9/23/2010

Win7: Memory Dump

A kernel dump gets created every time a machine has a kernel fault. This dump gets stored in the %systemroot% folder as a memory.dmp file.
(Control Panel > System and Security > System > Advanced system settings > Advanced tab > Startup and Recovery Settings.)

  1. No Full Memory Dumps option?
    The I/O Manager originally limited the size of a complete memory dump to 2GB, now the fact is Windows support crash dumps larger than 2GB. To workaround this, set \HKLM\System\CCS\Control\CrashControl\CrashDumpEnabled DWORD value to 1
  2. No memory.dmp generated after crash?
    Algorithm to decide whether to store/delete memory.dmp file generated after a system crash:
    First report the kernel fault to the Online Crash Analysis Service.
    Then, if machine has a registry setting AlwaysKeepMemoryDump set to 1, store the dump file on disk.
    Else, if machine is a Windows Server SKU, store the dump file on disk.
    Else, if the machine is joined to a domain (i.e. this is a corporate machine), store the dump file on disk.
    Else, if machine is not on a domain (i.e. this is a home user’s machine),
    If free disk space is >= 25GB, store the dump file on disk.
    Else (free disk space is < 25 GB), delete the dump file.
    The exact location of the AlwaysKeepMemoryDump setting in the registry is:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl ! AlwaysKeepMemoryDump Type: REG_DWORD.

No comments: