Microsoft KB Archive/254649

= Overview of memory dump file options for Windows Server 2003, Windows XP, and Windows 2000 =

Article ID: 254649

Article Last Modified on 10/11/2007

-

APPLIES TO


 * Microsoft Windows Server 2003, Standard x64 Edition
 * Microsoft Windows Server 2003, Datacenter x64 Edition
 * Microsoft Windows Server 2003, Enterprise x64 Edition
 * Microsoft Windows Server 2003, Datacenter Edition for Itanium-Based Systems
 * Microsoft Windows Server 2003, Enterprise Edition for Itanium-based Systems
 * Microsoft Windows Server 2003, Standard Edition (32-bit x86)
 * Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
 * Microsoft Windows Server 2003, Enterprise Edition
 * Microsoft Windows Server 2003, Web Edition
 * Microsoft Windows XP Professional x64 Edition
 * Microsoft Windows XP for Itanium-based Systems Version 2003
 * Microsoft Windows XP Professional 64-Bit Edition (Itanium)
 * Microsoft Windows XP Professional
 * Microsoft Windows XP Home Edition
 * Microsoft Windows XP Media Center Edition 2002
 * Microsoft Windows XP Tablet PC Edition
 * Microsoft Windows 2000 Server
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Professional Edition
 * Microsoft Windows 2000 Datacenter Server

-



This article was previously published under Q254649



SUMMARY
You can configure Microsoft Windows Server 2003, Microsoft Windows XP, and Microsoft Windows 2000 to write debugging information to three different file formats (also known as memory dump files) when your computer stops unexpectedly as a result of a Stop error (also known as a "blue screen," system crash, or bug check). You can also configure Windows not to write debugging information to a memory dump file. Windows can generate any one of the following three memory dump file types:
 * Complete memory dump
 * Kernel memory dump
 * Small memory dump (64 KB)



Complete memory dump
A complete memory dump records all the contents of system memory when your computer stops unexpectedly. If you select the Complete memory dump option, you must have a paging file on the boot volume that is sufficient to hold all the physical RAM plus 1 megabyte (MB). By default, the complete memory dump file is written to the %SystemRoot%\Memory.dmp file.

If a second problem occurs and another complete memory dump (or kernel memory dump) file is created, the previous file is overwritten.

Note The Complete memory dump option is not available on computers that are running a 32-bit operating system and that have 2 gigabytes (GB) or more of RAM. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

274598 Complete memory dumps are not available on computers that have 2 or more gigabytes of RAM

Kernel memory dump
A kernel memory dump records only the kernel memory. This speeds up the process of recording information in a log when your computer stops unexpectedly. Depending on the RAM in your computer, you must have between 150MB and up to 2GB of pagefile space available based on server load and the amount of physical RAM available for page file space on the boot volume.

This dump file does not include unallocated memory or any memory that is allocated to User-mode programs. It includes only memory that is allocated to the kernel and hardware abstraction level (HAL) in Windows 2000 and later, and memory allocated to Kernel-mode drivers and other Kernel-mode programs. For most purposes, this dump file is the most useful. It is significantly smaller than the complete memory dump file, but it omits only those parts of memory that are unlikely to have been involved in the problem. By default, the kernel memory dump file is written to the %SystemRoot%\Memory.dmp file.

If a second problem occurs and another kernel memory dump file (or a complete memory dump file) is created, the previous file is overwritten.

Small memory dump
A small memory dump records the smallest set of useful information that may help identify why your computer stopped unexpectedly. This option requires a paging file of at least 2 MB on the boot volume and specifies that Windows 2000 and later create a new file every time your computer stops unexpectedly. A history of these files is stored in a folder.

This dump file type includes the following information:
 * The Stop message and its parameters and other data
 * A list of loaded drivers
 * The processor context (PRCB) for the processor that stopped
 * The process information and kernel context (EPROCESS) for the process that stopped
 * The process information and kernel context (ETHREAD) for the thread that stopped
 * The Kernel-mode call stack for the thread that stopped

This kind of dump file can be useful when space is limited. However, because of the limited information included, errors that were not directly caused by the thread that was running at the time of the problem may not be discovered by an analysis of this file.

If a second problem occurs and a second small memory dump file is created, the previous file is preserved. Each additional file is given a distinct name. The date is encoded in the file name. For example, Mini022900-01.dmp is the first memory dump generated on February 29, 2000. A list of all small memory dump files is kept in the %SystemRoot%\Minidump folder.

Configure the dump type
To configure startup and recovery options (including the dump type), follow these steps.

Note Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.
 * 1) Click Start, point to Settings, and then click Control Panel.
 * 2) Double-click System.
 * 3) On the Advanced tab, click Startup and Recovery.

Tools for the various dump types
You can load complete memory dumps and kernel memory dumps with standard symbolic debuggers, such as I386kd.exe. I386kd.exe is included with the Windows 2000 Support CD-ROM.

Load small memory dumps by using Dumpchk.exe. Dumpchk.exe is included with the Support Tools for Windows 2000 and Windows XP. You can also use Dumpchk.exe to verify that a memory dump file has been created correctly. For more information about how to use Dumpchk.exe in Windows XP, click the following article number to view the article in the Microsoft Knowledge Base:

315271 How to use Dumpchk.exe to check a memory dump file

For more information about how to use Dumpchk.exe in Windows 2000, click the following article number to view the article in the Microsoft Knowledge Base:

156280 How to use Dumpchk.exe to check a memory dump file

For additional information about Windows debugging tools, visit the following Microsoft Web site:

http://www.microsoft.com/whdc/devtools/debugging/default.mspx

Definitions

 * Boot volume: The volume that contains the Windows operating system and its support files. The boot volume can be, but does not have to be, the same as the system volume.
 * System volume: The volume that contains the hardware-specific files that you must have to load Windows. The system volume can be, but does not have to be, the same as the boot volume. The Boot.ini, Ntdetect.com, and Ntbootdd.sys files are examples of files that are located on the system volume.

Registry values for startup and recovery
The following registry value is used:

CrashDumpEnabled REG_DWORD 0x0 = None

CrashDumpEnabled REG_DWORD 0x1 = Complete memory dump

CrashDumpEnabled REG_DWORD 0x2 = Kernel memory dump

CrashDumpEnabled REG_DWORD 0x3 = Small memory dump (64KB)

Additional registry values for CrashControl:

0x0 = Disabled

0x1 = Enabled

AutoReboot REG_DWORD 0x1

DumpFile REG_EXPAND_SZ %SystemRoot%\Memory.dmp

LogEvent REG_DWORD 0x1

MinidumpDir REG_EXPAND_SZ %SystemRoot%\Minidump

Overwrite REG_DWORD 0x1

SendAlert REG_DWORD 0x1

Test to make sure that a dump file can be created
For more information about how to configure your computer to generate a dump file for testing purposes, click the following article number to view the article in the Microsoft Knowledge Base:

244139 Windows feature allows a Memory.dmp file to be generated with the keyboard

Default dump type options

 * Windows 2000 Professional: Small memory dump (64 KB)
 * Windows 2000 Server: Complete memory dump
 * Windows 2000 Advanced Server: Complete memory dump
 * Windows XP (Professional and Home Edition): Small memory dump (64 KB)
 * Windows Server 2003 (All Editions): Complete memory dump

Maximum paging file size
Maximum paging file size is limited as follows:

Note When the Physical Address Extension (PAE) option is enabled for an x86-based processor, you can set the paging file size to a maximum of 16 terabytes (TB). However, we recommend that you set the paging file size to 1.5 times the installed physical memory.

Technical support for x64-based versions of Microsoft Windows
Your hardware manufacturer provides technical support and assistance for x64-based versions of Windows. Your hardware manufacturer provides support because an x64-based version of Windows was included with your hardware. Your hardware manufacturer might have customized the installation of Windows with unique components. Unique components might include specific device drivers or might include optional settings to maximize the performance of the hardware. Microsoft will provide reasonable-effort assistance if you need technical help with your x64-based version of Windows. However, you might have to contact your manufacturer directly. Your manufacturer is best qualified to support the software that your manufacturer installed on the hardware.

For product information about Microsoft Windows XP Professional x64 Edition, visit the following Microsoft Web site:

http://www.microsoft.com/windowsxp/64bit/default.mspx

For product information about x64-based versions of Microsoft Windows Server 2003, visit the following Microsoft Web site:

http://www.microsoft.com/windowsserver2003/64bit/x64/default.mspx

Additional query words: Winx64 Windowsx64 64bit 64-bit

Keywords: kbinfo kbenv KB254649

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.