How to Use Windows Reliability Monitor to Identify Software Issues

What is Windows Reliability Monitor?

Windows Reliability Monitor is a Windows application that assists you in the identification of software issues in the Windows operating system that may affect the system performance and reliability.

Windows Reliability Monitor is located inside the Windows Control Panel under System and Security\Security and Maintenance.  (See Figure 1.)

Figure 1. - Windows Reliability Monitor

You can also access the Reliability Monitor through the Windows search box from Start Menu. Just type the magic letters "reliab" (without quotation marks) and click on View reliability history. (See Figure 2.)

Figure 2. - Reliability Monitor on the start menu search

The third option for starting Reliability Monitor is by opening up the Windows Run Box (Windows Key + R) and type the command:  perfmon /rel then press the Enter key.

This feature was originally intended to be used by system administrators (admins) running Windows Server 2008, not on Windows user based systems. This may explain why the tool is relatively unknown and is underutilized.

What does it look like? (See Figure 3.)

Figure 3. - The Reliability Monitor Interface

How does it work?

Like your car's onboard computer constantly monitors critical performance values such as fuel consumption, tire pressure, engine RPMs and valve load, Windows constantly monitors the system state of the operating system between initial logon and the system shutdown.

Critical system components (memory, data drives, fans and CPU) are constantly probed and the results are collected in Performance Counters. System and application events (e.g. Outlook send/receive activity, Word opening a document and so forth) are individually tracked and the information is saved as event trace data. For information about Windows event logs and how to export them, refer to KB article How to Export Windows Event Logs.

Performance monitor uses both data collections (counters and events) to create a visual summary of performance relevant events that occurred on the system in a format that can be easily understood. (See figure 4.)

Figure 4. - Investigating events in the Reliability Monitor.

Each column represents a date (Day or Week) based on the View By selection on the top of the graphic, with the relevant events listed underneath, grouped by their severity - Critical. Warning, Information – in order of occurrence. This system shows two critical events on June 29th, MapsBroker and LinkCollector are both crashing at some point. We need additional information on what either application does, or if it has any decencies. Now let’s click on the View technical details link in the Action column: (See Figure 5.)

Figure 5. - Investigation faulting applications.

A quick search for svchost.exe_MapsBroker finds an article from McAfee outlining that the issue was resolved in McAfee Antivirus version 10.1.2. If I can update to this or a newer McAfee product version the issue with McAfee is solved!

The second entry is a bookmark manager app (LinkCollector) an older application that has been used by this user for several years. Let’s see what we can learn from the details view: (See Figure 6.)

Figure 6. - Linkcollector details

Investigating the details, Kernelbase.dll is faulting launching LinkCollector executable. If this a problem file? Let’s take a closer look at Kernelbase.dll. (Given the file name and its location it is fair to assume that this is part of the Windows 10 kernel and is a legitimate Windows file. But, we want to be on the safe side) (See Figure 6.)

Figure 6. - Checking faulting module digital signature

The file checks out, and carries a proper signature from Microsoft.

Now it’s time to investigate LinkCollector. Further investigation with the user indicated that the application was purchased over six years ago in 2011 and it probably ran without issues under Windows 7.

Investigating the startup of the LinkCollector application the start was slow and sluggish and the application could not deal with the 4K screen resolution on the system being troubleshot.

What’s the next step? Windows Compatibility Troubleshooter! (See Figure 7.)

Figure 7. - Running Windows troubleshooter.

Two troubleshooting steps within the Windows compatibility troubleshooter process (switching the Compatibility settings to Windows 7 and disabling high DPI scaling) solved the crash.(See Figure 8.)

Figure 8. - Using compatibility mode options to resolve issues with older programs.