How it reads
Every rule the report uses, in plain sight.
The reader counts events by the Windows component that wrote them and the event number, then applies the rules below. Nothing is guessed and no score is invented.
What is counted
| Finding | Component and event number |
|---|---|
| Unexpected restarts | Kernel-Power 41 / EventLog 6008 |
| Blue screens (stop errors) | BugCheck 1001 |
| Disk warnings | disk 7, 51, 153 |
| File system damage | Ntfs 55 |
| Fatal hardware reports | WHEA-Logger 18 |
| Corrected hardware reports | WHEA-Logger 17, 19, 47 |
| Graphics driver resets | Display 4101 |
| Failed updates | WindowsUpdateClient 20 |
| Service crashes | Service Control Manager 7031, 7034 |
| Program crashes | Application Error 1000 |
| Program hangs | Application Hang 1002 |
| Starts | EventLog 6005 |
| Clean shutdowns | EventLog 6006 |
| Planned restarts / shutdowns | User32 1074 |
Counting rules
- An unexpected restart is a Kernel-Power 41. Windows often also writes an EventLog 6008 for the same restart; a 6008 within 10 minutes of a 41 is not counted twice. A 6008 alone counts as one.
- A blue screen is a BugCheck 1001 in the System log; its stop code is read from the text "The bugcheck was: 0x..." and written as eight hex digits. The Application log's Windows Error Reporting 1001 (a different component) is not counted.
- Disk warnings are disk 7 (bad block), disk 51 (error during a paging operation) and disk 153 (a read or write was retried). Bad blocks and paging errors count as disk errors; a retried read or write on its own counts toward Watch, not Act now. The report names the disk number from each message (Disk 0 is usually the Windows drive; USB sticks and card readers get higher numbers). File system damage is Ntfs 55.
- Per week = count × 7 ÷ days in the period (first to last event).
- Dates like 03/04/2026 are read month-first, unless a date in the same file proves day-first (a first number above 12).
Verdict rules
Act now when any of: any fatal hardware report (WHEA-Logger 18); any disk error (disk 7 bad block, disk 51 paging error) or file system damage (Ntfs 55); 2 or more blue screens.
Watch when none of those, and any of: 1 blue screen; any retried disk read or write (disk 153); 3 or more unexpected restarts; 3 or more graphics driver resets; 5 or more corrected hardware reports; 2 or more failed updates.
Steady otherwise.
What is kept
Nothing, unless you press Save. Then only the summary: counts per day, stop codes, update numbers with error codes, and service and program names (each list capped at 12). Event messages, user names, file paths and the computer's name are never stored.