Question

A service we have is occasionally crashing on a test PC.

We are getting some information in the Event Log, a “.NET Runtime 2.0 Error” with some details.

I’ve determined that P1 is the executable, P2 is the version, P5 is the .NET Runtime, but what are the rest of the fields (P1-P10)?

Answer 1

These details are Watson buckets, that are used to group crash reports that get sent back to Microsoft. Some more details are in the MSDN article Unhandled Exception Processing In The CLR. From that article:

[T]he CLR will collect the managed
bucket details pertaining to the
unhandled exception and write them to
the event log (under the Application
Log)…

Bucketing is the process that groups
crashes of applications based upon the
point of crash. In case of unhandled
managed exceptions, it is based upon
nine details that the CLR collects
pertaining to the managed exception
that went unhandled. These are
collectively known as the Watson
buckets, and in the context of managed
code they include details such as the
name of the module that was
responsible for the crash, the
intermediate language (IL) offset at
which the crash happened, and the
MethodDef of the method in which the
crash happened