Windows Event ID 22 – Application Error: Application Hang Detection

Start by examining the specific Event ID 22 entries to identify the problematic application and hang patterns.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Application
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 22 in the Event IDs field and click OK
5. Review recent Event ID 22 entries, noting the application name, process ID, and hang duration
6. Look for patterns such as specific applications hanging repeatedly or hangs occurring at particular times

Use PowerShell to query hang events programmatically:

Get-WinEvent -FilterHashtable @{LogName='Application'; Id=22} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -Wrap

Use Task Manager and Performance Monitor to identify resource constraints causing application hangs.

1. Open Task Manager by pressing Ctrl + Shift + Esc
2. Click the Processes tab and sort by CPU usage to identify high-usage applications
3. Monitor the Memory column to check for applications consuming excessive RAM
4. Switch to the Performance tab to view overall system resource utilization
5. If memory usage is consistently above 80%, consider adding RAM or closing unnecessary applications
6. Use Resource Monitor (accessible from Task Manager's Performance tab) for detailed I/O analysis

Create a PowerShell script to monitor problematic processes:

# Monitor specific application performance
$ProcessName = "YourAppName"
while ($true) {
    $Process = Get-Process -Name $ProcessName -ErrorAction SilentlyContinue
    if ($Process) {
        $CPUTime = $Process.CPU
        $Memory = [math]::Round($Process.WorkingSet64/1MB, 2)
        Write-Host "$(Get-Date): CPU: $CPUTime, Memory: ${Memory}MB"
    }
    Start-Sleep -Seconds 5
}

Adjust Windows hang detection timeouts to reduce false positives or increase sensitivity based on your environment needs.

1. Open Registry Editor by pressing Win + R, typing regedit, and pressing Enter
2. Navigate to HKEY_CURRENT_USER\Control Panel\Desktop
3. Look for or create the following DWORD values:
• HungAppTimeout - Time in milliseconds before considering an app hung (default: 5000)
• WaitToKillAppTimeout - Time to wait before force-closing hung apps (default: 20000)
4. Double-click each value to modify the timeout periods
5. Restart the affected applications or log off and back on for changes to take effect

Use PowerShell to check current timeout settings:

# Check current hang timeout settings
$DesktopKey = "HKCU:\Control Panel\Desktop"
Get-ItemProperty -Path $DesktopKey -Name "HungAppTimeout", "WaitToKillAppTimeout" -ErrorAction SilentlyContinue

Set timeouts programmatically:

# Increase hang timeout to 10 seconds
Set-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name "HungAppTimeout" -Value 10000 -Type DWord
# Increase kill timeout to 30 seconds
Set-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name "WaitToKillAppTimeout" -Value 30000 -Type DWord

Generate and analyze memory dumps of hanging applications to identify root causes.

1. Enable automatic dump collection by navigating to Control Panel → System and Security → System → Advanced system settings
2. Click Settings under Startup and Recovery
3. Ensure Write debugging information is set to Small memory dump or Kernel memory dump
4. Configure Windows Error Reporting to collect hang dumps:
• Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps
• Create a new key named after your problematic application (e.g., "notepad.exe")
• Add DWORD values: DumpType (2 for full dump), DumpCount (10), DumpFolder (REG_EXPAND_SZ pointing to dump location)

Use PowerShell to configure dump collection:

# Configure dump collection for a specific application
$AppName = "problematic-app.exe"
$DumpPath = "HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\$AppName"
New-Item -Path $DumpPath -Force
Set-ItemProperty -Path $DumpPath -Name "DumpType" -Value 2 -Type DWord
Set-ItemProperty -Path $DumpPath -Name "DumpCount" -Value 10 -Type DWord
Set-ItemProperty -Path $DumpPath -Name "DumpFolder" -Value "C:\CrashDumps" -Type ExpandString

Manually create a dump of a hanging process:

# Create dump using ProcDump (SysInternals tool)
procdump.exe -ma -h notepad.exe C:\dumps\notepad_hang.dmp

Set up automated monitoring to detect and respond to application hang patterns before they impact users.

1. Create a PowerShell script to monitor Event ID 22 occurrences and send alerts:

# Hang monitoring script
param(
    [int]$ThresholdMinutes = 60,
    [int]$MaxHangs = 5,
    [string]$EmailTo = "admin@company.com",
    [string]$SMTPServer = "mail.company.com"
)

$StartTime = (Get-Date).AddMinutes(-$ThresholdMinutes)
$HangEvents = Get-WinEvent -FilterHashtable @{
    LogName='Application'
    Id=22
    StartTime=$StartTime
} -ErrorAction SilentlyContinue

if ($HangEvents.Count -ge $MaxHangs) {
    $Subject = "Alert: $($HangEvents.Count) application hangs detected on $env:COMPUTERNAME"
    $Body = $HangEvents | Select-Object TimeCreated, Message | ConvertTo-Html | Out-String
    Send-MailMessage -To $EmailTo -Subject $Subject -Body $Body -SmtpServer $SMTPServer -BodyAsHtml
}

2. Schedule the script using Task Scheduler:
• Open Task Scheduler and create a new task
• Set trigger to run every 30 minutes
• Configure action to run PowerShell with your monitoring script
3. Use Windows Performance Toolkit (WPT) for advanced hang analysis:

# Install WPT and create custom hang detection
wpa.exe -i hang_trace.etl -profile hang_analysis.wpaProfile

Create a custom Event Log view for hang tracking:

<QueryList>
  <Query Id="0" Path="Application">
    <Select Path="Application">*[System[(EventID=22) and TimeCreated[timediff(@SystemTime) &lt;= 86400000]]]</Select>
  </Query>
</QueryList>