Microsoft KB Archive/315263

= How to read the small memory dump files that Windows creates for debugging =

Article ID: 315263

Article Last Modified on 12/3/2007

-

APPLIES TO


 * Microsoft Windows Server 2003, 64-Bit Datacenter Edition
 * Microsoft Windows Server 2003, Enterprise x64 Edition
 * Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
 * Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
 * Microsoft Windows Server 2003, Standard Edition (32-bit x86)
 * Microsoft Windows Server 2003, Web Edition
 * Microsoft Windows Small Business Server 2003 Premium Edition
 * Microsoft Windows Small Business Server 2003 Standard Edition
 * Microsoft Windows XP Home Edition
 * Microsoft Windows XP Professional
 * Microsoft Windows XP Professional x64 Edition
 * Microsoft Windows XP Media Center Edition 2002
 * Microsoft Windows XP Tablet PC Edition
 * Microsoft Windows 2000 Datacenter Server
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Server
 * Microsoft Windows 2000 Professional Edition

-



This article was previously published under Q315263



IN THIS TASK

 * SUMMARY
 * Small memory dump files
 * Configure the dump type
 * Tools to read the small memory dump file
 * Install the debugging tools
 * Open the dump file
 * Examine the dump file



SUMMARY
This step-by-step article describes how to examine a small memory dump file. You can use this file to determine why your computer has stopped responding.

back to the top

Small memory dump files
A small memory dump file records the smallest set of useful information that may help identify why your computer has stopped unexpectedly. This option requires a paging file of at least 2 megabytes (MB) on the boot volume. On computers that are running Microsoft Windows 2000 or later, Windows create a new file every time your computer stops unexpectedly. A history of these files is stored in a folder.

This dump file type includes the following information:
 * The Stop message and its parameters and other data
 * A list of loaded drivers
 * The processor context (PRCB) for the processor that stopped
 * The process information and kernel context (EPROCESS) for the process that stopped
 * The process information and kernel context (ETHREAD) for the thread that stopped
 * The Kernel-mode call stack for the thread that stopped

The small memory dump file can be useful when hard disk space is limited. However, because of the limited information that is included, errors that were not directly caused by the thread that was running at the time of the problem may not be discovered by an analysis of this file.

If a second problem occurs and if Windows creates a second small memory dump file, Windows preserves the previous file. Windows gives each file a distinct, date-encoded file name. For example, Mini022900-01.dmp is the first memory dump file that was generated on February 29, 2000. Windows keeps a list of all the small memory dump files in the %SystemRoot%\Minidump folder.

back to the top

Configure the dump type
To configure startup and recovery options to use the small memory dump file, follow these steps.

Note Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.
 * 1) Click Start, point to Settings, and then click Control Panel.
 * 2) Double-click System.
 * 3) Click the Advanced tab, and then click Settings under Startup and Recovery.
 * 4) In the Write debugging information list, click Small memory dump (64k).

To change the folder location for the small memory dump files, type a new path in the Dump File box (or in the Small dump directory box, depending on your version of Windows).

back to the top

Tools to read the small memory dump file
You can load small memory dump files by using the Dump Check Utility (Dumpchk.exe). You can also use Dumpchk.exe to verify that a memory dump file has been created correctly. The Dump Check Utility does not require access to debugging symbols. The Dump Check Utility is included with the Microsoft Windows 2000 Support Tools and the Microsoft Windows XP Support Tools.

For additional information about how to use the Dump Check Utility in Windows 2000 and in Windows NT, click the following article number to view the article in the Microsoft Knowledge Base:

156280 How to use Dumpchk.exe to check a memory dump file

For additional information about how to use the Dump Check Utility in Windows XP, click the following article number to view the article in the Microsoft Knowledge Base:

315271 How to use Dumpchk.exe to check a memory dump file

Note The Dump Check Utility is not included in the Microsoft Windows Server 2003 Support Tools. To obtain the Dump Check Utility if you are using Microsoft Windows Server 2003, download and install the Debugging Tools for Windows package from the following Microsoft Web site:

http://www.microsoft.com/whdc/devtools/debugging/default.mspx

You can also read small memory dump files by using the WinDbg tool or the KD.exe tool. WinDbg and KD.exe are included with the latest version of the Debugging Tools for Windows package.

This Web page also provides access to the downloadable symbol packages for Windows. To use the resources, create a folder on the disk drive where the downloaded local symbols or the symbol cache for symbol server use will reside. For example, use C:\Symbols. You can use the following symbol path with all the commands that are described in this article:

SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

If you download the symbols to a local folder, use the path of that folder as your symbol path.

For more information about the dump file options in Windows, click the following article number to view the article in the Microsoft Knowledge Base:

254649 Overview of memory dump file options for Windows Server 2003, Windows XP, and Windows 2000

back to the top

Install the debugging tools
To download and install the Windows debugging tools, visit the following Microsoft Web site:

http://www.microsoft.com/whdc/devtools/debugging/default.mspx

Select the Typical installation. By default, the installer installs the debugging tools in the following folder:

C:\Program Files\Debugging Tools for Windows

back to the top

Open the dump file
To open the dump file after the installation is complete, follow these steps:  Click Start, click Run, type cmd, and then click OK. Change to the Debugging Tools for Windows folder. To do this, type the following at the command prompt, and then press ENTER:

cd c:\program files\debugging tools for windows

 To load the dump file into a debugger, type one of the following commands, and then press ENTER:

windbg -y  -i   -z

kd -y  -i   -z



The following table explains the use of the placeholders that are used in these commands.

Sample Commands
You can use the following sample commands to open the dump file. These commands assume the following:
 * The contents of the I386 folder on the Windows CD-ROM are copied to the C:\Windows\I386 folder.
 * Your dump file is named C:\Windows\Minidump\Minidump.dmp.

Sample 1:

kd -y srv*c:\symbols*http://msdl.microsoft.com/download/symbols -i c:\windows\i386 -z c:\windows\minidump\minidump.dmp

Sample 2. If you prefer the graphical version of the debugger instead of the command line version, type the following command instead:

windbg -y srv*c:\symbols*http://msdl.microsoft.com/download/symbols -i c:\windows\i386 -z c:\windows\minidump\minidump.dmp

back to the top

Examine the dump file
There are several commands that you can use to gather information in the dump file, including the following commands:
 * The !analyze -show command displays the Stop error code and its parameters. The Stop error code is also known as the bug check code.
 * The !analyze -v command displays verbose output.
 * The lm N T command lists the specified loaded modules. The output includes the status and the path of the module.

Note The !drivers extension command displays a list of all drivers that are loaded on the destination computer, together with summary information about their memory use. The !drivers extension is obsolete in Windows XP and later. To display information about loaded drivers and other modules, use the lm command. The lm N T command displays information in a format that is similar to the old !drivers extension.

For help with other commands and for complete command syntax, see the debugging tools Help documentation. The debugging tools Help documentation can be found in the following location:

C:\Program Files\Debugging Tools for Windows\Debugger.chm

Note If you have symbol-related issues, use the Symchk utility to verify that the correct symbols are loaded correctly. For additional information about using Symchk, click the following article number to view the article in the Microsoft Knowledge Base:

311503 Use the Microsoft Symbol Server to obtain debug symbol files

Simplify the commands by using a batch file
After you identify the command that you must have to load memory dumps, you can create a batch file to examine a dump file. For example, create a batch file and name it Dump.bat. Save it in the folder where the debugging tools are installed. Type the following text in the batch file:

cd &quot;c:\program files\debugging tools for windows&quot;

kd -y srv*c:\symbols*http://msdl.microsoft.com/download/symbols -i c:\windows\i386 -z %1

When you want to examine a dump file, type the following command to pass the dump file path to the batch file:

dump c:\windows\minidump\minidump.dmp

back to the top

Additional query words: hang stop responding quits reboot restart crash blue screen of death bsod

Keywords: kbhowto kbenv kbinfo KB315263

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.