When your VPS suddenly reboots, your trading platform freezes or closes, or a background service stops working, the first question is what actually crashed. The whole VPS? Just one app? A service running in the background? Our diagnostic tool reads the Windows event logs and tells you in about 30 seconds.
Run the tool
#1. Download QuantVPS-CrashDiagnostic.zip on your VPS.
#2. Double-click the zip → And then Double-click the QuantVPS-CrashDiagnostic
#3. The scan runs, then two windows open automatically:
Your browser, showing the HTML report (verdict + table of crash events).
Event Viewer, pre-navigated to Custom Views → QuantVPS Crash & Stability Issues so you can browse the live event log.
Don't click anywhere else for the first few seconds — the script needs focus to navigate Event Viewer to the right view. If something steals focus, you'll just see Event Viewer at its default state; just click Custom Views → QuantVPS Crash & Stability Issues in the left pane manually.
The tool scans the last 2 weeks of Windows event logs and writes the report to your Desktop. The custom view it installs is permanent, so you can browse crash events any time without re-running the tool. No internet access required, nothing uploaded.
Reading the report
The report opens with a colored verdict at the top:
Verdict | What it means | What to do |
No crash events detected(green) | The VPS, services, and applications were stable in the scan window. | If you still saw a problem, run the network diagnostic next — disconnects can look like crashes. |
N application or service events detected (amber) | An app or background service crashed, but the VPS itself stayed up. | Check the table for which app/service. Usually fixed by reinstalling or updating that specific software. |
N critical system events detected (red) | The VPS bluescreened, rebooted unexpectedly, or hit a hardware error. | Open a support ticket — we can investigate from our side. |
Below the verdict the report shows an info panel pointing you back to the live Event Viewer custom view, then a stats row, then a table of every matching event with timestamp, severity, source, and the original Windows error message.
The report also includes info-level events for context — Windows Update installs and planned reboots. These don't trigger amber or red verdicts, but they show up in the table so you can tell if a "weird reboot" was actually just Windows applying patches. If the tool sees an unexpected reboot (Event 41) within 10 minutes of a Windows Update restart (Event 22), it automatically reclassifies the reboot as planned instead of treating it as a crash.
Match it against what you saw
Different symptoms usually map to different log entries. Find the row that matches your experience:
What you saw | Most likely event(s) |
Whole VPS went offline / RDP session died / had to reconnect | Event 41 (unexpected reboot), 1001 (BSOD stop code), or 6008 (previous shutdown was unexpected) |
VPS rebooted overnight / during a maintenance window | Event 22 (Windows Update restart), often with Event 19 nearby (KB number installed). The tool will tag this as planned, not a crash. |
Trading platform suddenly closed or stopped responding | Event 1000 (application crashed) or 1002 (application hung) for that app |
Background service stopped working | Event 7031 / 7034 (Service Control Manager) |
VPS got slow, sluggish, or hung but didn't reboot | WHEA-Logger events (17–47) — hardware errors |
Got a "blue screen" or saw a stop code | Event 1001 with a BugCheck code, paired with 41 at the same time |
If the report shows none of these during the time you saw a problem, the VPS itself was stable — the issue was almost certainly a network or broker disconnect, not a crash. Run the network diagnostic instead.
Contact support
Open a ticket and attach:
The HTML report (
QuantVPS-CrashDiagnostic-YYYY-MM-DD_HHMM.htmlfrom your Desktop).The exact time(s) you saw the problem, in the same time zone as the report (e.g. "9:42 AM ET on May 3").
A description of what you saw: did the whole VPS reboot? Did just your trading app close? Did RDP drop? Did anything appear on screen before it happened?
Screenshots if you have them — error dialogs, BSOD photos from your phone, broker disconnect notices from around the same time.
For system-level crashes (red verdict), we can usually identify the cause from the bugcheck stop code or WHEA event details — please always send the report.
For application crashes (amber verdict), the report tells you exactly which app and module faulted (e.g. ntdll.dll, clr.dll, the broker's main executable). That information is usually enough for the app's vendor to identify the bug. We're happy to help interpret it.
Scanning a different time window
The tool defaults to the last 2 weeks. To use a different window, open Command Prompt as administrator in the folder where you saved the file and run:
QuantVPS-CrashDiagnostic.bat -HoursBack 720
Common values: 24 = last day, 168 = last week, 336 = last 2 weeks (default), 720 = last 30 days.
Event ID reference
For anyone who wants to investigate specific events directly in Event Viewer, here's what the tool scans for:
Event ID(s) | Log | Source | What it tells you |
41 | System | Microsoft-Windows-Kernel-Power | The system did not shut down cleanly. Often a BSOD, hard power-off, or kernel panic. |
1001 | System | Microsoft-Windows-WER-SystemErrorReporting | Bugcheck (BSOD) — includes the stop code and parameters. |
1003 | System | System | Older bugcheck format on legacy Windows. |
6008 | System | EventLog | "The previous system shutdown at X was unexpected." |
17–20, 46, 47 | System | Microsoft-Windows-WHEA-Logger | Hardware errors (memory, CPU, PCIe). 17–18 are corrected; 47 is a fatal PCIe error. |
7031 / 7034 | System | Service Control Manager | A Windows service terminated unexpectedly. |
7026 | System | Service Control Manager | A boot-required driver failed to load. |
1000 | Application | Application Error | A user-mode application faulted. Includes the faulting module and offset. |
1002 | Application | Application Hang | An application stopped responding. |
1026 | Application | .NET Runtime | A managed (.NET) application threw an unhandled exception. |
19 | System | Microsoft-Windows-WindowsUpdateClient | Windows Update installed successfully (KB number in event details). info |
20 | System | Microsoft-Windows-WindowsUpdateClient | Windows Update installation failed. medium |
22 | System | Microsoft-Windows-WindowsUpdateClient | Restart initiated to complete a Windows Update. info |
109 | System | Microsoft-Windows-Kernel-General | OS-initiated shutdown (Windows Update or admin-triggered). info |
A few worth knowing:
Event 41 + Event 1001 at almost the same timestamp is the classic BSOD signature. 41 is logged after the reboot, and 1001 records the stop code from memory.
Event 41 + Event 22 within 10 minutes is a Windows Update reboot, not a crash. The tool detects this pairing and reclassifies the 41 from "unexpected reboot" to "planned reboot for Windows Update" automatically.
Event 6008 alone (without a 41 / 1001 pair) usually means the VPS lost power without a chance to log a bugcheck — most often a host-level event we should look at.
WHEA Event 47 with
PCI Express Root Porttext is a fatal PCIe error and worth opening a ticket about immediately.Event 1000 in the Application log includes the faulting module name (e.g.
kernel32.dll,ntdll.dll,clr.dll, or your trading app's own DLL) — that's usually where a vendor will start their investigation.