How to Obtain a Kernel Memory Dump file in Server Core of Windows Server 2008

Roop — Mon, 10 Mar 2008 12:34:00 GMT

If a Kernel memory dump is needed for troubleshooting purposes, the following methods may be used:

■ Crash.exe (available with Microsoft Support)– both the command line and GUI versions of Crash.exe may be used to create a memory dump file on Server Core.

■ CrashOnCTRLScroll – the “CTRL+Scroll Lock+Scroll Lock” keyboard sequence may be used to “crash” a server to create a memory dump file after editing the registry to add the CrashOnCTRLScroll DWORD value, set to 1, in the following key and restarting the server:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\
Parameters

Note

The CrashOnCTRLScroll process is described in the following Knowledge Base article:

244139 Windows feature lets you generate a memory dump file by using the keyboard
http://support.microsoft.com/default.aspx?scid=kb;EN-US;244139

As with previous versions of Windows, prior to creating a memory dump, the paging file and memory dump type must be configured and the server must be restarted. To create a Complete memory dump, the paging file must be located on the System drive and sized to at least (installed memory + 50MB). The paging file may be configured using the steps discussed in the “Configure the Paging File” topic in the Initial Configuration of Server Core section of this module.

By default, Windows Server 2008 is configured to create a Kernel memory dump when a Kernel exception occurs. The memory dump type is defined by the CrashDumpEnabled DWORD value in the following registry key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl

Valid CrashDumpEnabled registry values are as follows:

■ 0x0 = None

■ 0x1 = Complete memory dump

■ 0x2 = Kernel memory dump

■ 0x3 = Small memory dump (64KB)

Other settings that are available in the Startup and Recovery options on a full installation of Windows Server 2008 are also located in the CrashControl registry key as shown in the following table.

Table 16: Full Windows Server 2008 Startup and Recovery Option Registry Values

Startup and Recovery UI Option	Registry value (value range)
Write an event to the System log	Logevent (0, 1)
Automatically restart	AutoReboot (0,1)
Write debugging information	CrashDumpEnabled (see above)
Dump file	DumpFile (path\<dump file name>.dmp)
Overwrite any existing file	Overwrite (0,1)

Performance Monitoring in Server Core in Windows Server 2008

Roop — Mon, 10 Mar 2008 12:27:00 GMT

Performance Monitoring

The Reliability and Performance Monitor (RPM) console is not available on Server Core, however, the Performance Logs and Alerts service and the underlying performance subsystem is the same as a full installation of Windows Server 2008. Performance Monitoring of a Server Core server can be accomplished using the following methods:

■ Remotely using Performance Monitor on a full installation of Windows Server 2008 or Windows Vista

■ Locally on Server Core using the following command line performance monitoring tools:

Logman.exe

Logman.exe can be used to perform the following tasks:

■ Locally and remotely manage performance counter and event trace log collections.

■ Configure a data collector set on one computer and then copy that configuration to multiple computers from a central location.

■ Query currently-running logs and event traces.

Command Syntax

The following table describes logman.exe command line parameters:

Table 13: LOGMAN Command Parameters

Parameter	Description
Verbs
create	Create a new data collector.
query	Query data collector properties by name.
start	Start an existing data collector and set the begin time to manual.
stop	Stop an existing data collector and set the end time to manual.
delete	Delete an existing data collector.
update	Update an existing data collector's properties.
import	Import a data collector set from an XML file.
export	Export a data collector set to an XML file.
Options
-?	Displays context sensitive help.
-s <computer>	Perform the command on specified remote system.
-config <value>	Settings file containing command options.
-ets	Send commands to Event Trace Sessions without saving or scheduling.

A common scenario for using logman.exe on Server Core is to create a Data Collector Set using Performance Monitor on a full installation of Windows Server 2008, or Windows Vista, and export the Data Collector Set configuration as an XML template. Then, use logman.exe to import and start the Data Collector Set on a Server Core server. After exporting the Data Collector Set XML template file, the following command can be used to import the XML template using logman.exe:

logman import –n <name> -xml <filename>

where:
<name> = desired name for target Data Collector Set
<filename> = name of XML template to import

To start the Performance Monitor Data Collector Set after inporting the XML template, type the following command at the command prompt:

logman start <name>

where:
<name> = name of Data Collector Set to start

Tip

All of the configured Data Collector Sets may be listed using logman query.

The Performance Monitor log file will be created in the following folder, by default:

%systemdrive%\PerfLogs

Relog.exe

Relog can be used to create new performance logs from data in existing performance logs by changing the sampling rate and/or converting the file format. Supports all performance log formats, including Windows NT 4.0 compressed logs.

Command Syntax

relog <filename [filename ...] [options]

The following table describes Relog command line parameters.

Table 14: RELOG Command Parameters

Parameter	Description
<filename [filename ...]	Required: Performance file to relog.
Options
-?	Displays context sensitive help.
-a	Append output to the existing binary file.
-c <path [path ...]>	Counters to filter from the input log.
-cf <filename>	File listing performance counters to filter from the input log. Default is all counters in the original log file.
-f <CSV\|TSV\|BIN\|SQL>	Output file format.
-t <value>	Only write every nth record into the output file. Default is to write every record.
-o	Output file path or SQL database.
-b <M/d/yyyy h:mm:ss[AM\|PM]	Begin time for the first record to write into the output file.
-e <M/d/yyyy h:mm:ss[AM\|PM]	End time for the last record to write into the output file.
-config <filename>	Settings file containing command options.
-q	List performance counters in the input file.
-y	Answer yes to all questions without prompting.

Typeperf.exe

Typeperf.exe can be used to perform the following tasks:

■ Write performance data to the command window or to a supported log file format (csv | tsv | bin | sql).

■ Display all of the counters that are currently available on a particular local or remote computer.

Command Syntax

typeperf { <counter [counter ...]>

| -cf <filename>

| -q [object]

| -qx [object]

} [options]

The following table describes typeperf command line parameters

Typeperf.exe supports the following commands:

Table 15: Typeperf Command Parameters

Parameter

Description

<counter [counter ...]>

Required: Performance counters to monitor.

Note

The counter parameter(s) specify the full name of a performance counter in \\<Computer>\<object>(<instance>)\<counter> format.

Example: \\Server1\Processor(0)\% User Time

Options

-f <CSV|TSV|BIN|SQL>

Output file format. Default is CSV.

-cf <filename>

File containing performance counters to monitor, one per line.

-si <[[hh:]mm:]ss>

Time between samples. Default is 1 second.

-o <filename>

Path of output file or SQL database. Default is STDOUT.

-q [object]

List installed counters (no instances). To list counters for one object, include the object name, such as Processor.

-qx [object]

List installed counters with instances. To list counters for one object, include the object name, such as Processor.

-sc <samples>

Number of samples to collect. Default is to sample until CTRL+C.

-config <filename>

Settings file containing command options.

-s <computer_name>

Server to monitor if no server is specified in the counter path.

-y

Answer yes to all questions without prompting.

Displays context sensitive help.

PERFGURU : Server Core

How to Obtain a Kernel Memory Dump file in Server Core of Windows Server 2008

Performance Monitoring in Server Core in Windows Server 2008

Performance Monitoring

Logman.exe

Command Syntax

Relog.exe

Command Syntax

Typeperf.exe

Command Syntax