We are occasionally encountering a blue screen on certain Windows Server 2008 R2 systems. There is no dump file written.
Despite extensive analysis and corrections no dump file is generated (nor in tests with NotMyFault
from Sysinternals). So I want to understand how the mechanism should work.
This is my understanding of the process:
Minidump is configured
- In a BSOD a kernel mechanism writes the dump information in the
pagefile
During the next boot
, Windows detects that the pagefile contains dump information and creates in c:\windows\minidump the minidump file- Windows creates an entry in the eventlog
Full memory dump is configured
- In a BSOD a kernel mechanism
overwrites the entire pagefile
with the contents of the RAM During the next boot
, Windows detects that the pagefile contains a complete memory dump and moves the page file to c:\windows and renames it to Memory.dmp- Windows creates a new page file
- Windows creates an entry in the event log
Is this correct so far?
Is there a service that is responsible for generating the dump file after reboot?