How to Obtain a Kernel Memory Dump file in Server Core of Windows Server 2008

Roop — Mon, 10 Mar 2008 12:34:00 GMT

If a Kernel memory dump is needed for troubleshooting purposes, the following methods may be used:

■ Crash.exe (available with Microsoft Support)– both the command line and GUI versions of Crash.exe may be used to create a memory dump file on Server Core.

■ CrashOnCTRLScroll – the “CTRL+Scroll Lock+Scroll Lock” keyboard sequence may be used to “crash” a server to create a memory dump file after editing the registry to add the CrashOnCTRLScroll DWORD value, set to 1, in the following key and restarting the server:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\
Parameters

Note

The CrashOnCTRLScroll process is described in the following Knowledge Base article:

244139 Windows feature lets you generate a memory dump file by using the keyboard
http://support.microsoft.com/default.aspx?scid=kb;EN-US;244139

As with previous versions of Windows, prior to creating a memory dump, the paging file and memory dump type must be configured and the server must be restarted. To create a Complete memory dump, the paging file must be located on the System drive and sized to at least (installed memory + 50MB). The paging file may be configured using the steps discussed in the “Configure the Paging File” topic in the Initial Configuration of Server Core section of this module.

By default, Windows Server 2008 is configured to create a Kernel memory dump when a Kernel exception occurs. The memory dump type is defined by the CrashDumpEnabled DWORD value in the following registry key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl

Valid CrashDumpEnabled registry values are as follows:

■ 0x0 = None

■ 0x1 = Complete memory dump

■ 0x2 = Kernel memory dump

■ 0x3 = Small memory dump (64KB)

Other settings that are available in the Startup and Recovery options on a full installation of Windows Server 2008 are also located in the CrashControl registry key as shown in the following table.

Table 16: Full Windows Server 2008 Startup and Recovery Option Registry Values

Startup and Recovery UI Option	Registry value (value range)
Write an event to the System log	Logevent (0, 1)
Automatically restart	AutoReboot (0,1)
Write debugging information	CrashDumpEnabled (see above)
Dump file	DumpFile (path\<dump file name>.dmp)
Overwrite any existing file	Overwrite (0,1)

PERFGURU : Dump

How to Obtain a Kernel Memory Dump file in Server Core of Windows Server 2008