Kernel- Power how to determine the cause of the crashes?

[aleks94]

Last couple months i've been having this issue, but i havent started looking into it until now. I have a dell XPS 13 9343.

The computer will randomly shut down, no warning, no nothing. It's not overheating because it would shut down even if im doing nothing on the computer and everything is closed. (completely random shutdowns actually)

Ive done all sorts of diagnostics to rule out things such as cpu, ram, hardrive etc.

The error im receiving is "Kernel-Power" Event Id 41, Task Category 63

Here are the details.

Log Name: System
Source: Microsoft-Windows-Kernel-Power
Date: 3/30/2017 11:15:51 AM
Event ID: 41
Task Category: (63)
Level: Critical
Keywords: (70368744177664),(2)
User: SYSTEM
Computer: DESKTOP-GCA11AP
Description:
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
Event Xml:
<Event xmlns="http/schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />
<EventID>41</EventID>
<Version>4</Version>
<Level>1</Level>
<Task>63</Task>
<Opcode>0</Opcode>
<Keywords>0x8000400000000002</Keywords>
<TimeCreated SystemTime="2017-03-30T15:15:51.542092300Z" />
<EventRecordID>8639</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-GCA11AP</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="BugcheckCode">0</Data>
<Data Name="BugcheckParameter1">0x0</Data>
<Data Name="BugcheckParameter2">0x0</Data>
<Data Name="BugcheckParameter3">0x0</Data>
<Data Name="BugcheckParameter4">0x0</Data>
<Data Name="SleepInProgress">6</Data>
<Data Name="PowerButtonTimestamp">131353604716805621</Data>
<Data Name="BootAppStatus">0</Data>
<Data Name="Checkpoint">0</Data>
<Data Name="ConnectedStandbyInProgress">false</Data>
<Data Name="SystemSleepTransitionsToOn">1</Data>
<Data Name="CsEntryScenarioInstanceId">0</Data>
</EventData>
</Event>

I should also mention that my power button isnt functioning, rarely does. The odd thing i found about the details is that there are no values for the bugcheckparameter. Could it be that my messed up button (which it sometimes will actuate and work, but VERY rarely) is the cause of this? could it be actuating on its own at random times because of the malfunction?

Furthermore, i did do powersupply stress tests but the computer didnt crash during those. not sure if i used a good program. if someone could recommend a good psu stress test program? But perhaps even a stress test wouldnt directly cause a bettery that has dying cells to crash?

Anyways, i would GREATLY appreciate the help in solving this issue. Im hoping its something as simple as changing the power button board/buying a new battery.

Thanks in advance.

 

[derekullo]

The event you linked isn't what caused the computer to shutdown/restart.

All it says is that the computer was last shutdown unexpectedly, which is of course the problem.

You need to look a little further back in the logs.

The easiest to find would be an event like:

The process blabla.exe has initiated the power off of computer YOURCOMPUTERNAME on behalf of user NT AUTHORITY\SYSTEM for the following reason: Other (Unplanned/).

To stress the power supply you just need to stress the cpu and gpu.

Prime95 is a good and free way to stress the cpu.

Furmark is a good and free way to stress the gpu.

 

[derekullo]

A faulty power button could hypothetically cause the computer to shutdown randomly.

I've never had one break on me before but you could always disconnect the power button and push the power button on the motherboard to start the computer if it has one.

If it doesn't have a button than you would need to connect the power button to start the computer then disconnect it after the computer is running.

If you know exactly which pins to short out you could start the computer with a screwdriver.
Use the power button if you aren't sure which pins to short especially since the computer will be turned on.

 

[Mister_MO]

If you are getting crashes with report, there should be minidumps, try to use this to look at what program/library causes this http/www.nirsoft.net/utils/blue_screen_view.html

 

[aleks94]

The event you linked isn't what caused the computer to shutdown/restart.

All it says is that the computer was last shutdown unexpectedly, which is of course the problem.

You need to look a little further back in the logs.

The easiest to find would be an event like:

The process blabla.exe has initiated the power off of computer YOURCOMPUTERNAME on behalf of user NT AUTHORITY\SYSTEM for the following reason: Other (Unplanned/).

To stress the power supply you just need to stress the cpu and gpu.

Prime95 is a good and free way to stress the cpu.

Furmark is a good and free way to stress the gpu.

As im typing my reply i get a shutdown. anyways, i looked at the errors and warnings prior to the critical warning about the computer not powering on correctly.

I get an application error "faulting application name: AUDIODG.exe" event ID 1000 task category 100

I get a Appmodel-Runtime error event Id 69, task category none.

I also get a warning that says "kernel-Processor-Power" event id 37 task category 7.
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.

^ that shows up 4 times. except the values are 0/1/2/3 for each one. asuming its for each of the cores on my cpu?

I got a distributedCOM error event Id 10016 task category none.

Then another warning, source is "ESRV_SVC_QUEENCREEK"
The description for Event ID 2 from source ESRV_SVC_QUEENCREEK cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

Finally i get a Kernel-PNP warning. event id 219 and task category 212
The driver \Driver\WUDFRd failed to load for the device ACPI\INT3400\2&daba3ff&1.

I havent received that application error before until today. So, i doubt that would be a cause. the rest of the stuff i have no clue about.

 

[aleks94]

A faulty power button could hypothetically cause the computer to shutdown randomly.

I've never had one break on me before but you could always disconnect the power button and push the power button on the motherboard to start the computer if it has one.

If it doesn't have a button than you would need to connect the power button to start the computer then disconnect it after the computer is running.

If you know exactly which pins to short out you could start the computer with a screwdriver.
Use the power button if you aren't sure which pins to short especially since the computer will be turned on.

That would be a good way to test it on a desktop, unfortunately i dont have easy access to my motherboard as im getting these problems on my dell laptop.

 

[aleks94]

If you are getting crashes with report, there should be minidumps, try to use this to look at what program/library causes this http/www.nirsoft.net/utils/blue_screen_view.html

I downloaded the program and no files were generated. Everything was just blank in the program, something im doing wrong?

 

[Mister_MO]

They should be in folder C:\windows\minidump, if it is empty or does not exist, try look if in C:\windows is memory.dmp, if not you don't have logs turned on. To turn them on go to system properties (right click on this computer and then properties), then advanced system settings, go in tab advanced, there is start-up and recovery settings and there enable write debugging information, small memory dump should be enough. With this every system crash will create log that program i posted you should be able to view, problematic files should be red, so you should be able to narrow it down.

 

[aleks94]

They should be in folder C:\windows\minidump, if it is empty or does not exist, try look if in C:\windows is memory.dmp, if not you don't have logs turned on. To turn them on go to system properties (right click on this computer and then properties), then advanced system settings, go in tab advanced, there is start-up and recovery settings and there enable write debugging information, small memory dump should be enough. With this every system crash will create log that program i posted you should be able to view, problematic files should be red, so you should be able to narrow it down.

the option seems to be enabled and the location is "%systemroot%\MEMORY.DMP but i cant seem to find the file in the root of my hardrive.

 

[Mister_MO]

%systemroot% is folder where system is installed, most of time it is C:\windows. If you were to place %systemroot% into run (win+R) it would open this folder. But it would be better to enable small memory dump (256kb) as others are rewriting this one file.

 

[aleks94]

%systemroot% is folder where system is installed, most of time it is C:\windows. If you were to place %systemroot% into run (win+R) it would open this folder. But it would be better to enable small memory dump (256kb) as others are rewriting this one file.

yeah it was on automatic i changed it to small. and also it says %systemroot%\minidump not the other one i said. i also went and unchecked in c properties to make sure i can see all files and nothing was hidden. still didnt find anything.

 

[Mister_MO]

Only thing why there wont be any crash logs is it crashes at hardware level and os don't get any warning before it happens. So this would mean there shouldn't be anything wrong with software, but on hardware level and this could be even something stupid as grounding tape that peeled off and is causing random short circuits. When you power up your laptop try pressing down keyboard and around it to see if it shuts down, but from mine experience it would be most of time something stupid like squeezed or bit pulled out cable. You could try reassemble your notebook, but i would recommend it only if its out of warranty.

 

[aleks94]

Only thing why there wont be any crash logs is it crashes at hardware level and os don't get any warning before it happens. So this would mean there shouldn't be anything wrong with software, but on hardware level and this could be even something stupid as grounding tape that peeled off and is causing random short circuits. When you power up your laptop try pressing down keyboard and around it to see if it shuts down, but from mine experience it would be most of time something stupid like squeezed or bit pulled out cable. You could try reassemble your notebook, but i would recommend it only if its out of warranty.

You bring up a good point. Yeah my laptops been out of warranty for about 6- 7 months now. have had to crack it open already. ill make sure everything connected properly and nothing is out of the ordinary. You think my power button could be the reason its shutting down randomly? because ive been having issues with it for a while. sometimes it works sometimes it doesnt. most of the time it doesnt, i cant even hard reset my laptop ever. so im thinking maybe it randomly actuates?

 

[Mister_MO]

Maybe, but i think not as on this notebook it looks like it is physical button instead of integrated into keyboard where it would be impossible to check or repair. If you can open it up and measure it with multimeter's continuity test if there is proper connection when you press it down would be best to check.

 

[johnbl]

Hitting the power button on a sleeping system would generate the power event as the system boots.
Most often you would have to hit it twice or hold it. If the machine does not wake correctly, you would update the bios,and motherboard drivers. Then go into windows control panel and set what the power buttons do. If the system does not complete shutdown you would run cmd.exe and run powercfg.exe /energy and read the report.
If the system does not complete a shutdown you would turn on verbose shutdown messages.
https/support.microsoft.com/en-us/help/325376/how-to-enable-verbose-startup,-shutdown,-logon,-and-logoff-status-messages-in-the-windows-server-2003-family
It will tell you what the system is doing

 

[aleks94]

Hitting the power button on a sleeping system would generate the power event as the system boots.
Most often you would have to hit it twice or hold it. If the machine does not wake correctly, you would update the bios,and motherboard drivers. Then go into windows control panel and set what the power buttons do. If the system does not complete shutdown you would run cmd.exe and run powercfg.exe /energy and read the report.
If the system does not complete a shutdown you would turn on verbose shutdown messages.
https/support.microsoft.com/en-us/help/325376/how-to-enable-verbose-startup,-shutdown,-logon,-and-logoff-status-messages-in-the-windows-server-2003-family
It will tell you what the system is doing

Since i dont have windows 10 pro i couldnt access "pgedit.msc" although, i used another method they listed and was able to create a verbosestatus key in the registry. Now, im not certain how to read/where to find these status messages once recorded?

 

[Mister_MO]

Verbose status messages are totally useless to you as they just display what is system exactly doing at this moment while starting/shutting down/restarting. They don't record any log except for boot log if you have it enabled it in msconfig. They are good just for diagnosis if you are getting stuck during startup/shutdown.

 

[aleks94]

Only thing why there wont be any crash logs is it crashes at hardware level and os don't get any warning before it happens. So this would mean there shouldn't be anything wrong with software, but on hardware level and this could be even something stupid as grounding tape that peeled off and is causing random short circuits. When you power up your laptop try pressing down keyboard and around it to see if it shuts down, but from mine experience it would be most of time something stupid like squeezed or bit pulled out cable. You could try reassemble your notebook, but i would recommend it only if its out of warranty.

On top of the shutdowns my power button wasn't working majority of the time. I opened up my laptop to clean it all out again and make sure everything was connected properly. The laptop has a separate board for the power button, usb and sd card reader. i pulled that out to clean the button, as i was pulling it out the ribbon cable just slipped out. Which it shouldn't have done since they're clipped in. I plugged it all back in correctly. boom! button works correctly now and im not experiencing the shutdowns anymore(been about two days without shutdowns, previously multiple shutdowns a day). So what im assuming happened is exactly what you mentioned. Certain times it would contact and either work, or trigger a shutdown. Thank you so much!

Only thing that is unfortunate is for the people who dont have the knowledge, patience and help to troubleshoot their computers. especially out of warranty. I also contacted dell to see what theyd tell me. It seems their solution to everything is "replacing a faulty system board" Which that obviously isnt the case. its just easier for them to replace major parts than actually trouble shoot. I dont even want to know how many people pay 400+ dollars to replace a board thats perfectly functioning.

Also, thank you to everyone else who took the time to try and help me troubleshoot my computer.

 

[sapu__6356]

You should really check on that kernel-pnp,because im currently having the same issues random reboots kernel power 41,and i also has that kernel pnp driver load fail error in my event viewer