Environment
Microsoft Windows XP
Microsoft Windows 2003
Microsoft Windows Vista
Microsoft Windows 7
Situation
How to get a Windows memory dump
Resolution
The following steps are similar for all versions of Windows NT-based operating systems.
Launch the Control Panel
Select System
Select Advanced system settings
Select the Advanced tab
Click the Settings button under Startup and Recovery
In the System Failure section, deselect the automatic restart option
Under the Write debugging information section, select the desired type of memory dump from the pick list - Small, Kernel, Complete, etc. If in doubt, select "Complete memory dump."
Note: If the "Complete" option does not appear in the drop-down list:
- Open the registry editor (regedit.exe).
- Navigate to the following key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl
- Double-click the value "CrashDumpEnabled" and set/change the data to "1".
Upload the zipped memory dump to ftp.novell.com/incoming and send the Novell support engineer an email that you have uploaded the file.
How to force a memory dump from a hung workstation:
Use Microsoft's "CrashOnCtrlScroll" configuration and method, as described in the Microsoft article:
a. Open the Windows Control Panel.
d. In the "System Properties" pane, Click the "Settings..." button in the "Startup and Recovery" section.
e. In the "Write Debugging Information" section, select "Complete memory dump".
f. Deselect the "Automatically Restart" option
2. Create the "CrashOnCtrlScroll" DWORD value of 0x00000001 under either
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters] or
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdhid\Parameters]
depending on whether the machine uses a PS/2 or USB keyboard, respectively.
3. Perform the operation which will encounter the problem.
4. Wait long enough to ensure that the machine is in the midst of the problem, then force Windows to crash and write a kernel-mode memory dump by holding down the right CTRL key and pressing the SCROLL LOCK key two times.
5. Once complete, ZIP THE DUMP FILE before moving it off the machine, to ensure that the dump file is transferred intact.
Additional Information
If the "Complete memory dump" option is removed from the choice list in the later Windows versions, it is because Windows knows that a Complete memory dump isn't possible. e.g. The amount of physical RAM is more than 2GB, or the page file size isn't set to the size of physical memory or greater.
The "How to generate a kernel or a complete memory dump file in Windows Server 2008" KB article (http://support.microsoft.com/kb/969028) presents a good deal of information on what's new and different regarding obtaining a crash dump on Vista/2008, and also covers the "how to manually force a dump" topic too. Although the document describes the possibility of enabling the "Complete" memory dump option even though the machine has over 4GB of memory, due to the issue described of dumps over 4GB potentially being corrupt and the general non-necessity of actually making and uploading a dump of that size, Novell recommends using the "truncatememory or removememory switches in the BCDEdit.exe" approach described in the document.
i.e. From an elevated command prompt (i.e. "Run as administrator"), execute this command:
BCDEDIT.EXE /set {current} truncatememory 0x80000000
to have Windows ignore all the memory above 2GB after the next reboot. Now (after reboot) the "Complete" memory dump option should become available, and the Complete dump generated won't be larger than 2GB.
To return the machine to its original memory configuration, execute this command:
BCDEDIT.EXE /deletevalue {current} truncatememory
Windows 7 Specific
When attempting to collect a memory dump in connection with a Windows 7 kernel-mode crash, the MEMORY.DMP file may be unexpectedly missing. This may be due to the following Windows 7-specific default behavior:
If there are less than 25GB of disk space free and the machine is not joined to a domain, by default Windows will delete a generated MEMORY.DMP file rather than keeping it. (After Windows reboots and reports the crash to Microsoft via the online crash analysis / Windows Error Reporting.)
If there are more than 25GB, or the machine is joined to a domain (read "corporate environment"), or you're actually on a Windows Server 2008 R2 (not Windows 7 Ultimate / Professional / Home), the MEMORY.DMP will be retained by default, as it always has in previous versions of Windows.
The Windows 7 default policy can be explicitly overridden by setting the following registry value:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl]
"AlwaysKeepMemoryDump"=dword:00000001
Formerly known as TID# 10084257
Change Log
EWELLS updated TID 19Oct2009, adding information on If the "Complete memory dump" option is not available.
EWELLS updated TID 22Jan2010, fixing a minor typo.
EWELLS updated TID 28Jan2011, adding information about LiveKD Utility