Windows 8 and Windows Server 2012: Automatic Memory Dump

Windows 8 and Windows Server 2012: Automatic Memory Dump

  • Comments 5
  • Likes

There is a new memory dump option introduced in Windows 8 and Windows Server 2012 called “Automatic memory dump.” This is the default option selected when you install Windows.

clip_image001

The “Automatic memory dump” type was created to support the “System Managed” page file configuration.

clip_image002

The “System Managed” page file has been updated to reduce the page file size on disk, primarily for small SSDs but will also benefit servers with large amounts or ram.

The “Automatic memory dump” is not really a new memory dump type. In previous versions of Windows, we already have Mini, Kernel, and Complete memory dump options. The Automatic memory dump option produces a Kernel memory dump, the difference is when you select Automatic it allows the SMSS process to reduce the page file smaller than the size of RAM.

We use the registry to store the memory dump configuration, which can be located in

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl

The value CrashDumpEnabled contains one of the following values to identify the memory dump setting

None

0x0

Complete memory dump

0x1

Kernel memory dump

0x2

Small memory dump

0x3

Automatic memory dump

0x7

When configured for Automatic memory dump, and the page file is set to System Managed, the page file should have a minimum size large enough to ensure that a kernel dump can be captured most of the time. Because the minimum size is only large enough most of the time, there is an additional feature to increase the minimum size of the page file. If your system experiences a bug check, we will create the registry key

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\LastCrashTime

For the next 4 weeks after this crash, the system managed page file will now have a minimum size that at least that of the amount of ram in the system.

As an example, the screenshots for this were taken from a system that has 16GB of ram installed. For the normally running system my page file is about 5.5GB

clip_image003

After the system experienced a bug check the page file size was increased to about 16.5GB

clip_image004

Now that the page file is larger than the amount of ram installed in the system, we will be able to capture the kernel memory dump in the situations where the smaller size was not large enough.

One question that may come up is “What happens if I change the memory dump type to Kernel instead of Automatic?” The system managed page file will have a minimum size that at least the size of ram.

On a final note, once the system is stable for 4 weeks we will go back to using the smaller reduced page file size. If you have fixed the issue causing the bug check and you want the page file size to return to its reduced size more quickly, you can delete or rename the LastCrashTime value listed above.

Robert Simpkins
Senior Support Escalation Engineer
Microsoft Enterprise Platforms Support

Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment
  • Thanks for the info. I have 2 questions:

    1. What happens when you have LastCrashTime set and there is not enough free space on the drive to create the system managed page file larger than the amount of RAM?

    2. What happens when there is not enough free space to write the dump file after system managed pagefile has been expanded as a result of LastCrashTime value and system crash?

  • What about performance impacts ?

    I knew that was better to set minimum and maximum limits at same value to avoid disk fragmentation..

  • Good Stuff.  Regarding NMI dumps. Does the NMICrashDump reg entry still need to be enabled within 2012?

  • Great Article! Thank you very much for sharing.

  • So after I change the settings to create a complete memory dump, as well as change its save to path do I need to restart the server? I too have to wonder how this will work as my c drive does not have enough room for a 16 gb pagefile