How to Check Crash Logs in Windows 11

The easiest way to check crash logs in Windows 11 is Reliability Monitor. Select Start, type reliability, and open View reliability history. Red X icons mark app crashes and Windows failures, and you can select any one to see details. For the full technical logs, right-click Start and open Event Viewer, then look under Windows Logs > Application and System.

This guide shows both tools step by step, explains which event IDs matter for app crashes, freezes, and sudden restarts, covers blue screen dump files, and tells you what to do with what you find. No extra software is needed.

Before You Start

Note roughly when the crash happened. Both tools sort by date and time, and Event Viewer records a lot of harmless errors, so the time is what connects a log entry to your crash.

Check Crashes With Reliability Monitor

1. Select Start, type reliability, and open View reliability history. Expected result: a chart opens with one column per day and a stability line across the top.
2. Look for red X icons. The rows show application failures, Windows failures, and other problems.
3. Select a day to list what happened, such as “Stopped working” or “Windows was not properly shut down.”
4. Select View technical details on an entry. Expected result: you see the app name, the faulting module, and an exception code.
5. To see every report at once, select View all problem reports at the bottom.

Check Crash Logs in Event Viewer

1. Right-click Start and select Event Viewer. You can also press Windows + R, type eventvwr.msc, and press Enter.
2. Expand Windows Logs and select Application for app crashes or System for restarts and hardware errors.
3. In the right pane, select Filter Current Log, check Critical and Error, and select OK. Expected result: only serious events remain, newest first.
4. Find entries near the time of your crash and double-click one to read the details.
5. To share it with support, select the entry and use Copy to paste the details into a document, as software vendors such as Spectrasonics and Dotemu ask customers to do.

Microsoft describes Event Viewer and how to open it in its guide to system configuration tools in Windows.

Which Event IDs to Look For

• Event ID 1000, Application Error (Application log): an app crashed. The details name the faulting application and module.
• Event ID 41, Kernel-Power (System log): Windows didn’t shut down cleanly before it restarted, for example after a freeze, power loss, or holding the power button.
• Event ID 6008 (System log): the previous shutdown was unexpected, logged on the next startup.
• Event ID 1001, BugCheck (System log): Windows stopped with a blue screen. The entry includes the stop code.
• Event ID 7034 (System log): a Windows service stopped unexpectedly.

Exception code 0xc0000005 in an app crash means an access violation, a memory problem inside the app.

Check Crash Events With PowerShell

If you prefer a command, use PowerShell’s Get-WinEvent. Open Terminal (Admin) with Windows key + X, then A, and run:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=41,1001,6008} -MaxEvents 20

Expected result: a list of recent unexpected restarts and blue screens with their times. Change LogName='System' to LogName='Application' and Id to 1000 to list app crashes instead.

In Event Viewer you can also save a filter for later: select Create Custom View in the right pane, choose the logs and event IDs above, and name the view. It then appears under Custom Views.

If Windows Crashed With a Blue Screen

1. Write down the stop code shown on the blue screen, like CRITICAL_PROCESS_DIED.
2. In Event Viewer, look in the System log for a BugCheck entry (Event ID 1001) at that time.
3. Check C:\Windows\Minidump. Windows usually saves a small dump file there for each crash, which a technician can analyze with Microsoft’s WinDbg debugger.

Microsoft’s guide to unexpected restarts and stop code errors walks through fixes, and our guide on how to stop your computer from turning off by itself may help.

What to Do With What You Find

• One app keeps crashing: update it, then repair or reinstall it from Settings > Apps > Installed apps.
• The faulting module is a driver: update that driver through Windows Update or the maker’s website.
• Kernel-Power 41 with no blue screen: check power cables, the battery, and overheating, and make sure the PC wasn’t just switched off at the button. For a desktop, identify the power supply and follow its model-specific diagnostics. Event ID 41 alone does not prove a faulty PSU.
• Repeated blue screens: install all updates from Windows Update and test your hardware.
• Crashes started after a change: undo the change, or go back to a restore point.

Frequently Asked Questions

What’s the difference between crash logs and error logs?

Crash logs record when an app or Windows stopped unexpectedly. Error logs include every error Windows records. See how to check error logs on Windows 11 for a broader look.

Why are there so many errors in Event Viewer?

Windows logs many minor errors that don’t cause problems. Focus on entries that match the time of a crash or keep repeating.

Where are the log files stored?

Event logs are stored in C:\Windows\System32\winevt\Logs, but they’re meant to be read in Event Viewer rather than opened directly.

What should I do after I find the crashing app?

Update or reinstall that app, install Windows updates, and update drivers. To test your hardware, see how to run system diagnostics on Windows 11.