Share via

How to Obtain a Kernel Memory Dump file in Server Core of Windows Server 2008

  • Article

If a Kernel memory dump is needed for troubleshooting
purposes, the following methods may be used:

¦
Crash.exe
(available with Microsoft Support)– both the command line and GUI versions of Crash.exe may be used to create a
memory dump file on Server Core.

¦
CrashOnCTRLScroll
– the “CTRL+Scroll Lock+Scroll Lock” keyboard sequence may be used
to “crash” a server to create a memory dump file after editing the registry to
add the CrashOnCTRLScroll DWORD value, set to 1, in the following key and
restarting the server:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\

Parameters

Note

The CrashOnCTRLScroll process is described in the following Knowledge Base article:

244139 Windows feature lets you generate a memory dump file by using the keyboard https://support.microsoft.com/default.aspx?scid=kb;EN-US;244139

As with previous versions of Windows, prior to creating a
memory dump, the paging file and memory dump type must be configured and the
server must be restarted. To create a Complete memory dump, the paging file
must be located on the System drive and sized to at least (installed memory + 50MB) .
The paging file may be configured using the steps discussed in the “Configure
the Paging File” topic in the Initial Configuration of Server Core section of
this module.

By default, Windows Server 2008 is configured to create a
Kernel memory dump when a Kernel exception occurs. The memory dump type is
defined by the CrashDumpEnabled DWORD value in
the following registry key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl

Valid CrashDumpEnabled
registry values are as follows:

¦
0x0
= None

¦
0x1
= Complete memory dump

¦
0x2
= Kernel memory dump

¦
0x3
= Small memory dump (64KB)

Other settings that are available in
the Startup and Recovery options on a full installation of Windows Server 2008
are also located in the CrashControl
registry key as shown in the following table.

Table 16: Full Windows Server 2008 Startup and
Recovery Option Registry Values

Startup and Recovery UI Option

Registry value (value range)

Write an event to the System log

Logevent (0, 1)

Automatically restart

AutoReboot (0,1)

Write debugging information

CrashDumpEnabled (see above)

Dump file

DumpFile (path\<dump file name>.dmp)

Overwrite any existing file

Overwrite (0,1)