Error Reporting Web Service


The Error Reporting Web Service is the client facing collection component within the over-all ETD collector. It only apply rules to clients and collects the logs and cabs. There are no analytical features in the Error Reporting Web Service.

The Error Reporting Web Service (ERWS) implements the Corporate Error Reporting V.2 (MS-CER2) protocol as documented on the public MSDN site. The

ERWS has two functions:

The ERWS manages and responds to the clients’ error report level 1 message and responds with a level 1 server response with these entries:

  • BucketId
  • BucketTableId
  • Data
  • DumpFile
  • Doc
  • MemoryDump
  • RegKeyValues
  • RegTreeValues
  • GetFile
  • Wql
  • GetFileVersion

The ERWS stores the logs and cabs forwarded from the clients’ error reports.


  • Windows Server 2012 R2 with IIS installed.
  • Microsoft .Net Framework 4.5 or higher
  • PowerShell 4.0 or higher
  • KB2919355


The ERWS interacts with the WER client using the CER v.2 protocol and associated tokens. The clients’ level 1 messages and cabs are stored as files. The ERWS running under IIS takes on the role of the CER server from the following diagram:

The CER client and CER server error report exchange

Figure 1 – The CER client and CER server error report exchange.