2

We are occasionally encountering a blue screen on certain Windows Server 2008 R2 systems. There is no dump file written.

Despite extensive analysis and corrections no dump file is generated (nor in tests with NotMyFault from Sysinternals). So I want to understand how the mechanism should work.

This is my understanding of the process:

Minidump is configured

  • In a BSOD a kernel mechanism writes the dump information in the pagefile
  • During the next boot, Windows detects that the pagefile contains dump information and creates in c:\windows\minidump the minidump file
  • Windows creates an entry in the eventlog

Full memory dump is configured

  • In a BSOD a kernel mechanism overwrites the entire pagefile with the contents of the RAM
  • During the next boot, Windows detects that the pagefile contains a complete memory dump and moves the page file to c:\windows and renames it to Memory.dmp
  • Windows creates a new page file
  • Windows creates an entry in the event log

Is this correct so far?

Is there a service that is responsible for generating the dump file after reboot?

6
  • If a dump file is not being created then its likely caused by the system disk starting to fail.
    – Ramhound
    Feb 5, 2015 at 11:46
  • Turn your page file Off, reboot, turn it back On and reboot again, will it generate a dump file now? You might also consider running a few chkdsk's on the drive.
    – Moab
    Feb 8, 2015 at 0:53
  • @Ramhound: Thanks for your suggestion. Its an VMWare ESX system. The behaviour occurs both on the SAN an on the local storages. Do you know details about the mechanism how the dumps are created? Feb 11, 2015 at 7:47
  • Moab: We will try it, thanks! Do you know details about the mechanism how the dumps are created? Feb 11, 2015 at 7:49
  • @boboes - Yes, It dumps the information from memory to the system disk.
    – Ramhound
    Feb 11, 2015 at 11:46

1 Answer 1

1

This Microsoft TechNet link contains a technical description of the method by which the dump is actually created: http://blogs.technet.com/b/askperf/archive/2008/01/08/understanding-crash-dump-files.aspx

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .