Freigeben über

Not getting kernel memory dumps in Windows Vista or Windows 2008?

  • Artikel

Backstory:

With the advent of Windows Vista there are changes made in how the operating system determines if it can take a kernel memory dump or not.  Starting in Vista the amount of memory allocated for kernel mode could vary dynamically.  If the pagefile is not big enough, switching to minidump at dump time can’t be done easily.  So the dump stack initialization is happening at the time of boot where this check for the pagefile size is done.

What does this mean?  It means if you don't have a pagefile as large as physical memory at boot, and your system is configured for a kernel dump, you'll end up getting a minidump.  If you permit me to opine, this makes sense in the client space where a valid dump is more critical than a corrupted kernel dump, as the results usually would get uploaded to Microsoft via WERCON or another mechanism.  If further triage is needed MSFT could contact you with the ability to setup a kernel capture. 

In the Server world though, it's different.  We have thousands of x64 systems with 16GBs of RAM and there is no way we could have a 16GB page file as the system either does not have the space (on C), or it does not make fiscal sense with regards to disk space.  We have all our systems configured to take kernel dumps in case we crash the server via debugger/keyboard.  We dogfood our beta operating systems, and a hung server is a normal site to see, and sometimes we can't break in via the debugger and a crash dump is our last and only resort.  Crashing a box and ending up with a minidump does not suffice in our role.

 

The change in Vista SP1 RC0/Windows 2008 RC0 on:

Starting with the release of RC0, there is a new registry key that can be set which will tell the OS to ignore the page file check on boot up and you'll take your chances getting a valid kernel dump.  We've tested this internally and all works as expected.  So if you need kernel dumps on your large memory systems, this might be something to remember for your bag of tricks. 

 

Key: HKLM\System\CurrentControlSet\Control\CrashControl

Value: IgnorePagefileSize

Type: DWORD

Data: 1

Technorati tags: Windows 2008, Vista, Debugging

Comments