video placed on there?

[Response. -Raymond]

# re: Why is Windows Error Reporting nicknamed "Dr. Watson"?

Wednesday, August 10, 2005 11:04 AM by oldnewthing
nikos: The crash dump contains information even more reliable than the file version resource (people often forget to update that) and the last-modified date (which can be altered) - it contains the file header timestamp. Use that to index your symbol files. That's how the Symbol Server works.

# re: Why is Windows Error Reporting nicknamed "Dr. Watson"?

Wednesday, August 10, 2005 11:04 AM by Anonymous Coward
Why was the blue screen blue?

# re: Why is Windows Error Reporting nicknamed "Dr. Watson"?

Wednesday, August 10, 2005 11:10 AM by Eric K.
"Why was the blue screen blue?"

Duh. It would be awful silly calling it the "Blue Screen Of Death" if it wasn't blue, now wouldn't it?

Sheesh. :)

# re: Why is Windows Error Reporting nicknamed "Dr. Watson"?

Wednesday, August 10, 2005 11:29 AM by nikos
> it contains the file header timestamp

i examined a few logs my users have sent me (all from w2000 unfortunately) but i can't find any sort of timestamp info except for the time of the crash

perhaps what you are refering to is XP-only, and where can it be found?

thanks

# re: Why is Windows Error Reporting nicknamed "Dr. Watson"?

Wednesday, August 10, 2005 11:38 AM by oldnewthing
I don't have time right now. You can read about it yourself.
http://msdn.microsoft.com/library/en-us/debug/base/minidump_module_str.asp

# re: Why is Windows Error Reporting nicknamed "Dr. Watson"?

Wednesday, August 10, 2005 11:57 AM by Walter
I can never read about Dr. Watson without thinking of this cartoon: http://www.ibiblio.org/Dave/Dr-Fun/df200006/df20000627.jpg

# re: Why is Windows Error Reporting nicknamed "Dr. Watson"?

Wednesday, August 10, 2005 12:14 PM by Francisco Moraes
What annoyed me about Dr Watson is that Win 95/98/Me produced .wlg files which could not be read by Dr Watson on Win 2000/XP/2003. The file format was not documented as well which didn't allow people to produce their own readers either.

# re: Why is Windows Error Reporting nicknamed "Dr. Watson"?

Wednesday, August 10, 2005 1:36 PM by KorbyP
The Watson meme lives. 71 blogs.msdn.com posts and counting! http://blogs.msdn.com/search.aspx?q=watson&p=1

It's elementary...

# re: Why is Windows Error Reporting nicknamed "Dr. Watson"?

Wednesday, August 10, 2005 1:38 PM by Dr. Watson
Though it has got the conspiracy theorists going crazy about how your personal information, credit card number and house key are sent to Microsoft during error reporting, I don't care because those who designed it have done a superb job. Nowadays, nearly each time I send an error report I get a solution in return. Kudos to them, however little you appreciate Microsoft (or Micro$oft, is that right?).

# Follow on to Raymond's post on Dr. Watson

Wednesday, August 10, 2005 2:38 PM by Under The Hood - Matt Pietrek
Raymond's post on the history of Dr. Watson is right on the money. Some additional info, since I have...

# re: Why is Windows Error Reporting nicknamed "Dr. Watson"?

Wednesday, August 10, 2005 3:25 PM by Dan
nikos, Dr. Watson not only writes a log file but it can also create a crash dump. By default it's configured to do both. The amount of information written in the dump will depend of which crash options are selected.

The reason for the "information not available" error is because there's no symbols installed on the system. It's not feasible to ask customers to install symbols. As a developer you should be in the habit of requesting crash dumps.

Once you have the crash dump then load it in a debugger such as WinDbg. Using either the !dh or !lmi commands you can access the information Raymond mentioned. Use the lmv command if you wish to access version information.

Dr. Watson logs are great because they're cumulative and they keep a history but they're no replacement for a crash dump.

# re: Why is Windows Error Reporting nicknamed "Dr. Watson"?

Wednesday, August 10, 2005 4:26 PM by Dare
Actually, the nickname is supposed to be just "Watson" (without the "Dr."). Unfortunately, everyone added "Dr." because they assumed it was either the next version of or somehow associated with the default JIT debugger which still exists and is still called "Dr. Watson" and because the name for the reporting app itself is "DW" and people incorrectly assume that the D stands for "Dr."


# re: Why is Windows Error Reporting nicknamed "Dr. Watson"?

Wednesday, August 10, 2005 5:04 PM by Stefan Kuhr
Besides from Arthur Conan Doyles's well-known Dr. Watson I always thought that drwatson.exe/drwtsn32.exe is also a play with words on "Doctor What's On?"

Puzzled,

--
Stefan

# re: Why is Windows Error Reporting nicknamed "Dr. Watson"?

Thursday, August 11, 2005 2:34 AM by Chris
The old Dr. Watson and the newer DW are actually named differently. DW was supposed to stand for "Dad Watson." DAD was the acronym for Desktop Applications Division, which was the old name for the team that made Office.

The Office guys wanted to differentiated their new Watson that used the internet to upload stuff with the older Win 3x Dr. Watson so they called it Dad Watson. Ultimately it was abbreviated DW and Windows also picked up the functionality so the old Dr. Watson got grandfathered in.

# re: Why is Windows Error Reporting nicknamed "Dr. Watson"?

Thursday, August 11, 2005 9:05 AM by nikos
Dan: thanks for the info, I didn't know about the crash dump part, only logs. Looks like I've got to learn how to use windbg :)

# re: Why is Windows Error Reporting nicknamed "Dr. Watson"?

Thursday, August 11, 2005 9:56 AM by Tim Smith
If you save your PDB files for each build and Dr. Watson uses the minidump file format, you can load a crash in .NET and see everything. It is really nice.

About half the crash dumps we received using the minidump system showed us exactly where the crash happened. The other half of the time, the PC was off in the weeds.

# re: Why is Windows Error Reporting nicknamed "Dr. Watson"?

Thursday, August 11, 2005 10:32 AM by nikos
of course the best scenario is a user that has visual studio, where you can just send him the PDB and get back the stack trace :)

# re: Why is Windows Error Reporting nicknamed "Dr. Watson"?

Thursday, August 11, 2005 1:18 PM by protectedstatic
I always thought that in addition to the Holmes reference, it tied in nicely w/ the story about Bell & his first phone call: Watson, come here! I need you!

# re: Why is Windows Error Reporting nicknamed "Dr. Watson"?

Thursday, August 11, 2005 10:41 PM by Norman Diamond
Thursday, August 11, 2005 9:56 AM by Tim Smith
> If you save your PDB files for each build
> and Dr. Watson uses the minidump file
> format, you can load a crash in .NET and see
> everything. It is really nice.

Yeah I thought I had read something like that before. But when cmd.exe aborted and I tried to open its minidump in .Net, .Net didn't show anything. When I closed .Net, .Net aborted. Then I was offered an opportunity to debug .Net using a new invocation of .Net, which I declined.

# re: Why is Windows Error Reporting nicknamed "Dr. Watson"?

Wednesday, August 17, 2005 7:23 PM by Salman
thanks for that. how about the history of the 'blue screen of death'? j/k

# re: Why is Windows Error Reporting nicknamed "Dr. Watson"?

Monday, August 22, 2005 10:05 PM by Rolf
Actually, Chris is nearly correct when he points out that

"The old Dr. Watson and the newer DW are actually named differently. DW was supposed to stand for "Dad Watson." DAD was the acronym for Desktop Applications Division, which was the old name for the team that made Office."

The DAD devs liked to frequent "Dad Watsons", a pub on Fremont Ave and 36th, which is where DAD Watson (dw.exe) got its Nickname.

# Origin of Dr. Watson

Tuesday, September 13, 2005 2:12 PM by Designing @ Microsoft
Just read a post of Matt Pietrek referrring to the origin of Dr. Watson.
Check it out at OldNewThing...

# Circumventing custom SEH

Sunday, May 07, 2006 10:54 AM by REblog
I do most of my malware analysis statically, which is to say that I typically analyze malware by looking...

# Circumventing custom SEH

Wednesday, April 18, 2007 12:23 AM by REblog

I do most of my malware analysis statically, which is to say that I typically analyze malware by looking...

# Circumventing custom SEH

Wednesday, April 18, 2007 12:34 AM by REblog

I do most of my malware analysis statically, which is to say that I typically analyze malware by looking...

# Server Core phone home

Sunday, January 06, 2008 2:00 PM by The things that are better left unspoken

Windows Error Reporting (WER) is a Windows feature we know since Windows XP. (2001)&#160; Microsoft loves

# Connecting with Customers via Windows Error Reporting (Watson) and CEIP

Saturday, March 29, 2008 1:44 PM by Satisfy Me

Earlier this week, I provided a couple of glimpses at how product groups listen and respond to customers

New Comments to this post are disabled
 
Page view tracker