Debugging hang where Ctrl Alt Delete won't work

Question

My computer recently froze out of the blue wwhile I was browsing the web. Ctrl-Alt-Delete didn't work so I had to resort to killing the power and rebooting.

Now I'm wondering what I could have done to diagnose and determine the cause of why it hung.

I read you can force a system crash, but after I get a kernel memory dump, what could I do in windbg to figure out why it was hanging?
Would that even work if I couldn't use ctrl-alt-delete? Are there any other options to figure this out?

Solution

When your system freezes there is nothing you can do to analyze the situation. Usually, you won't even be able to do any post-mortem analysis, because no information about the hang is recorded.

The method described in the article you linked is intended to be used by driver developers that have to cause a crash for testing purposes. It would not have helped you in your situation, primarily because you didn't have the registry key set when it happened. If you had it set, you could have caused a crash and would have a memory dump for post-mortem analysis.

What could I do with it?

Probably nothing. When you collected such a dump through a regular crash, it would usually contain easily obtainable information regarding who or what caused the crash. You can get that information by loading the dump into windbg and executing:

!analyze -v

However, if you had enabled the registry option to cause a crash, windbg would indicate that the keyboard driver caused the bug check.

You could check the other processes and threads that were recorded in the dump to find what actually caused the hang. But you should really know what you're doing and/or looking for.

So, what should I do?

The problem with random hangs is that they're random. As long as they appear random, there's nothing you can do. You can observe the behavior long enough until it doesn't appear random anymore.

Once you realize that the problem happens due to a certain pattern, you can start troubleshooting the issue.

Comments

[Oliver Salzburg]

It would not have worked, because you have to set the registry value and then reboot. So you should have made that change before the hang even occurs.

[Ramhound]

If the kernel locked up there isn't much you can do. Did you actually get a memory dump. Is this an actual problem you face currently?

[Josh]

@OliverSalzburg I know. I'm wondering for next time something like this happens.