How do I find MSFS crash logs in Event Viewer?
On Windows PC, Microsoft Flight Simulator usually records crash evidence in Windows Event Viewer and Reliability Monitor rather than in one simulator crash-log folder. Open the Application log, inspect errors at the exact crash time, then compare the faulting module and exception code across repeated crashes; a single event rarely proves the cause.
This process applies to Microsoft Flight Simulator 2020 and 2024 on PC, including Steam and Microsoft Store installations. The location of the simulator itself does not change where Windows records application crashes.
Where does Microsoft Flight Simulator store crash reports?
Microsoft Flight Simulator does not consistently create one user-facing crash log containing a plain-English explanation. Windows supplies the most useful records through these locations:
- Application event log: Event Viewer displays this under
Windows Logs > Application. Its backing file isC:\Windows\System32\winevt\Logs\Application.evtx, but use Event Viewer rather than opening or modifying that file directly. - Reliability Monitor: Search Windows for
View reliability history. Its daily timeline often presents an MSFS application failure more clearly than Event Viewer. - Windows Error Reporting: Retained reports may appear under
%ProgramData%\Microsoft\Windows\WER\ReportArchiveorReportQueue. Windows can purge these folders, so they may be empty. - Local crash dumps: Binary
.dmpfiles may appear in%LOCALAPPDATA%\CrashDumps, but only when local dump collection has been enabled or requested. Most installations will not have them.
The simulator’s installation and Community folders are normally the wrong places to search. The Developer Mode Console can expose package errors while MSFS is running, but it is not a dependable post-crash record and normally disappears with the simulator.
How do I use Event Viewer to diagnose an MSFS crash?
Event Viewer is most useful when you match its records to an exact crash time and look for the same signature across more than one failure.
- Record the crash time. Note the hour and minute before restarting MSFS. This prevents unrelated Windows errors from being mistaken for the simulator crash.
- Open Event Viewer. Press
Win+R, entereventvwr.msc, and press Enter. - Open the Application log. Expand
Windows Logsand selectApplication. Wait for the event list to finish loading. - Filter the relevant period. Select
Filter Current Log, choose Error and Critical levels, and restrict the time to the last hour or another short period surrounding the crash. - Find the simulator failure. Look for an
Application Errorentry at the crash time where the faulting application is the Microsoft Flight Simulator executable. Event ID1000is common, although Windows does not use it for every failure. - Check the associated WER report. A
Windows Error Reportingevent, commonly ID1001, may follow the application error. These reports can be logged at Information level, so clear or adjust the filter if they are hidden. - Read the event details. Record the faulting application, faulting module and path, exception code, event time, report ID and fault bucket. The Details tab’s XML view can expose fields omitted from the General summary.
- Inspect the System log. Check
Windows Logs > Systemat the same minute for display-driver resets,WHEA-Loggerhardware errors or an unexpected shutdown. These can show that MSFS was the workload when a driver or hardware fault occurred, rather than the original cause.
What should I save from Event Viewer?
Save the matching events and their identifying fields, not the entire Windows log. Right-click an event to copy its details as text, or use Save Selected Events to create an .evtx file.
Keep the paired Application Error and Windows Error Reporting entries where available. Before sharing them, check for Windows usernames or personal folder paths; event records can contain both.
What do the faulting module and exception code mean?
The faulting module shows where Windows detected the failure, while the exception code describes the immediate type of failure. Neither field necessarily identifies what originally caused it.
| Event Viewer clue | What it usually means | Best next test |
|---|---|---|
0xc0000005 | An access violation: the process tried to read, write or execute invalid memory. Add-ons, drivers, application defects and unstable RAM or CPU settings can all produce it. | Reproduce with third-party content disabled and all overclocks or undervolts returned to default. |
0xc0000409 | A fail-fast termination. It describes how Windows stopped the process, not which component initiated the bad state. | Compare repeated events and look for a consistent module or preceding driver error. |
0xe06d7363 | An unhandled Microsoft C++ exception. By itself, it is too broad to identify the responsible package or component. | Test a clean simulator configuration and review events immediately before the crash. |
ntdll.dll, KERNELBASE.dll or ucrtbase.dll | The crash surfaced through a Windows runtime component. This does not prove that the named Windows file is damaged. | Do not download replacement DLL files. Investigate add-ons, drivers, system stability and repeatability instead. |
| A graphics-driver module or nearby display reset | The graphics stack or GPU may have timed out or become unstable. | Remove GPU tuning, test a stable graphics driver and reduce unusually heavy graphics or VRAM settings. |
| The same external module every time | The application, overlay or plug-in owning that module becomes a strong suspect. | Disable or update that component, then repeat the same flight. |
A mistake we see often is treating the module named in one Event ID 1000 entry as a verdict. If the recorded module changes between crashes, system instability, memory corruption or a driver problem is often more plausible than several unrelated DLL failures.
How do I turn the crash record into a diagnosis?
A repeated signature under controlled conditions is far more useful than one isolated event. Recreate the same aircraft, airport and phase of flight, changing only one variable at a time.
- If the crash disappears in Safe Mode or with third-party Community content removed, restore packages in small groups until it returns.
- If one aircraft, airport or livery triggers it consistently, test the same location with a default aircraft and default scenery.
- If crashes occur randomly under heavy load and coincide with display resets or WHEA events, prioritise driver, temperature, power, RAM and overclocking checks.
- If Event Viewer always identifies the same external overlay or injected module, disable that software before reinstalling the simulator.
For the full elimination order, use our MSFS crash-isolation workflow for add-ons, drivers, caches and hardware stability. Reinstalling the entire simulator should come after targeted tests, not before them.
What if Event Viewer shows no MSFS crash?
No Application Error entry usually means the simulator hung, Windows restarted abruptly, or the process failed before Windows generated a normal crash report.
Open Reliability Monitor and select the red failure marker at the relevant time. It may show an application failure, application hang, hardware error or Windows shutdown with a problem signature unavailable in Event Viewer’s filtered view.
If the simulator remains visible but never completes loading, treat it as a loading hang and use these clean-flight checks for add-ons, cache and streaming problems. If MSFS 2020 disappears before reaching its main interface, follow the PC startup checks for platform services, permissions and drivers.
After a hard reset, a Kernel-Power event only confirms that Windows did not shut down cleanly; it does not prove that the power supply caused the crash. A nearby WHEA hardware event or display-driver reset is more diagnostic.
Can I use Event Viewer for MSFS crashes on consoles?
Event Viewer is available only on Windows PC. MSFS 2020 and 2024 on Xbox Series X|S, and MSFS 2024 on PlayStation 5, do not expose Windows application logs to the player.
On consoles, use the platform’s built-in error reporting and diagnose by reproducing the crash with add-ons disabled, a default aircraft, a different airport and less demanding graphics settings where available.