How to Use Windows Reliability Monitor to Find What Actually Broke

Reliability Monitor shows crashes and installs on one timeline, so cause and effect is obvious. How to open it, read it, and where it stops being useful.

windows reliability monitor guide

When someone says “it’s been crashing since last week”, the useful question is what changed. Event Viewer will tell you, eventually, if you know which of its thousands of entries to care about. Reliability Monitor answers the same question in about fifteen seconds, on a timeline, and almost nobody opens it.

It has shipped with Windows since Vista. It’s still there in Windows 11. Here’s how to use it properly, and where its limits are.

Quick Facts

  • Open it fastest by running perfmon /rel — it isn’t in the Start menu under an obvious name.
  • It shows crashes, failed updates and software installs on a single timeline, which is what makes cause and effect obvious.
  • The stability index runs 1 to 10 and is only useful as a trend — the absolute number means little.
  • It keeps roughly a year of history, far longer than most people assume.
  • It’s a triage tool, not a diagnostic one. It tells you when and what; Event Viewer tells you why.

Opening it

Press Win+R and run perfmon /rel. That’s the reliable route. You can also search “reliability” in the Start menu and pick “View reliability history”, but the name has moved around between Windows versions and the search doesn’t always surface it.

Remotely, it’s a Performance Monitor snap-in, so you can point it at another machine — or just pull the same underlying data with PowerShell, which is usually quicker across several servers:

Get-CimInstance -ClassName Win32_ReliabilityRecords -ComputerName SERVER01 |
    Select-Object -First 20 TimeGenerated, SourceName, Message |
    Format-List

Reading the timeline

The chart is days across the bottom and a stability score from 1 to 10 up the side. Below it, five rows of icons.

RowWhat lands there
Application failuresA program crashed or stopped responding
Windows failuresBlue screens and boot failures — the serious row
Miscellaneous failuresUnexpected shutdowns, usually power loss or a hard reset
WarningsSomething failed but recovered, e.g. an update that rolled back
InformationSuccessful installs and updates — the row that tells you what changed

The Information row is the one people skip, and it’s the most useful. A driver installing on the 14th and blue screens starting on the 14th is the whole investigation, visible at a glance. That correlation is what Reliability Monitor gives you that Event Viewer doesn’t.

A method that works

Quick Steps

  1. Switch the view to Weeks first. It’s easier to spot where the line dropped than to scan day by day.
  2. Find where stability fell and stayed down — that’s your date, not the first isolated blip.
  3. Switch back to Days and go to that date.
  4. Look at the Information row on and just before that date. What installed or updated?
  5. Click the failure entries and choose “View technical details” for the fault module and exception code.
  6. Take that fault module name into Event Viewer for the full picture.

Step 2 is where judgement comes in. One bad day is noise. A line that drops on a Tuesday and never recovers is a change that stuck.

What the technical details actually tell you

Clicking through to technical details on an application crash gives you a few fields worth understanding:

  • Faulting application name — what crashed. Often not the culprit.
  • Faulting module name — the DLL that actually threw. This is the useful one. If it’s a third-party DLL rather than a Windows one, you’ve found your suspect.
  • Exception code0xc0000005 is an access violation (usually a bad pointer, often a driver), 0xc0000374 is heap corruption.

A faulting module belonging to a graphics driver, an antivirus product or a VPN client explains a very large share of “random” application crashes.

Where it falls short

Being straight about the limits, because it’s a triage tool and treating it as more than that wastes time:

  • It won’t catch hangs that ended in a hard power-off — nothing got logged.
  • The stability index is arbitrary. Comparing scores between two machines tells you nothing.
  • Hardware faults often appear as software crashes. Failing RAM shows up as apparently random application failures across unrelated programs — a pattern worth recognising.
  • A reimaged machine starts fresh, so no history doesn’t mean no problems.

Glossary

TermWhat it means
Stability indexA 1–10 rolling score calculated from failures over time. Useful as a trend only.
Faulting moduleThe specific DLL where a crash occurred — usually more informative than the application name.
0xc0000005Access violation. Code tried to read or write memory it shouldn’t.
WERWindows Error Reporting, the subsystem that captures crash data.
perfmon /relThe command that opens Reliability Monitor directly.

Frequently asked questions

How far back does Reliability Monitor go?

Around a year on a typical machine, though it depends on how much has been logged. That’s considerably more history than most people expect, and it makes it genuinely useful for “this started months ago” reports.

Is Reliability Monitor the same as Event Viewer?

No. They read overlapping data, but Reliability Monitor presents a filtered subset on a timeline. Event Viewer has everything and no correlation. Use Reliability Monitor to find the date, then Event Viewer to find the detail.

My stability index is 1 out of 10. Is that bad?

Not necessarily. The index is heavily weighted towards recent events, so a single crash on a machine with little history can drop it dramatically. Look at the shape of the line over weeks, not today’s number.

Can I check Reliability Monitor on a remote machine?

Yes. It’s a Performance Monitor snap-in so it supports connecting to another computer, though it can be slow. Querying Win32_ReliabilityRecords with PowerShell is usually faster, especially across several machines at once.

🛠️

Gear We Recommend

Chasing an intermittent fault? These are the diagnostic bits we keep on the bench.

Browse our General Tech Accessories picks on Amazon

As an Amazon Associate, TechyGeeksHome earns from qualifying purchases

Disclosure: this post may contain affiliate links. If you buy through one of them, we may earn a small commission at no extra cost to you. We only recommend products we’ve tested or genuinely rate.


Discover more from TechyGeeksHome

Subscribe to get the latest posts sent to your email.

Andrew Armstrong

Andrew Armstrong is a UK-based IT professional with 26+ years of hands-on experience in Windows, Windows Server, SCCM/ConfigMgr, Active Directory, PowerShell, and enterprise infrastructure.

He founded TechyGeeksHome in 2010 and has published over 1,500 practical guides covering real-world IT problems and solutions. When not solving IT problems,

Andrew develops free Windows utilities including Ultimate Settings Panel, which has been downloaded over 850,000 times.

Leave a Reply

Your email address will not be published. Required fields are marked *