Skip to content

Log Format

Jump to bottom
Gnawbie edited this page Mar 27, 2026 · 5 revisions

Log Format

Entry format

Each process exit produces one line. Crashes produce an additional why --> explanation line beneath it:

[HH:mm:ss] TAG    | PID: ###### | Exit: CODE                   | ProcessName  [spawned by: Parent (PID)]  [crash: short-desc | module: x | exception: 0x...]
           why --> Plain-English explanation of what the crash means and what to try.

Fields

Field Description
HH:mm:ss Time the process exited
TAG CLOSE for clean exits, ERROR for crashes
PID Process ID (right-aligned in 6 characters)
Exit Exit code in decimal and hex (padded to 24 chars)
ProcessName The executable name as reported by WMI
spawned by Name and PID of the parent process that launched this one
crash: Short technical description of the crash type, plus faulting module and exception code from Windows Error Reporting if available
why --> Plain-English explanation of what the crash means and what you can do about it

The crash: tag and why --> line only appear on ERROR entries. If the parent process had already exited, the entry reads [spawned by: ??? (PID XXXXX - already gone)].

Real-world log screenshot

The following screenshot shows actual entries from errors_2026-03-26.log, grouped by error type:

Error log examples

Examples

Clean close:

[14:32:07] CLOSE  | PID:   9812 | Exit: 0 (clean)              | chrome.exe  [spawned by: explorer.exe (9200)]

Access violation crash:

[14:33:41] ERROR  | PID:  11024 | Exit: 3221225477 (0xC0000005) | someapp.exe  [spawned by: explorer.exe (9200)]  [crash: access violation | module: ntdll.dll | exception: 0xC0000005]
           why --> The program tried to read or write memory it does not own. Usually a bug, bad mod/plugin, or driver conflict. A reinstall or update may help.

Game crash with custom exit code:

[21:04:11] ERROR  | PID: 139076 | Exit: 3489660927 (0xCFFFFFFF) | PathOfExile.exe  [spawned by: steam.exe (8812)]  [crash: game/custom crash code | module: PathOfExile.exe | exception: 0xCFFFFFFF]
           why --> The game or program caught an internal error and exited with its own crash code. Check the game's own crash log or support site for details.

Missing DLL crash:

[10:15:03] ERROR  | PID:  44210 | Exit: 3221225781 (0xC0000135) | myapp.exe  [spawned by: explorer.exe (9200)]  [crash: DLL not found]
           why --> A required library file (.dll) is missing. Try reinstalling the program or installing the relevant runtime (e.g. Visual C++ Redistributable).

Session start banner:

============================================================
  ProcessMonitor started  2026-03-25 09:00:00
  PID: 4821  |  Log folder: C:\Users\walli\ProcessMonitorLogs
============================================================

Clean shutdown:

[17:45:00] INFO  | ProcessMonitor stopped.

Common exit codes

Exit code Hex Short description Plain meaning
0 0x00000000 Clean exit Program closed normally
1 0x00000001 Generic error No specific reason recorded
2 0x00000002 File not found A needed file was missing
5 0x00000005 Access denied Blocked from accessing a resource — try running as admin
3221225477 0xC0000005 Access violation Read/write to memory it doesn't own — bug, mod, or driver
3221225496 0xC0000017 Out of memory Ran out of RAM — close other apps
3221225501 0xC000001D Illegal instruction Invalid CPU instruction — corrupt install or OC instability
3221225620 0xC0000094 Integer divide by zero Bug in the program
3221225725 0xC00000FD Stack overflow Infinite loop or very deep call chain — bug in the program
3221225781 0xC0000135 DLL not found Missing library — reinstall or install Visual C++ runtime
3221225794 0xC0000142 DLL init failed Library loaded but failed to start — corrupt install or AV block
3221226356 0xC0000374 Heap corruption Memory corrupted at runtime — bad mod, plugin, or RAM issue
3221226505 0xC0000409 Stack buffer overrun Wrote past a memory boundary — serious bug, check for malware
3758096384 0xE0434352 .NET CLR exception Unhandled .NET error — check Event Viewer Application log
3489660927 0xCFFFFFFF Game/custom crash code App-defined code (e.g. Path of Exile) — check game's crash log

How crash context is gathered

When a crash is detected, the monitor:

  1. Looks up the exit code in a built-in table to get a short description and a plain-English explanation
  2. Waits ~1 second for Windows Error Reporting (WER) to write its event
  3. Queries the Windows Application Event Log for Event ID 1000 (Application Error) matching the crashed process
  4. If found, extracts the faulting module (the exact DLL or EXE that triggered the crash) and the Windows exception code
  5. Writes everything to the log and displays the plain-English explanation in the tray balloon tip

WER data won't always appear. If an app catches its own crash and calls ExitProcess with a custom code, Windows won't write an Event ID 1000 entry — you'll still get the description and why --> line, just no faulting module.

Clone this wiki locally