Memory Dump Files
Memory Dump Files
When a Stop error occurs, Windows XP Professional writes information to the paging file (Pagefile.sys) on the systemdrive root by default. When you restart the computer in normal or safe mode after a Stop error occurs, Windows XP Professional uses paging file information to create a memory dump file in the systemroot folder. Analyzing the dump file can help provide more information about the root cause of a problem and enables offline analysis by using tools run on another computer. You can configure your system to generate one of three different types of dump files.
1. Small memory dump Small memory dump files contain the least information, but consume the least disk space, 64 kilobytes (KB). Small memory dump files are sometimes referred to as "mini" dump files. Unlike kernel and complete memory dump files; Windows XP Professional stores small memory dump files in the systemroot\Minidump folder, instead of using the systemroot\Memory.dmp file name.
2. Windows XP Professional always create a small memory dump file when a Stop error occurs, even when you choose the kernel or complete memory dump file options. One of the services that use small memory dump files is the Error Reporting service. The Error Reporting service reads the contents of a small memory dump file to help diagnose problems that cause Stop errors. For more information about the Error Reporting service, see "Using Memory Dump Files to Analyze Stop Errors" later in this appendix.
3. Kernel memory dump This is an intermediate size dump file that records only kernel-level memory and can occupy several megabytes (MB) of disk space. When a Stop error occurs, Windows XP Professional saves a kernel memory dump file to a file named systemroot\Memory.dmp and create a small memory dump file in the systemroot\Minidump folder. You cannot exactly predict the size of a kernel memory dump file because this depends on the amount of kernel-mode memory allocated by the operating system and drivers present on the machine when the Stop error occurred.
4. Complete memory dump A complete memory dump file contains the entire contents of physical memory when the Stop error occurred. The file size is equal to the amount of physical memory installed plus 1 MB. When a Stop error occurs, the operating system saves a complete memory dump file to a file named systemroot\Memory.dmp and creates a small memory dump file in the systemroot\Minidump folder.
To help ensure that your system can save memory dump files:
Verify that adequate free space exists on systemdrive to accommodate the maximum paging file size for the selected dump file. For example, for complete memory dump files, the available space must be at least equal to the amount of physical memory present plus 1 MB.
To view the maximum paging file size for each disk volume
1. In Control Panel, click Performance and Maintenance, and then click System.
2. Select the Advanced tab, and then in the Performance box, click Settings.
3. In the Performance Options dialog box, select the Advanced tab.
4. In Virtual memory, click Change to view the Virtual Memory dialog box that contains paging file information.
5. In Total paging file size for all drives, the Currently allocated value indicates the paging file disk space used. If you choose to enable the Custom size option, you can specify different paging file sizes by entering values for Initial size (MB) and Maximum size (MB). Verify that adequate disk space is available on systemdrive to accommodate the maximum paging file specified.
6. Verify that the memory dump file path (by default, systemroot\Memory.dmp) contains sufficient free space to store the memory dump file. For more information about specifying the disk dump file location, see the discussions on small, kernel, and complete memory dump files that follow.
7. Verify that the systemdrive or the volume containing the memory dump file is not corrupted. To test hard disk or volume integrity, follow the instructions provided in "Stop 0x00000024 or NTFS_FILE_SYSTEM" later in this appendix.
8. Infrequently, device driver problems might cause failure to save memory dump files. To minimize the potential for problems, use storage devices and controllers listed in the HCL and device drivers digitally signed by Microsoft.
------------------
Small Memory Dump File
A small memory dump file records the smallest set of useful information that might identify the cause of the system stopping unexpectedly. A small memory dump file includes the following:
1. Stop error information. Includes the error number and additional parameters that describe the Stop error.
2. A list of drivers running on the system. Identifies the modules in memory when the Stop error occurred.
3. Device driver information sent includes the file name, date, version, size, and manufacturer.
4. Processor context information for the process that stopped. Includes the processor and hardware state, performance counters, multiprocessor packet information, deferred procedure call information, and interrupts.
5. Kernel context information for the process that stopped. Includes offset of the directory table and the page frame number database (which describes the state of every physical page in memory).
6. Kernel context information for the thread that stopped. Identifies registers and interrupt request levels, and includes pointers to operating system data structures.
7. Kernel-mode call stack information for the thread that stopped. Consists of a series of memory locations and includes a pointer to the initial location. If this information is greater than 16 KB, only the top most 16 KB is included.
A small memory dump file requires a paging file of at least 2 MB on the boot volume and specifies that the operating system save each dump file using a unique file name every time a Stop error occurs. Each minidump file has a unique file name, which includes the date encoded in the file name. For example, Mini062701-01.dmp is the first small memory dump generated on June 27, 2001.
Small memory dump files are useful when space is limited or when you are using a slow connection to send information to technical support. Because of the limited amount of information that can be included, errors not directly caused by the thread that was running when the problem occurred are not included.
To configure Windows XP Professional to generate a small memory dump file
1. In Control Panel, click Performance and Maintenance, and then click System.
2. Select the Advanced tab, and in Startup and Recovery, click Settings.
3. In the Write Debugging Information list, select Small Memory Dump (64 KB).
4. Click OK to close the Startup and Recovery dialog box.
5. Click OK to close the System Properties dialog box, and then restart if prompted.
6. By default, Windows XP Professional saves small memory dump files to the systemroot\Minidump folder. You can change the folder location by typing a new path in Dump File box of the Write Debugging Information list.
----------------
Kernel Memory Dump File
A kernel memory dump file records only kernel memory information, which expedites the dump file creation process. Although you cannot exactly predict the size of a kernel memory dump file, a good rule of thumb is that roughly 50 MB to 800 MB, or one-third the size of physical memory, must be available on the boot volume for the paging file.
The kernel memory dump file does not include unallocated memory or any memory allocated to user-mode programs. It includes only memory allocated to the kernel and HAL, as well as memory allocated to kernel-mode drivers and other kernel-mode programs. For most purposes, a kernel memory dump file is the most useful kind of file for troubleshooting Stop messages. It contains more information than the small memory dump file and is significantly smaller than the complete memory dump file. It omits only those portions of memory that are unlikely to have been involved in the problem.
To configure Windows XP Professional to generate a kernel memory dump file
1. In Control Panel, click Performance and Maintenance, and then click System.
2. Select the Advanced tab, and then in Startup and Recovery, click Settings.
3. In the Write Debugging Information list, select Kernel Memory Dump.
4. Click OK to close the Startup and Recovery dialog box.
5. Click OK to close the System Properties dialog box, and then restart if prompted.
6. By default, Windows XP Professional saves a kernel memory dump file to systemroot\Memory.dmp. You can change the default output location by typing a new path in the Dump File box of the Write Debugging Information list.
Note
By default, a new kernel memory dump file overwrites an existing one. To change this, you need to clear the Overwrite any existing file check box. You can also choose to archive or move a dump file prior to troubleshooting.
----------------
Complete Memory Dump File
A complete memory dump records the contents of physical memory. If you choose to use complete memory dump files, you must have available space on the systemdrive partition large enough to hold the contents of physical RAM, plus 1 MB. By default, Windows XP Professional systems create complete memory dump files. A Microsoft technical support engineer might ask you to change this setting to facilitate data uploads over slow connections. Depending upon the speed of your Internet connection, uploading the data might not be practical and you might be requested to provide the memory dump file on higher capacity removable media.
To configure Windows XP Professional to generate a complete memory dump file
1. In Control Panel, click Performance and Maintenance, and then click System.
2. Select the Advanced tab, and then in Startup and Recovery, click Settings.
3. In the Write Debugging Information list, select Complete Memory Dump.
4. Click OK to close the Startup and Recovery dialog box. Click OK to close the System Properties dialog box, and then restart if prompted.
5. By default, Windows XP Professional saves a complete memory dump file to systemroot\Memory.dmp. You can change the default location by typing in a new path in the Dump File box of the Write Debugging Information list.
By default, new complete memory dump files overwrite existing files. To change this, you need to clear the Overwrite any existing file check box. You can also choose to archive or move a dump file prior to troubleshooting.
This Is A Must See
Windows Resource Kits - Web Resources
Back To The Top
Bud's CDs FREE MP3s Alphabetical Index Of Everything In This Site