BSODs but no Dump Files?

jcgriff2 · Mar 22, 2012

`

No Kernel Memory Dump files being produced upon BSOD?

For dumps to be produced. . .

▪ Page file must be on OS drive
▪ Page file base allocation size must be > than installed physical RAM
▪ Windows Error Reporting (WER) system service should be set to MANUAL
▪ Set page file to system managed, OS drive

Set System Crash/ Recovery Settings to "Kernel Memory Dump" - this will produce. . .
--> a Full Kernel Memory Dump - c:\windows\memory.dmp
--> a Mini Kernel dump c:\windows\minidump

The Full Kernel is overwritten each BSOD; a new mini kernel dump is created w/ different name for each BSOD

To check your system's "Recoveros" (Recovery) and Page File settings via Windows Management Instrumentation (WMI), run the following -

HTML output - WMI - "Recoveros" and Page File Settings (HTML)
Text file output - WMI - "Recoveros" and Page File Settings (TEXT)

July 2012
A hotfix is available that enables a Windows 7-based or Windows Server 2008 R2-based computer to create a memory dump file without a page file

kb2716542 - A hotfix is available that enables a Windows 7-based or Windows Server 2008 R2-based computer to create a memory dump file without a page file

Additional Information -

Read More:

To view page file settings, bring up an Admin cmd/DOS screen & paste this applet -

Or, click on START; paste the applet into the StartSearch box -

Code:


SystemPropertiesPerformance.exe /pagefile

Regards. . .

jcgriff2

.

karlsnooks · Sep 25, 2012

Physical memory = 6 GB
Page File size = 5606 MB

Used NotMyFault to generate minidump.

Minidump generated successfully.
Hotfix has not been installed.

jcgriff2 · Sep 25, 2012

Thank you... I will have to try that.

http://download.sysinternals.com/files/NotMyFault.zip

Vir Gnarus · Sep 26, 2012

Erm, NotMyFault is for training purposes and is not designed to diagnose issues. I think he's just saying that he used NotMyFault to test his current config which worked. Just know that NotMyFault will create its own crashes; using it to force a crash in order to view a problem from something else is kinda counterproductive.

jcgriff2 · Sep 27, 2012

Agree - another option to see if OPs system can simply produce a dump.

I've used kb244139, ProcExp & TaskMgr to do the same.

I'm wondering now if NotMyFault belongs with the other 3 or not. Does it create a dump differently?

Any idea how karlsnooks created a dump if kb2716542 not installed & page file is ~400 MB < RAM?

I thought both current page file and page file base allocation size must be > installed physical RAM. . . or no dump will be produced.

@ karlsnooks - can you create a dump with Task Manager?

Process Explorer?

Same command for both - Right-click on an app, "Create Dump.."

Dump is written to your temp folder - \users\<username>\AppData\Local\Temp

Vir Gnarus · Sep 27, 2012

Well, think of it this way, with those options you are manually triggering an exception which is technically legitimate, and the system sees that and will respond appropriately (like giving the proper bugcheck type for the key-triggered BSOD). There are no alterations done to the environment.

With NotMyFault, however, it is designed to cause corruption in the environment in one way or another, again for training purposes. This corruption will obviously complicate things if you're looking for a problem elsewhere, and may even alter the environment so that you won't find the answer you seek anyways.

karlsnooks · Sep 28, 2012

Why Mark Russinovich wrote NotMyFault was for testing purposes to the best of my recollection.

I've never tried other methods of creating a dump file since NotMyFault gives one the opportunity to generate faults of all types.

Here is a write-up of conditions I found to be necessary to generate a dump:

[h=1]MEMORY DUMPS – REQUIREMENTS[/h]
CREATE MINIDUMP FOLDER
WIN | type %systemroot% | ENTER
If Minidump is not shown, Then
CTRL + SHIFT + N keycombo |
CONTINUE button | type Minidump | ENTER

Enable automatic management of the Paging file
WIN + PAUSE key combo |
Advanced system settings (left-hand side) |
Advanced tab, Performance section, Settings |
Advanced tab, Virtual Memory section, Change |
checkmark Automatically manage paging file size for all drives |
OK | OK | OK

STARTUP AND RECOVERY SETTINGS
WIN + PAUSE key combo |
Advanced system settings (left-hand side) |
Advanced tab, Startup and Recovery section, Settings |
System Failure section | checkmark Write an Event to the system log
| uncheck Automatically restart |

Under Write debugging information, select Small memory dump |
in the Small dump directory: box, enter %SystemRoot%\Minidump | OK

If Overwrite any existing file is checked, then:

Under Write debugging information, select Kernel memory dump
Uncheck Overwrite any existing file
Under Write debugging information, select Small memory dump
OK button

If you get a crazy message from Win 7 about your paging file being too small, then just ignore the message since we have already made sure that the paging file is set to be managed by Win 7.

ENABLE THE WINDOWS ERROR REPORTING SERVICE
WIN key | type SERVICES.MSC | ENTER |
Scroll down to Windows Error Reporting Service |
Rt-clk on Windows Error Reporting Service | Properties |
General tab | for Startup type, choose Automatic |
In Service status, Start button (unless grayed out) | OK

ASSURE THAT CCLEANER IS NOT DELETING DUMPS
CCLEANER | Cleaner icon | Windows tab | System category |
Uncheck Memory Dumps

WINDOWS ERROR REPORTING SERVICE must NOT be disabled!

WIN | Services.msc | Enter
Under Name, locate Windows Error Reporting Service
If Status is not Started, then
Right-click on Windows Error Reporting Service |choose START
If Startup Type is not Automatic, then
Right-click on Windows Error Reporting Service |
choose Properties | General tab |
set Startup type to Automatic
Close Services.msc (I like to use ALT + F4)

After a crash, the minidump file will be in %SystemRoot%\Minidump
%SystemRoot% is generally C:\Windows

Search

Search

BSODs but no Dump Files?

jcgriff2

Co-Founder/Admin
BSOD Expert (Ret.)
Microsoft MVP (Ret.)
PRIMARILY RETIRED

karlsnooks

Windows Specialist

jcgriff2

Co-Founder/Admin
BSOD Expert (Ret.)
Microsoft MVP (Ret.)
PRIMARILY RETIRED

Vir Gnarus

BSOD Kernel Dump Expert

jcgriff2

Co-Founder/Admin
BSOD Expert (Ret.)
Microsoft MVP (Ret.)
PRIMARILY RETIRED

Vir Gnarus

BSOD Kernel Dump Expert

karlsnooks

Windows Specialist

BSODs but no Dump Files?

jcgriff2

Co-Founder/AdminBSOD Expert (Ret.)Microsoft MVP (Ret.)PRIMARILY RETIRED

karlsnooks

Windows Specialist

jcgriff2

Co-Founder/AdminBSOD Expert (Ret.)Microsoft MVP (Ret.)PRIMARILY RETIRED

Vir Gnarus

BSOD Kernel Dump Expert

jcgriff2

Co-Founder/AdminBSOD Expert (Ret.)Microsoft MVP (Ret.)PRIMARILY RETIRED

Vir Gnarus

BSOD Kernel Dump Expert

karlsnooks

Windows Specialist

Co-Founder/Admin
BSOD Expert (Ret.)
Microsoft MVP (Ret.)
PRIMARILY RETIRED

Co-Founder/Admin
BSOD Expert (Ret.)
Microsoft MVP (Ret.)
PRIMARILY RETIRED

Co-Founder/Admin
BSOD Expert (Ret.)
Microsoft MVP (Ret.)
PRIMARILY RETIRED