how to work out which process crashed a server

Hi,

We have a VMware virtual machine running Windows 2003 Terminal Server.  Users connect to this and run apps like Office 2007, finance software, HR software, and then some - has a variety of software on it.

The problem we are having is that the server is crashing pretty much daily, but there is nothing in the event logs to help pinpoint the application that's causing the issue.  The first we see is the good old "The last shutdown at ..... was unexpected" and the dump isn't much good either.

performance monitoring in vSphere shows a spike in CPU and memory as well as disk reads when this happens.  Looks like an application is doing something and then looses it before the server decides to restart itself - just a little hard to pinpoint which app.

I think that there is about 30 seconds where the server is still functioning before it restarts and I was hoping there maybe some sort of Perfmon counter that I can add to monitor resource utilisation of running processes.  With so much different software running on this server it would be great if I could identify which bit of software is having the problem.

Hoping someone might be able to advise on what I can monitor to better help narrow down which app needs attention.

Thanks,