Produce a stop error on purpose and read it back from the logs

short · 40 min · Objective 3.1

Task

Trigger a stop error on the guest deliberately, then reconstruct what happened from the event log and the dump alone -- as though you had not been there. Reading the machine's own record is the skill, because in real life the machine has always already restarted.

Steps

  1. Enable the keyboard-initiated crash or use the built-in crash tool, trigger a stop error, and photograph or note the screen. Record the stop code and any named module in lab/stop/screen.txt.
  2. After the restart, find the unexpected shutdown event in the system log and record its identifier and time in lab/stop/event.txt.
  3. Locate the dump file, record its path and size in lab/stop/dump.txt, and note what tool would read it.
  4. Disable a service that others depend on, restart, and record the cascade in lab/stop/cascade.csv with header event_time,source,message_summary,first_or_consequence -- marking which single entry is the cause.
  5. Run a clean boot, then re-enable in halves to identify one startup item, and record the sequence in lab/stop/cleanboot.csv with header round,enabled_set,fault_present,conclusion.

Verify

grep -Eic '0x|stop code|[A-Z_]{6,}' lab/stop/screen.txt
grep -Ec '[0-9]' lab/stop/event.txt
grep -c . lab/stop/dump.txt
awk -F, 'NR>1 && NF>=4 {n++} END {print n" log entr(ies)"}' lab/stop/cascade.csv
awk -F, 'NR>1 && $4 ~ /first/ {n++} END {print n" entr(ies) marked as the cause"}' lab/stop/cascade.csv
awk -F, 'NR>1 && NF>=4 {n++} END {print n" clean boot round(s)"}' lab/stop/cleanboot.csv

A stop code captured, the shutdown event found, at least four cascade entries with exactly one marked as the cause, and three or more clean boot rounds. If every cascade entry is marked first, the ordering was not examined.

Notes

Put the machine back to a normal startup afterwards. A guest left in clean-boot configuration has its security software, backup agent and sync client silently disabled, which is a fix that creates three problems.

This is an independent study companion for CompTIA A+ Core 2 220-1202 and is not produced by or endorsed by CompTIA.