Claus Brod


a number of the crash reports we're seeing is marked with the "Cabs requested" icon (cab icon with a little clock in it). The documentation says that this icon means that ".cab data has been requested and is not yet ready for download".

I'm not quite sure how I should read this. My current interpretation is as follows:
  • For some crash reports, the .cab file is not transmitted to the Winqual site by default. Only a short notification about the crash is recorded.
  • Crash reports without .cab data are marked with a .cab icon with a red "x" in it. On the Winqual site, we can request more data for such crash reports. The docs say: "When end-users experience the event, Microsoft will ask to collect minidump data." I guess this means that if another crash of the same type (same bucket) occurs on a customer system, the Winqual server will request the .cab data immediately from them. However, if the same crash never occurs again, we will never see any .cab data.
Is this an adequate interpretation

Apparently, some crash reports have .cab files by default, i.e. without us explicitly requesting those files. What are the criteria for the Winqual server to request .cab data even for the first crash of a new event type



Re: "Cabs requested" icon

Jason Hardester - MSFT

Hi Claus,

Your assumptions are correct. Take a look at my posting into PostID=1426737&SiteID=1 (especially my 3rd point). Although the posting is centered on processing delays, I also explained some of how Cab collection and processing works. Basically we set up collection rules for mapped files, but if an event existed for a new mapping rule the collection status may not get updated right away (or at all in some cases). This is where you would see ¡®no cabs available¡¯ in the system.

We are working to improve this experience in our future service updates to better update existing event rules for data collection based on file mapping.

Kind regards,