Event Viewer: knowing your errors

When a PC crashes, freezes or blue-screens, Windows quietly records what happened. That record lives in Event Viewer — a built-in tool most people never open. Used well, it can turn "my computer just crashed" into an actual diagnosis.

Opening Event Viewer

Press the Windows key, type "Event Viewer" and open it. The section you want most of the time is Windows Logs, which contains System and Application logs.

Understanding the levels

• Information — normal activity, usually safe to ignore
• Warning — something wasn't right but Windows carried on
• Error — a component or app failed
• Critical — a serious failure, often what caused a crash or restart

Focus on Error and Critical entries around the time your problem happened. The date and time columns let you line events up with when the PC actually misbehaved.

What to look for

Double-click an entry to see the source and an event ID. Common culprits include disk errors (a failing drive), Kernel-Power (an unexpected shutdown, often power or overheating), and application crashes tied to a specific program. You don't need to memorise IDs — the source and description usually point you in the right direction.

Event Viewer rarely gives a single obvious answer, but a cluster of disk errors before every crash tells its own story.

Where it gets tricky

Event Viewer shows symptoms, not always causes — and it's easy to chase harmless warnings down a rabbit hole. If you're seeing repeated disk or Kernel-Power errors, or crashes that keep coming back, that's worth a proper look. We diagnose recurring crashes and blue screens across London, on-site the same day, and read the logs so you don't have to.

The event IDs worth actually knowing

You don't need to memorise Event Viewer's thousands of codes, but a few come up often enough to be worth recognising. Event ID 41 (Kernel-Power) means the PC shut down unexpectedly — usually a power, overheating or power-supply problem rather than software. Event ID 7 (Disk) and warnings from disk or Ntfs sources point to a failing drive and are worth acting on fast. Event ID 1000 (Application Error) ties a crash to a specific program. Seeing the same ID cluster together right before each problem is the clue that turns "it just crashes" into an actual diagnosis.

Using Reliability Monitor instead

Event Viewer can be overwhelming. If you want the same information in a far friendlier form, open Reliability Monitor (search "reliability" in the Start menu). It shows a simple timeline of your PC's stability, with red crosses marking crashes and failures. Click any day to see what happened, in plain language. It's the quickest way for a non-technical user to see whether a problem is getting worse, and when it started — which is often the single most useful thing to know when something's going wrong.

When the logs point to hardware

The real value of these logs is telling software problems apart from hardware ones. Repeated disk errors before every freeze suggest a failing drive. Kernel-Power events with no clean shutdown point to power or heat. A single misbehaving application is a software fix; a pattern of hardware warnings is not something to ignore. If you're seeing recurring errors and aren't sure what they mean, that's exactly the point to get the machine looked at — we read these logs every day and can tell quickly whether you're facing a quick software fix or a failing component.