How does Microsoft generate the Event ID for winqual events?

Question

I am curious about the IDs that are used to identify items in winqual.

I assume it is some sort of hash. Is this published?

Hash of the module name, its version and an offset?

That seems appropriate but the size is too small to cover the possibilities unless some truncation/lossy algorithm is used.

This seems to be generated with the minidump on the client machine.

Answer 1

If you're interested in the gory details read Debugging in the (Very) Large: Ten Years of Implementation and Experience (PDF) which was presented by some Microsoft folks at the 2nd ACM Symposium on Operating Systems Principles. The paper goes into a lot of detail about the bucketing process.

It's essentially a hash and it isn't perfect: "The ideal bucketing algorithm should strictly maintain a property of orthogonality: one bug per bucket and one bucket per bug. WER approaches orthogonality through two phases of bucketing."