Microsoft KB Archive/886429

= What to consider when you configure a new location for memory dump files in Windows Server 2003 =

Article ID: 886429

Article Last Modified on 10/11/2007

-

APPLIES TO


 * Microsoft Windows Server 2003, Enterprise Edition for Itanium-based Systems
 * Microsoft Windows Server 2003, Enterprise x64 Edition
 * Microsoft Windows Server 2003, Standard x64 Edition
 * Microsoft Windows Server 2003, Enterprise Edition
 * Microsoft Windows Server 2003, Standard Edition (32-bit x86)
 * Microsoft Windows Server 2003, Web Edition

-



INTRODUCTION
This article discusses issues that you must consider if you configure Microsoft Windows Server 2003 to dump physical memory to a location other than the boot volume.

By default, Windows Server 2003 writes memory dump information to the following location:

%SystemRoot%\MEMORY.DMP

To modify this location, follow these steps:
 * 1) Click Start, right-click My Computer, and then click Properties.
 * 2) Click the Advanced tab, and then click Settings under Startup and Recovery.
 * 3) In the Dump file box, type the path where you want Windows to write dump file information.



MORE INFORMATION
Consider the following scenario:
 * You configure Windows Server 2003 to dump physical memory to a location other than the boot volume.
 * Windows Server 2003 experiences a fatal error.

When Windows restarts after the fatal error, Windows requires a temporary file on the boot volume that is equal to the physical memory that is installed in the computer. If there is not enough hard disk space available to meet this requirement, the memory dump file is still generated. However, the pagefile size on this volume is reduced.

This behavior occurs because Windows Server 2003 introduces the following design changes for dump file generation:  In the first stage of a memory dump operation, the Session Manager Subsystem process (SMSS.exe) performs part of the Savedump tool's job before Windows creates the pagefile. SMSS examines the pagefile head block to determine whether this file is a valid memory dump file. If the memory dump file is valid, SMSS truncates the original pagefile to the size of the dump file and renames this file to Dump .tmp.

Note The  part of this file name is calculated from the Lower Word of the tickcount function.

SMSS stores the Dump .tmp file on the boot volume and removes both the hidden attribute and the system attribute from this file. SMSS also sets the TempDestination value and the DumpFile value in a volatile registry subkey. This subkey is later read by the Savedump.exe process when the process copies Dump .tmp to Memory.dmp. In the second stage of the memory dump operation, the Savedump.exe process examines the following registry location to determine whether a volatile subkey exists:

The existence of a volatile registry key indicates that a valid memory dump file has been created. In this scenario, the Savedump.exe process reads the data from the TempDestination registry value and copies the dump file to the correct location.

SMSS requires a temporary file on the boot volume for the following reasons:
 * In this scenario, SMSS can safely write only to the boot volume. The write operation for crashdump information ignores filter drivers.

Note The SMSS process cannot write a dump file to a redundant array of independent disks (RAID) array because the process skips filter drivers. Therefore, the temporary file should be written to a boot volume.
 * In this scenario, SMSS uses the NtSetFileInformation function with the renaming operation to truncate the pagefile to the size of the temporary file. This function supports rename operations only on the same volume.

Keywords: kbhowto kbinfo kbfilesystems kbenv kbdiskmemory KB886429

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.