Microsoft KB Archive/838461

= An API that attaches header information to the memory image is available for OEM computers that have &quot;capture memory image&quot; capability in Windows Server 2003 =

Article ID: 838461

Article Last Modified on 6/2/2006

-

APPLIES TO


 * Microsoft Windows Server 2003, Web Edition
 * Microsoft Windows Server 2003, Standard Edition (32-bit x86)
 * Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
 * Microsoft Windows Server 2003, Enterprise x64 Edition

-





Beta Information
This article discusses a Beta release of a Microsoft product. The information in this article is provided as-is and is subject to change without notice.

No formal product support is available from Microsoft for this Beta product. For information about how to obtain support for a Beta release, see the documentation that is included with the Beta product files, or check the Web location where you downloaded the release.



INTRODUCTION
Some computers can capture a memory image when they stop responding, when performance is extremely slow, or when they crash without providing a crash dump file. After the computer captures the memory image, the computer requires a Microsoft Windows application programming interface (API) to analyze the image with debug tools. This API attaches information that is required for debugging the image. An API for attaching the header information to the memory image is now available. This API is scheduled to be included in Service Pack 1 (SP1) for Microsoft Windows Server 2003.



Update information
A supported feature that modifies the product's default behavior is now available from Microsoft, but it is only intended to modify the behavior that this article describes. Apply it only to systems that specifically require it. This feature may receive additional testing. Therefore, if the system is not severely affected by the lack of this feature, we recommend that you wait for the next Windows Server 2003 service pack that contains this feature.

To obtain this feature immediately, contact Microsoft Product Support Services. For a complete list of Microsoft Product Support Services telephone numbers and information about support costs, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support

Prerequisites
Prerequisites are supplied by the OEMs that provide the feature to capture a memory image from a non-responding computer.

Restart requirement
The restart requirement is supplied by the OEMs that provide the feature to capture a memory image from a non-responding computer.

Hotfix replacement information
Hotfix replacement information is supplied by the OEMs that provide the feature to capture a memory image from a non-responding computer.

File information
The English version of this update has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.   Date         Time   Version         Size       File name 06-Mar-2004 00:44  5.2.3790.139    2,407,424  Ntkrnlmp.exe 06-Mar-2004 00:30  5.2.3790.139    2,064,896  Ntkrnlpa.exe 06-Mar-2004 00:30  5.2.3790.139    2,108,416  Ntkrpamp.exe 06-Mar-2004 00:47  5.2.3790.139    2,207,232  Ntoskrnl.exe

API information
The following information applies to this API:
 * The API is restricted to full dumps only. For example, the API is restricted to complete memory images of the computer.
 * The API will not account for any dynamic data, such as contact information or secondary dump callbacks.
 * The API may also lack certain information if the image is captured early in the startup process of the operating system.
 * The API is named &quot;KeInitializeCrashDumpHeader.&quot; This API will be documented in the driver development kit (DDK) for Windows Server 2003 SP1 and in the Debug documentation.

Note If the computer can capture a crashed system image &quot;off-line&quot; without the use of Crashdump.sys, set the Startup and Recovery setting for Write debugging information to (none). To do this:
 * 1) In Control Panel, double-click System.
 * 2) Click the Advanced tab.
 * 3) Under Startup and Recovery, click Settings.
 * 4) In the Write debugging information box, click (none).

The API does not have to have the crash dump selection set in the Write debugging information box to capture the image in memory. You do not have to specify Small Memory dump (64KB) or Kernel memory dump in this box because the new API captures the full image. The API only works for full memory images. The full memory image may be required to completely understand an issue. A small memory dump or a kernel memory dump may not provide enough information to resolve the issue.

For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

824684 Description of the standard terminology that is used to describe Microsoft software updates

Keywords: kbhowto kbinfo kbbug kbqfe kbwinserv2003presp1fix kbhotfixserver KB838461

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.