How to Check Crash Logs in Windows 11
When your PC freezes, blue-screens, or restarts unexpectedly, Windows 11 quietly records what happened. These crash logs contain error codes, timestamps, and system details that can point you toward the cause — whether it's a failing driver, misbehaving app, or hardware issue. Here's where to find them and how to read what matters.
What Are Crash Logs and Why Do They Exist?
Windows 11 uses several built-in tools to track system events. When something goes wrong — a BSOD (Blue Screen of Death), an app crash, or an unexpected shutdown — the operating system writes diagnostic data to log files automatically. These logs exist precisely so you (or a technician) can investigate without guessing.
There's no single "crash log file." Instead, Windows stores this information across a few different locations and tools, each suited to different types of problems.
Method 1: Event Viewer — The Most Detailed Option
Event Viewer is Windows 11's primary logging hub. It captures system events, errors, warnings, and critical failures in real time.
To open Event Viewer:
- Press Windows + X and select Event Viewer, or
- Press Windows + R, type
eventvwr.msc, and hit Enter
Once open, navigate to: Windows Logs → System for OS-level crashes Windows Logs → Application for app-related crashes
Look for entries marked Critical or Error. Each entry includes:
- A timestamp showing exactly when the crash occurred
- An Event ID (a numeric code that identifies the error type)
- A Source field identifying which component logged the event
- A Details tab with more technical information
Common Event IDs to know:
| Event ID | What It Typically Means |
|---|---|
| 41 | Unexpected shutdown / power loss |
| 1001 | Windows Error Reporting — post-crash summary |
| 6008 | Previous shutdown was unexpected |
| 7034 | A service terminated unexpectedly |
You don't need to understand every field. The Event ID alone is often enough to search online and find what other users with identical crashes discovered.
Method 2: Reliability Monitor — The Visual Timeline 🕐
If Event Viewer feels overwhelming, Reliability Monitor presents the same data as a visual timeline — easier to scan at a glance.
To open it:
- Press Windows + S, search for Reliability Monitor, and open View reliability history
You'll see a calendar-style graph where red X marks indicate failures and yellow triangles indicate warnings. Click any day to see what crashed and when. Each entry links back to Event Viewer for deeper detail if needed.
Reliability Monitor is particularly useful for spotting patterns — for example, crashes that cluster around a specific time, a recent update, or the installation of new software.
Method 3: Minidump Files — For Driver and BSOD Analysis
When a BSOD occurs, Windows saves a minidump file — a compact snapshot of what was happening in memory at the moment of the crash. These files are stored at:
C:WindowsMinidump Minidump files (.dmp extension) aren't readable as plain text. To analyze them, you'll typically use:
- WinDbg — Microsoft's official debugger, available free from the Microsoft Store. Powerful but has a steep learning curve.
- WhoCrashed — a third-party tool that translates minidump data into plain-English summaries, often identifying the specific driver responsible.
The minidump approach is most useful when crashes are BSOD-related and you suspect a driver conflict or hardware failure. If a specific .sys file keeps appearing in crash reports, that's your driver culprit to investigate.
Method 4: Windows Memory Diagnostic — Hardware-Specific Checks
If crash logs point toward memory errors, Windows 11 includes a built-in memory test tool.
To run it:
- Press Windows + R, type
mdsched.exe, and press Enter - Choose to restart now or schedule the test for next boot
After the test, results appear in Event Viewer under Windows Logs → System, logged by the source MemoryDiagnostics-Results. A pass doesn't guarantee perfect RAM, but failures are a strong indicator of faulty hardware. 🔍
Reading Between the Lines: What the Logs Actually Tell You
Understanding crash logs means recognizing a few key distinctions:
Driver-related crashes often show .sys files in the faulting module field. Common culprits include graphics drivers, network adapters, and third-party antivirus kernel components.
Application crashes appear in the Application log rather than System. These rarely cause BSODs but can cause freezes and unexpected closures.
Hardware-triggered crashes tend to produce inconsistent error codes — no two crashes look exactly alike — because the failure is physical rather than logical.
Software-triggered crashes are more likely to produce the same Event ID or error code repeatedly, which makes them easier to diagnose and resolve.
The Variables That Shape What You'll Find
How useful crash logs are — and which method gets you there fastest — depends on several factors specific to your setup:
- How recent the crash was: Older events may be overwritten depending on your log size settings
- Whether minidumps are enabled: Some systems are configured to skip minidump creation; check under System Properties → Advanced → Startup and Recovery
- Your comfort with technical output: Event Viewer provides raw data; Reliability Monitor and WhoCrashed translate it into something more approachable
- The type of crash: BSODs, app crashes, and unexpected shutdowns leave different evidence in different places
- What changed recently: A driver update, new hardware, or a Windows Update that preceded the crashes often narrows the investigation significantly
Windows 11 gives you all the raw data — but what that data means, and which fix applies, depends entirely on what your logs actually show and what's unique about your system's configuration.