No Kernel Memory Dump files being produced upon BSOD?
For dumps to be produced. . .
▪ Page file must be on OS drive
▪ Page file base allocation size must be > than installed physical RAM
▪ Windows Error Reporting (WER) system service should be set to MANUAL
▪ Set page file to system managed, OS drive
Set System Crash/ Recovery Settings to "Kernel Memory Dump" - this will produce. . .
--> a Full Kernel Memory Dump - c:\windows\memory.dmp
--> a Mini Kernel dump c:\windows\minidump
The Full Kernel is overwritten each BSOD; a new mini kernel dump is created w/ different name for each BSOD
To check your system's "Recoveros" (Recovery) and Page File settings via Windows Management Instrumentation (WMI), run the following -
Erm, NotMyFault is for training purposes and is not designed to diagnose issues. I think he's just saying that he used NotMyFault to test his current config which worked. Just know that NotMyFault will create its own crashes; using it to force a crash in order to view a problem from something else is kinda counterproductive.
Well, think of it this way, with those options you are manually triggering an exception which is technically legitimate, and the system sees that and will respond appropriately (like giving the proper bugcheck type for the key-triggered BSOD). There are no alterations done to the environment.
With NotMyFault, however, it is designed to cause corruption in the environment in one way or another, again for training purposes. This corruption will obviously complicate things if you're looking for a problem elsewhere, and may even alter the environment so that you won't find the answer you seek anyways.
Why Mark Russinovich wrote NotMyFault was for testing purposes to the best of my recollection.
I've never tried other methods of creating a dump file since NotMyFault gives one the opportunity to generate faults of all types.
Here is a write-up of conditions I found to be necessary to generate a dump:
[h=1]MEMORY DUMPS – REQUIREMENTS[/h] CREATE MINIDUMP FOLDER WIN | type %systemroot% | ENTER
If Minidump is not shown, Then CTRL + SHIFT + N keycombo | CONTINUE button | type Minidump | ENTER
Enable automatic management of the Paging file WIN + PAUSE key combo | Advanced system settings (left-hand side) | Advanced tab, Performance section, Settings | Advanced tab, Virtual Memory section, Change |
checkmark Automatically manage paging file size for all drives |
OK | OK | OK
STARTUP AND RECOVERY SETTINGS WIN + PAUSE key combo | Advanced system settings (left-hand side) |
Advanced tab, Startup and Recovery section, Settings| System Failure section | checkmarkWrite an Event to the system log
| uncheckAutomatically restart|
Under Write debugging information, select Small memory dump |
in the Small dump directory: box, enter %SystemRoot%\Minidump| OK
If Overwrite any existing file is checked, then:
Under Write debugging information, select Kernel memory dump
Uncheck Overwrite any existing file
Under Write debugging information, select Small memory dump
If you get a crazy message from Win 7 about your paging file being too small, then just ignore the message since we have already made sure that the paging file is set to be managed by Win 7.
ENABLE THE WINDOWS ERROR REPORTING SERVICE WIN key | type SERVICES.MSC| ENTER|
Scroll down to Windows Error Reporting Service |
Rt-clk on Windows Error Reporting Service | Properties |
General tab | for Startup type, choose Automatic|
In Service status, Start button (unless grayed out) | OK
ASSURE THAT CCLEANER IS NOT DELETING DUMPS CCLEANER | Cleaner icon | Windows tab | System category | UncheckMemory Dumps
WINDOWS ERROR REPORTING SERVICE must NOT be disabled!
WIN |Services.msc | Enter
Under Name, locate Windows Error Reporting Service
If Status is not Started, then
Right-click on Windows Error Reporting Service |choose START
If Startup Type is not Automatic, then
Right-click on Windows Error Reporting Service | choose Properties | General tab |
set Startup type to Automatic
Close Services.msc (I like to use ALT + F4)
After a crash, the minidump file will be in %SystemRoot%\Minidump
%SystemRoot% is generally C:\Windows