Thread: How to generate a kernel or a complete memory dump

How to generate a kernel or a complete memory dump file in Windows Server 2008

INTRODUCTION

This explains how to generate, collect, verify, and examine kernel and complete memory dump files from a Windows Server 2008-based system.

MORE INFORMATION

Paging file
Generally, for regular functionality of Windows Server 2008-based PC, you would place the paging file size on server. Based on what type of memory dump file that you are attempting to gather, minimum size of paging file will be different. Windows Server 2008 has three choices for memory dump files:
• Small Memory Dump (64 KB for a 32-bit operating system, 128 KB for a 64-bit operating system)
• Kernel Memory Dump
• Complete Memory Dump
Step 1: Create a paging file
1. Click Start, right-click Computer, and then click Properties.
2. Click Advanced system settings on the System page, and then click the Advanced tab.
3. Click Settings under the Performance area.
4. Click the Advanced tab, and then click Change under the Virtual memory area.
5. Choose the system partition where the operating system is installed.
6. Set the value of Initial size and Maximum size to the amount of physical RAM that is installed plus 1 megabyte (MB) under the Custom Size button.
7. Click Set, and then click OK three times.
Partition size
In Windows Server 2003 or previous versions of Windows, the partition on which operating system is installed must be no less than the size of RAM fixed plus 1 megabyte (MB). For Windows Server 2008, you should decrease the physical memory of PC to create a valid finish of memory dump file. If PC has more than 4 GB of physical memory or if there is not sufficient disk space for paging file on the partition on which the operating system is installed, you must decrease the physical RAM of PC.
On a 32-bit version of Windows Server 2008 that has Physical Address Extension (PAE) enabled, the paging file can extend beyond 4 GB (4,096 MB) in size. To check if PAE is enabled, follow the steps given below:
a. Click Start, click Run, type Regedit, and then click OK.
b. Find the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\Session Manager\Memory Management
c. Right-click PhysicalAddressExtension, and then click Modify.
d. In the Edit DWORD Value dialog box, check the value of the PhysicalAddressExtension entry. If the value of the PhysicalAddressExtension entry is zero (0), PAE is stopped. If the value of the PhysicalAddressExtension entry is 1, PAE is enabled.
New behavior in Windows Vista and Windows Server 2008
In Windows Vista and Server 2008, paging file should be not on similar partition on which operating system is installed. To set a paging file on other partition, you should make a new registry entry named DedicatedDumpFile. You can also state size of the paging file by using a new registry entry that is called DumpFileSize. To make DedicatedDumpFile and DumpFileSize registry entries, follow the steps given below:
a. Click Start, click Run, type Regedit, and then click OK.
b. Find and then click the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\CrashControl
c. On the Edit menu, New, and then click String Value.
d. In the details pane, type DedicatedDumpFile, and hit ENTER.
e. Right-click DedicatedDumpFile, and then click Modify.
f. In the Value data box, type <drive>:\<dedicateddumpfile.sys>, and then click OK.
g. On the Edit menu, New, and then click DWORD Value.
h. Type DumpFileSize , and hit ENTER.
i. Right-click DumpFileSize, and then click Modify.
j. In the Edit DWORD Value dialog box, click Decimal under Base.
k. In the Value data box, type proper value, and then click OK.
l. Exit Registry Editor.
Step 2: Create a complete memory dump file
1. Click Start, right-click Computer, and then click Properties.
2. Click Advanced system settings on the System page, and then click the Advanced tab.
3. Click Settings under the Writing debugging information area, and then ensure Complete memory dump is chosen.

Disk space

There should be sufficient free space in the chosen place to write the memory dump file. By default, the memory dump file is written to the %SystemRoot%\Memory.dmp file. If there is not sufficient free space on the %SystemRoot% drive, you can redirect the dump file to other place that has sufficient free space.
To modify dump file path in the Startup and Recovery options on a Windows Server 2008-based PC, follow the steps given below:
1. Click Start, right-click Computer, and then click Properties.
2. Click Advanced system settings on the System page, and then click the Advanced tab.
3. Click Settings under the Writing debugging information area, and then replace the path with a proper value in the Dump file field. In other words, you can modify path from %SystemRoot%\Memory.dmp to go to a local drive that has sufficient disk space, like E:\Memory.dmp.

Methods to generate a manual memory dump file
Some methods used to create a manual kernel or full memory dump file. These consists of NMI, keyboard (PS2/USB), remote kernel, or NotMyFault.exe tools.

How to generate a manual memory dump by using the NotMyFault tool
If you log on when problem happen, SysInternals NotMyFault tool can be used. For this, follow the steps given below:

1. Download the NotMyFault tool
2. Click Start, find and right-click Command Prompt, and then click Run as administrator.
3. At the command line, type NotMyfault.exe /crash, and hit ENTER.
How to generate a manual memory dump file by using the keyboard
To enable the feature on PC that uses a USB keyboard, follow the steps given below:
1. Run Registry Editor.
2. Find and then click the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\kbdhid\Parameters
3. On Edit menu, click Add Value, and then add the following registry entry.

Name : CrashOnCtrlScroll
Data Type : REG_DWORD
Value : 1
4. Exit Registry Editor.
5. Restart PC. PC that uses a USB keyboard, you do not have to restart PC. Unplugging the keyboard and plugging it back again is enough. After that, the Memory dump file can be created.

How to obtain a utility to automate the registry keys and paging files

1. Download DumpConfigurator.hta
2. Click Download, and then click I Agree after you read Software License Terms.
3. Save the WInPlatTools-14600.zip file, and then extract the DumpConfigurator.hta utility.
4. Click DumpConfigurator.hta, and then click Auto Config Complete.