Why did my game crash? Reliability Monitor and Event Viewer

The game was running, and then it was not: back on the desktop with no message, a black screen that came back without the game, or a blue screen and a restart. Those are three different events, and Windows records each one in a different place. Reading the right record first turns "my game crashes" into a question with a next step.

Three kinds of crash, three different records

If the PC turned off or restarted without a blue screen, PC restarts while gaming is the page for that trail.

Start with Reliability Monitor

Press Windows + R, type perfmon /rel and press Enter; the /rel switch starts Reliability Monitor. Microsoft's guide to reading it was written for Windows Vista, so the layout you see may differ. It describes up to a year of history, one column per day, and an error icon on each day with a failure. Windows 11 sorts failures into three rows:

• Application failures: a program stopped working or stopped responding.
• Windows failures: an operating system crash, with its stop code, or a boot failure.
• Miscellaneous failures: other failures, unexpected shutdowns included.

The chart also logs software installs and uninstalls, Windows updates and drivers included, and that is the reason to start here. Microsoft points out that it shows "whether significant changes in stability began at the same time". Click the day the crashes started and see what was installed that day; an update on that date is a lead you can test by rolling it back.

The Application log: Event ID 1000

Open Event Viewer (eventvwr.msc) and look in the Application log for errors with the source Application Error and Event ID 1000, which Microsoft calls "the actual application crashing event". Its example entry shows the fields worth copying down:

• Faulting application name: the program that crashed, with its version.
• Faulting module name: the file the crash happened in.
• Exception code: Microsoft lists 0xc0000005 (STATUS_ACCESS_VIOLATION), 0xc0000374 (STATUS_HEAP_CORRUPTION) and 0xc0000022 (STATUS_ACCESS_DENIED) as common ones.

Microsoft reads Event ID 1000 and Event ID 1001 repeating in the Application log as a sign that an application keeps crashing; 1001 relates to Windows Error Reporting.

Read the module name with care. Microsoft notes that the event often names a Microsoft module, such as ntdll.dll, kernel32.dll or kernelbase.dll, and that these are "caught as victims of other types of corruption previously performed by misbehaving modules." For a third-party program, Microsoft's guidance is to share the relevant dumps "with the third party for investigation": for a game, that is its developer's support, and the module name, the exception code and the date belong in the report too.

A black screen, then the picture comes back

When the graphics card stops responding, Windows resets the driver and the GPU instead of leaving the machine frozen. Microsoft calls this Timeout Detection and Recovery: the default timeout is 2 seconds, and a successful recovery shows the message "Display driver stopped responding and has recovered."

A recovery can leave a live dump in C:\WINDOWS\LiveKernelReports, in a folder per component; Microsoft's reference notes that "Live dumps do not reset the OS". The codes involved are 0x117 VIDEO_TDR_TIMEOUT_DETECTED and 0x141 VIDEO_ENGINE_TIMEOUT_DETECTED, which identify live dumps and are never used for a real bug check.

Microsoft's reasons for 0x117 include a display driver that needs updating and a list of hardware issues: over-clocked components, "Incorrect component compatibility and settings (especially memory configuration and timings)", insufficient cooling or power, and defective parts. It also suggests checking the System log for error messages that might help identify the device or driver. Sudden FPS drops in games covers what a driver reset looks like mid-game.

A blue screen

A blue screen is a stop error. Windows writes a memory dump to %SystemRoot%\MEMORY.DMP or, with the small memory dump setting, a file of about 256 KB per crash to %SystemRoot%\Minidump, named by date. A small dump holds the stop message, its parameters and "A list of loaded drivers". To read one, install WinDbg from the Microsoft Store or with winget install Microsoft.WinDbg, open the .dmp file and run !analyze -v.

Read the result with Microsoft's warning in mind: "The root cause of stop errors is rarely a user-mode process." A game can trigger a stop error, but it is usually exposing a problem in a driver, the hardware or Windows itself, and when a driver is named, its vendor is where an update comes from.

What to check, one change at a time

Test the game after each step, so you know which change mattered.

1. Verify the game's files. In Steam, right-click the game in your Library (or use the gear icon on its Library page), then Properties... > Installed Files > Verify integrity of game files; Steam says one or more files failing to verify is normal for most Steam games. In the EA app, go to Library, select the game's Manage icon, then Repair.
2. Reinstall the graphics driver cleanly. NVIDIA says to "Reinstall the latest driver using a clean install method": Custom (Advanced) > Perform a clean installation in the NVIDIA installer, or Display Driver Uninstaller (DDU).
3. Close overlays and recording tools. Activision warns that "input remapping software, overlays, and recording software may interfere with gameplay", and suggests uninstalling them if crashes continue.
4. Return clocks to default. NVIDIA suggests Debug Mode, under System > Advanced in the NVIDIA app (or the menu bar of the legacy NVIDIA Control Panel), which "forces the graphics card to run at NVIDIA reference clock speeds", and default CPU and memory speeds if you overclocked them, which may mean setting the XMP or EXPO profile to Default in the BIOS. If that stops the crashes, see is your RAM at its rated speed?
5. Test the memory. Press Windows + R, run mdsched.exe (Windows Memory Diagnostic) and choose Restart now and check for problems (recommended); after the test, read the MemoryDiagnostics-Results entry in the System log.
6. Check temperatures and power. Both are on Microsoft's 0x117 list, and Activision's first step is a PC "in a cool, well-ventilated place". See CPU and GPU temperatures while gaming.
7. Update the BIOS. Microsoft's checklist for stop errors includes making sure "the BIOS and firmware are up-to-date". On a 13th or 14th Gen Intel Core desktop, read Intel 13th and 14th gen crashes in games first.

What does not help

• Raising the driver's recovery timeout. The timeout is how long Windows waits before it resets a stalled GPU, so a longer one turns a short black screen into a longer freeze. If an older tool changed it, w0a's GPU crash recovery card puts the Windows default back.
• Switching crash reporting off. The game crashes just the same, only without the report. If your crash reports have vanished, the Crash reporting and legacy apps card restores the Windows defaults.
• Removing the page file. Windows needs a paging file of at least 2 MB on the boot volume to write a memory dump, and Microsoft notes that "The default dump file is the pagefile". A machine that started without a configured dump file can log Event ID 46 from volmgr, "Crash dump initialization failed!". The page file and games explains the rest.
• Replacing ntdll.dll or another Windows file named as the faulting module. Microsoft describes those modules as victims of corruption that happened elsewhere.

Related

• Sudden FPS drops in games
• DPC latency: when a driver is what stutters
• PC restarts or shuts down while gaming
• Intel 13th and 14th gen crashes in games
• CPU and GPU temperatures while gaming