I have set in Advanced Settings for "Complete MEMORY Dump. I got a BSOD last night ... I did not find a Complete Memory Dump (%SystemRoot%\MEMORY.DMP). How would this Memory Dump disappear or not be created?
Sherry
Hi Sherry. . .
Was there a file there at all (meaning an older one) -- in (%systemroot%\memory.dmp)?
I found this entry in the Event Viewer log and it says that a dump from May 29, 2017, was written to/saved in %systemroot%\memory.dmp
From Event Viewer:
Code:
Event[33191]:
Log Name: System
Source: Microsoft-Windows-WER-SystemErrorReporting
Date: 2017-05-29T20:42:05.792
Level: Error
Computer: ALIENWARE17R4
Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x000000d1 (0x0000000000000208,
0x0000000000000007, 0x0000000000000000, 0xfffff80ac273690b). A dump was saved in:
C:\WINDOWS\MEMORY.DMP. Report Id: e17dcd83-711e-4e5c-9736-c23ec50be72a.
Do you use CCleaner or similar app that may have deleted the dump?
Not only does the Event Viewer indicate that a dump was written on 5/29/17 -- the dump is not included in the Sysnative/jcgriff2 zip file that you attached. So either these dumps are not being written or some app is coming along and deleting them. This fits the pattern of the BSOD/dump from yesterday. There may be many more dumps that are missing from BDODs that actually occurred.
The 5 dumps provided to us in the most recent Sysnative/jcgriff2 output zip file -
Code:
Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.
C:\Users\PalmDesert\_jcgriff2_\dbug\1>dir /o:n
Volume in drive C is Windows 8.1 x64
Volume Serial Number is C8D9-F1EF
Directory of C:\Users\PalmDesert\_jcgriff2_\dbug\1
10/06/2017 09:34 PM <DIR> .
10/06/2017 09:34 PM <DIR> ..
01/01/1980 12:00 AM 1,384,224 082217-8781-01.dmp
01/01/1980 12:00 AM 1,377,440 082517-9562-01.dmp
01/01/1980 12:00 AM 1,365,792 082917-10000-01.dmp
01/01/1980 12:00 AM 1,369,888 083017-10046-01.dmp
01/01/1980 12:00 AM 1,379,232 092717-10359-01.dmp
5 File(s) 6,876,576 bytes
2 Dir(s) 91,107,069,952 bytes free
C:\Users\PalmDesert\_jcgriff2_\dbug\1>
Windows 10 dump file dates have left all BSOD Analysts shaking their heads in disbelief as often
THE FILE DATE associated with the dump file is just plain wrong. Looking up at the list of your 5 dumps, you can see that the timestamp is wrong as they all say that all 5 BSODs occurred on January 1, 1980 at midnight. To obtain the correct timestamp, look at the filr name or run the dump. I usually do both.
If you look at the column to the right of the file size is the file name. The file name column for Windows' minidumps is partially made up of
Anyway, full physical memory dumps are not of any use to us. We need kernel dumps. Change crash control settings either to "Automatic" or "Full Kernel Dump". Doing so
should leave you with a full kernel dump (%systemroot%\memory.dmp) + a minidump (%systemroot%\minidump).
Regards. . .
jcgriff2
EDIT: I just saw the info about the page file.
For the page file deletion and re-allocation, try this -
Deletion + Reallocation of the Page File (Windows 10, 8.1, 8, 7 & Vista)
A problem with the page file
may be responsible for the lack of your full physical memory dump being written as all dump info is written to the page file first, then re-written to either %systemroot%\memory.dmp +/or %systemroot%\minidump.
If you have any other questions, just ask and we'll do our best to get it/them answered.