overview of memory dump file options for windows

Upload: abdu

Post on 06-Jul-2018

217 views

Category:

Documents


0 download

TRANSCRIPT

  • 8/16/2019 Overview of Memory Dump File Options for Windows

    1/9

    0 Sign in

    Support for Windows XP has endedMicrosoft ended support for Windows XP on April 8, 2014. This change has affected your

    software updates and security options. Learn what this means for you and how to stay

    protected.

    Support for Windows Server 2003 ended on

    July 14, 2015Microsoft ended support for Windows Server 2003 on July 14, 2015. This change has affected

    your software updates and security options. Learn what this means for you and how to stay

    protected.

    Summary

    You can configure the following operating systems to write debugging information:

    Windows 2000

    Windows XP

    Windows Server 2003

    Windows Vista

    Windows Server 2008

    Windows 7

    Windows Server 2008 R2

     

    Overview of memory dump file options for Windows

    https://www.microsoft.com/en-us/server-cloud/products/windows-server-2003/https://www.microsoft.com/en-us/server-cloud/products/windows-server-2003/http://windows.microsoft.com/en-us/eoshttps://www.microsoft.com/https://www.microsoft.com/en-us/server-cloud/products/windows-server-2003/http://windows.microsoft.com/en-us/eoshttps://www.microsoftstore.com/store/msusa/en_US/DisplayThreePgCheckoutShoppingCartPagehttps://www.microsoft.com/

  • 8/16/2019 Overview of Memory Dump File Options for Windows

    2/9

    Windows 8

    Windows Server 2012

    Windows 8.1

    Windows Server 2012 R2

    The debugging information can be written to different file formats also known as memory dump

    files 

    when your computer stops unexpectedly because of a Stop error also known as a "blue

    screen," system crash, or bug check 

    . You can also configure Windows not to write debugging

    information to a memory dump file.

    Windows can generate any one of the following memory dump file types:

    Complete memory dump

    Kernel memory dump

    Small memory dump 64 KB 

    Automatic memory dump

    More information

    Complete memory dump

    A complete memory dump records all the contents of system memory when your computer stops

    unexpectedly. A complete memory dump may contain data from processes that were running

    when the memory dump was collected.

    If you select the Complete memory dump option, you must have a paging file on the boot

    volume that is sufficient to hold all the physical RAM plus 1 megabyte MB .

    If a second problem occurs and another complete memory dump or kernel memory dump 

    file is

    created, the previous file is overwritten.

    Notes

    In Windows Vista, in Windows 7, in Windows Server 2008, and in Windows Server 2008 R2,

    the paging file can be on a partition that differs from the partition on which the operating

    system is installed.

    In Windows Vista and in Windows Server 2008, to put a paging file on another partition,

    you must create a new registry entry that is named DedicatedDumpFile. You can define the

    size of the paging file by using a new registry entry that is named DumpFileSize.

     

    https://msdn.microsoft.com/en-us/library/windows/hardware/dn383663(v=vs.85).aspx

  • 8/16/2019 Overview of Memory Dump File Options for Windows

    3/9

    For more information about how to do this, visit the following Microsoft Web site:

    969028 How to generate a kernel or a complete memory dump file in Windows Server

    2008

    In Windows 7 and in Windows Server 2008 R2, you do not have to use the

    DedicatedDumpFile registry entry to put a paging file onto another partition.

    The Complete memory dump option is not available on computers that are running a 32‐bit operating system and that have 2 gigabytes GB

     

    or more of RAM. For more information,

    see the "Specify what happens when the system stops unexpectedly" topic on the following

    Microsoft TechNet Web site:

    http://technet.microsoft.com/en‐us/library/cc778968 WS.10 .aspx

    Kernel memory dump

    A kernel memory dump records only the kernel memory. This speeds up the process of recordinginformation in a log when your computer stops unexpectedly. You must have a pagefile large

    enough to accommodate your kernel memory. For 32‐bit systems, kernel memory is usually

    between150MB and 2GB. Additionally, on Windows 2003 and Windows XP, the page file must be

    on the boot volume. Otherwise, a memory dump cannot be created.

    This dump file does not include unallocated memory or any memory that is allocated to User‐

    mode programs. It includes only memory that is allocated to the kernel and hardware abstraction

    layer HAL 

    in Windows 2000 and later, and memory allocated to Kernel‐mode drivers and other

    Kernel‐mode programs. For most purposes, this dump file is the most useful. It is significantly

    smaller than the complete memory dump file, but it omits only those parts of memory that areunlikely to have been involved in the problem.

    If a second problem occurs and another kernel memory dump file or a complete memory dump

    file  is created, the previous file is overwritten when the 'Overwrite any existing file' setting is

    checked.

    Small memory dump

    A small memory dump records the smallest set of useful information that may help identify whyyour computer stopped unexpectedly. This option requires a paging file of at least 2 MB on the

    boot volume and specifies that Windows 2000 and later create a new file every time your

    computer stops unexpectedly. A history of these files is stored in a folder.

    This dump file type includes the following information:

    The Stop message and its parameters and other data

    A list of loaded drivers

    The processor context PRCB  for the processor that stopped

    The process information and kernel context EPROCESS 

    for the process that stopped

     

    http://technet.microsoft.com/en-us/library/cc778968(WS.10).aspxhttp://support.microsoft.com/kb/969028

  • 8/16/2019 Overview of Memory Dump File Options for Windows

    4/9

  • 8/16/2019 Overview of Memory Dump File Options for Windows

    5/9

    Definitions

    Boot volume: The volume that contains the Windows operating system and its support files.

    The boot volume can be, but does not have to be, the same as the system volume.

    System volume: The volume that contains the hardware‐specific files that you must have to

    load Windows. The system volume can be, but does not have to be, the same as the boot

    volume. The Boot.ini, Ntdetect.com, and Ntbootdd.sys files are examples of files that arelocated on the system volume.

    Registry values for startup and recovery

    The following registry value is used:

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl

    CrashDumpEnabled REG_DWORD 0x0 = NoneCrashDumpEnabled REG_DWORD 0x1 = Complete memory dump

    CrashDumpEnabled REG_DWORD 0x2 = Kernel memory dump

    CrashDumpEnabled REG_DWORD 0x3 = Small memory dump 64KB 

    CrashDumpEnabled REG_DWORD 0x7 = Automatic memory dump 

    Additional registry values for CrashControl:

    0x0 = Disabled

    0x1 = Enabled

    AutoReboot REG_DWORD 0x1

    DumpFile REG_EXPAND_SZ %SystemRoot%\Memory.dmp

    LogEvent REG_DWORD 0x1

    MinidumpDir REG_EXPAND_SZ %SystemRoot%\Minidump

    Overwrite REG_DWORD 0x1

    SendAlert REG_DWORD 0x1

    NOTE: You must restart Windows in order for your changes to take affect.

    Test to make sure that a dump file can be created

    For more information about how to configure your computer to generate a dump file for testing

    purposes, click the following article number to view the article in the Microsoft Knowledge Base:

    244139 Windows feature lets you generate a memory dump file by using the keyboard

    Default dump type options

    Windows 2000 Professional: Small memory dump 64 KB 

    https://support.microsoft.com/en-us/kb/244139https://msdn.microsoft.com/en-us/library/windows/hardware/dn383663(v=vs.85).aspx

  • 8/16/2019 Overview of Memory Dump File Options for Windows

    6/9

    Windows 2000 Server: Complete memory dump

    Windows 2000 Advanced Server: Complete memory dump

    Windows XP Professional and Home Edition 

    : Small memory dump 64 KB 

    Windows Server 2003 All Editions : Complete memory dump

    Windows Vista All Editions 

    : Kernel memory dump

    Windows Server 2008 All Editions 

    : Kernel memory dump

    Windows 7 All Editions : Kernel memory dump

    Windows Server 2008 R2 All Editions 

    : Kernel memory dump

    Windows 8 and 8.1 All Editions 

    : Automatic memory dump

    Windows Server 2012 and 2012 R2 All Editions : Automatic memory.dmp

    Maximum paging file size

    Maximum paging file size is limited as follows:

    x86 x64 IA‐64

    Maximum size of a paging file 4 gigabytes non‐

    PAE 

    16 terabytes PAE 

    16 terabytes 32 terabytes

    Maximum number of paging

    files

    16 16 16

    Total paging file size 64 gigabytes non‐

    PAE 

    256 terabytes PAE 

    256

    terabytes

    512

    terabytes

    Technical support for x64‐based versions of Microsoft Windows

    Your hardware manufacturer provides technical support and assistance for x64‐based versions of Windows. Your hardware manufacturer provides support because an x64‐based version of 

    Windows was included with your hardware. Your hardware manufacturer might have customized

    the installation of Windows with unique components. Unique components might include specific

     

  • 8/16/2019 Overview of Memory Dump File Options for Windows

    7/9

    device drivers or might include optional settings to maximize the performance of the hardware.

    Microsoft will provide reasonable‐effort assistance if you need technical help with your x64‐based

    version of Windows. However, you might have to contact your manufacturer directly. Your

    manufacturer is best qualified to support the software that your manufacturer installed on the

    hardware.

    For product information about Microsoft Windows XP Professional x64 Edition, visit the following

    Microsoft Web site:http://www.microsoft.com/windowsxp/64bit/default.mspx

    For product information about x64‐based versions of Microsoft Windows Server 2003, visit the

    following Microsoft Web site:

    http://www.microsoft.com/windowsserver2003/64bit/x64/editions.mspx

    Properties

    Article ID: 254649 ‐ Last Review: 01/04/2016 18:19:00 ‐ Revision: 26.0

    Applies to

    Microsoft Windows Server 2003, Standard x64 Edition

    Microsoft Windows Server 2003, Datacenter x64 Edition

    Microsoft Windows Server 2003, Enterprise x64 Edition

    Microsoft Windows Server 2003, Datacenter Edition for Itanium‐Based Systems

    Microsoft Windows Server 2003, Enterprise Edition for Itanium‐based Systems

    Microsoft Windows Server 2003, Standard Edition 32‐bit x86 

    Microsoft Windows Server 2003, Datacenter Edition 32‐bit x86 

    Microsoft Windows Server 2003, Enterprise Edition 32‐bit x86 

    Microsoft Windows Server 2003, Web Edition

    Microsoft Windows XP Professional x64 Edition

    Microsoft Windows XP Professional

    Microsoft Windows XP Home Edition

    Microsoft Windows XP Media Center Edition 2005 Update Rollup 2

     

    http://www.microsoft.com/windowsserver2003/64bit/x64/editions.mspxhttp://www.microsoft.com/windowsxp/64bit/default.mspx

  • 8/16/2019 Overview of Memory Dump File Options for Windows

    8/9

    Microsoft Windows XP Tablet PC Edition

    Microsoft Windows 2000 Server

    Microsoft Windows 2000 Advanced Server

    Microsoft Windows 2000 Professional Edition

    Windows Server 2008 for Itanium‐Based Systems

    Windows Server 2008 Datacenter

    Windows Server 2008 Enterprise

    Windows Server 2008 Standard

    Windows Web Server 2008

    Windows Vista Business

    Windows Vista Enterprise

    Windows Vista Home Basic

    Windows Vista Home Premium

    Windows Vista Ultimate

    Windows Server 2008 Datacenter without Hyper‐V

    Windows Server 2008 Enterprise without Hyper‐V

    Windows Server 2008 Foundation

    Windows Server 2008 R2 Datacenter

    Windows Server 2008 R2 Enterprise

    Windows Server 2008 R2 Standard

    Windows Web Server 2008 R2

    Windows 7 Home Basic

    Windows 7 Home Premium

    Windows 7 Professional

    Windows 7 Service Pack 1

     

  • 8/16/2019 Overview of Memory Dump File Options for Windows

    9/9

    English United States 

    Terms of use  Privacy & cookies  Trademarks  © 2016 Microsoft

    Windows 7 Starter

    Windows 7 Ultimate

    Windows 7 Enterprise

    Keywords:

    kbenv kbinfo KB254649

    Support

    Security

    Contact Us

    https://support.microsoft.com/https://support.microsoft.com/https://support.microsoft.com/http://www.microsoft.com/trademarkshttp://go.microsoft.com/fwlink/?LinkID=521839http://go.microsoft.com/fwlink/?LinkID=206977