The short answer
For a first look at a misbehaving PC, open Reliability Monitor — it is already installed and gives you a dated timeline in seconds. For detail, Event Viewer shows everything Windows recorded. Install a third-party tool only for one of three reasons: you want the events explained rather than listed (ErrorAnalyser), you want to read the crash dump behind a blue screen (BlueScreenView, WhoCrashed), or you read logs often enough that navigation speed pays for itself (MyEventViewer, Event Log Explorer).
Disclosure
We make ErrorAnalyser, which is number three on this list. We have written it the way we would want to read it, including the cases where one of the other tools is the better answer — there are several, and they are marked.
The seven tools at a glance
The ordering is by how many people the tool helps, not by how much we like it. The first two cost nothing and are already on your machine.
| Tool | Reads | Best for | Type |
|---|---|---|---|
| 1. Windows Event Viewer | Event log | Seeing everything Windows recorded, with no install | Built into Windows |
| 2. Reliability Monitor | Summary timeline | A 30-second answer to “when did this PC start misbehaving?” | Built into Windows |
| 3. ErrorAnalyser | Event log | Understanding what the entries actually mean | Free · paid AI tier |
| 4. NirSoft MyEventViewer | Event log | A fast, portable viewer with no installation | Free download |
| 5. NirSoft BlueScreenView | Crash dumps | Reading the minidump left behind by a blue screen | Free download |
| 6. WhoCrashed | Crash dumps | A plain-language verdict on which driver crashed you | Free + paid edition |
| 7. Event Log Explorer | Event log | Heavy filtering across many logs and machines | Commercial |
What each tool is actually good at
Each entry below answers the same three questions: what it is, what it is genuinely good at, and where it falls down.
Windows Event Viewer
Built into Windows
The reference implementation. Every event this article talks about comes from here — every other tool is a different front end onto the same data.
Good at: Nothing is missing, nothing is interpreted for you, and it is already installed. Custom Views are genuinely powerful once you build one.
The catch: The entries are written for the developers of whatever failed. Navigation is slow, filters reset, and the descriptions assume you already know what a provider is.
Reliability Monitor
Built into Windows
A timeline of crashes, failed updates and hardware problems, scored per day. Open it with perfmon /rel — it is nearly impossible to find otherwise.
Good at: For a non-technical user this is the best first stop on the entire list. It answers “when did this start?” in one screen, which usually narrows the cause more than any single event does.
The catch: It summarises. Once you know roughly when the trouble began, you still need the event log to find out what happened.
ErrorAnalyser
Ours — free, with a paid AI tier
The same System and Application events, listed and filterable, with an AI explanation of what each one means and what to do about it.
Good at: It closes the gap the other viewers leave open: not “what does the log say” but “what does the log mean, and is it even a problem”.
The catch: Downloading requires a free account, the AI analysis is metered and needs an internet connection, and it does not read crash dumps. If your PC blue-screens, tools 5 and 6 will tell you more than we will.
NirSoft MyEventViewer
Free download
A tiny portable viewer that shows events in a flat, sortable list with no console, no tree and no installation.
Good at: Fast, small, and it runs from a USB stick — the pragmatic choice when you are fixing somebody else’s PC and do not want to install anything.
The catch: It presents; it does not interpret. NirSoft utilities are also flagged by some antivirus engines as a matter of heuristics, which is worth knowing before you are surprised by it.
NirSoft BlueScreenView
Free download
Reads the minidump files Windows writes to C:\Windows\Minidump after a blue screen and lists the stop code plus the drivers on the stack.
Good at: The fastest way to see which driver was involved in a specific crash, and it needs no expertise to run.
The catch: It only works when a dump exists. No blue screen, no dump, nothing to read — and a driver appearing on the stack is not proof that it caused anything.
WhoCrashed
Free edition, paid professional edition
Also a crash-dump reader, but it writes a report in sentences: which driver, which module, what it probably means.
Good at: For blue screens it is the closest thing on this list to a plain-English verdict, and it is what we would tell a friend to run after a BSOD.
The catch: Same limitation as BlueScreenView — dumps only. Check the vendor’s site for current licensing before using it commercially.
Event Log Explorer
Commercial, trial available
A serious power-user viewer: multiple logs in tabs, saved and reusable filters, colour rules, remote machines.
Good at: If you read event logs regularly — as an IT admin rather than as somebody with one broken PC — this is the productivity upgrade over the built-in console.
The catch: It is paid, and it is still raw events. It makes finding the entry faster; it does not tell you what the entry means.
Event log or crash dump? They are different tools
Windows keeps two different records of a failure, and most confusion about these tools comes from mixing them up. The event log records that something happened and what surrounded it. A crash dump is a snapshot of memory at the moment the kernel stopped, and it only exists if the system actually blue-screened.
That is why a dump reader cannot help with a PC that restarts silently — there is no dump — and why an event log viewer cannot name the driver that faulted. If your PC blue-screens, use both: the dump for the culprit, the log for the pattern around it.
Which one to use, by symptom
Pick by what your PC is doing, not by feature count.
| What is happening | Start with |
|---|---|
| Blue screen with a stop code | BlueScreenView or WhoCrashed for the dump, then the System log for context |
| Restarts on its own, no blue screen | The System log — Event ID 41 and what sits next to it |
| One program keeps closing | The Application log, looking for Application Error 1000 at the time it happened |
| Something feels wrong, no clear symptom | Reliability Monitor (perfmon /rel) for a dated timeline |
| Red entries you are worried about, but nothing is broken | Probably nothing — most of them are normal |
| Several machines, or a server | A centralised log manager, not anything on this list |
What about enterprise log managers?
Tools like SolarWinds Log Analyzer and ManageEngine EventLog Analyzer appear at the top of most “Event Viewer alternatives” lists, and for one home PC they are the wrong shape entirely.
They are built to collect logs from many machines into one place, correlate them, alert on thresholds and satisfy audit requirements. That is a real and serious job — it is simply not the job of finding out why your desktop rebooted last Tuesday. If you are reading this because one computer is misbehaving, everything you need is in the seven above, and two of them are already installed.