Manual Memory Dump Configuration Checklist for Windows Operating Systems (Physical Servers)
Hello Readers,
I see that we have lots of information about setting up a memory dump on a server for diagnostics. However, I found that there needs to be straight forward checklist or a summary of important points that needs to be verified to ensure we get a proper memory dump.
This is the reason behind this post, so that it can help you when Microsoft PSS team asks you to setup the server for a Kernel or Complete memory dump.
The steps may vary depending on RAM and server configuration, but I have tried to make it as simple and generic as possible so that it can be of use. Please browse through the topics below as per your OS version. The scope is to provide quick summary or checklist assuming user is aware of different types of dumps and when to configure them.
****
Windows Server 2003 / Windows XP,** x86 (32bit OS) & x64 (64bit OS)
Kernel Memory Dump:**
þ Page File is Mandatory on C:\ Drive i.e. on System Drive and cannot be present on any other drives, No Split page files allowed.
þ Memory.dmp file location can be redirected to any location as per available disk space. (C:\ or D:\ etc.)
þ Page File Size: Usually 2GB + 200MB if x86 server. In case of x64 servers you can choose anything between 4GB or 8GB or 16GB (depends on server usage & RAM). (Additional 200MB is to ensure that there is enough page file space to include dump header information )
þ Check Free Disk Space ( Should accommodate new Page File Size + Memory Dump file size as per setup )
þ Disable ASR (Automatic System Restore - Hardware Feature) if exist.
þ Dump will be generated only if the disks are available at system boot, SAN boot servers may not generate a dump, if the disk is not available.
Registry Keys to be set:
þ HKLM\SYSTEM\CurrentControlSet\Control\CrashControl - CrashDumpEnabled REG_DWORD 0x2.
þ If using PS2 keyboard : HKLM\System\CurrentControlSet\Services\i8042prt\Parameters - CrashOnCtrlScroll REG_DWORD value of 0x01.
þ If using USB Keyboard : HKLM\System\CurrentControlSet\Services\kbdhid\Parameters - CrashOnCtrlScroll REG_DWORD value of 0x01.
þ If using NMI : HKLM\SYSTEM\CurrentControlSet\Control\CrashControl - NMICrashDump REG_DWORD value of 0x01.
Additional Information :
þ A server restart is required for these changes to take effect – Mandatory.
þ Recommended to do a test dump after these changes so as to ensure that the settings are correct – Optional.
þ iLO / KVM / DRAC access to be available so that you can check the console for the progress when dump is being generated – Optional.
Complete / Full Memory Dump:
þ Page File is Mandatory on C:\ Drive i.e. on System Drive and cannot be present on any other drives. No Split page files allowed.
þ Memory.dmp file location can be redirected to any location as per available disk space. (C:\ or D:\ etc.,)
þ Page File Size: Usually RAM + 200MB (Additional 200MB is to ensure that there is enough page file space to include dump header information )
þ Check Free Disk Space ( Should accommodate new Page File Size + Memory Dump file size as per setup )
þ Disable ASR (Automatic System Restore - Hardware Feature ) if exist.
þ Dump will be generated only if the disks are available at system boot, SAN boot servers may not generate a dump, if the disk is not available.
Registry Keys to be set:
þ HKLM\SYSTEM\CurrentControlSet\Control\CrashControl - CrashDumpEnabled REG_DWORD 0x1.
þ If using PS2 keyboard : HKLM\System\CurrentControlSet\Services\i8042prt\Parameters - CrashOnCtrlScroll REG_DWORD value of 0x01.
þ If using USB Keyboard : HKLM\System\CurrentControlSet\Services\kbdhid\Parameters - CrashOnCtrlScroll REG_DWORD value of 0x01.
þ If using NMI : HKLM\SYSTEM\CurrentControlSet\Control\CrashControl - NMICrashDump REG_DWORD value of 0x01
Additional Information :
þ A server restart is required for these changes to take effect. – Mandatory.
þ Recommended to do a test dump after these changes so as to ensure that the settings are correct – Optional.
þ iLO / KVM / DRAC access to be available so that you can check the console for the progress when dump is being generated – Optional.
**
Windows Server 2008 / Windows Vista, x86 (32bit OS) & x64 (64bit OS)
**
Kernel Memory Dump:
þ Page File can be on C drive if there is enough space, no split page files allowed. If no space available, page file can be on other drives as well.
þ When no free space on C Drive and you choose to use other drive you need to add additional registry keys. (DedicatedDumpFile & DumpFileSize)
þ Even when using DedicatedDumpFile, there must be at least one paging file on any of the partitions. Size of the paging file is not important in this case.
(DedicatedDumpFile key will be used as the placeholder for writing the data rather than using the actual page file)
þ Memory.dmp file location can be redirected to any location as per available Disk space (C:\ or D:\ etc.,)
þ Page File Size: Usually 2GB + 200MB if x86 server. In case of x64 servers you can choose anything between 4GB or 8GB or 16GB (depends on server usage & RAM). (Additional 200MB is to ensure that there is enough page file space to include dump header information )
þ Check Free Disk Space ( Should accommodate new Page File Size + Memory Dump file size as per setup )
þ Disable ASR (Automatic System Restore - Hardware Feature) if exist
þ Dump will be generated only if the disks are available at system boot, SAN boot servers may not generate a dump, including Spanned, Striped or RAID 5 volumes
Registry Keys to be set:
þ HKLM\SYSTEM\CurrentControlSet\Control\CrashControl - CrashDumpEnabled REG_DWORD 0x2.
þ If using PS2 keyboard : HKLM\System\CurrentControlSet\Services\i8042prt\Parameters - CrashOnCtrlScroll REG_DWORD value of 0x01.
þ If using USB Keyboard : HKLM\System\CurrentControlSet\Services\kbdhid\Parameters - CrashOnCtrlScroll REG_DWORD value of 0x01.
þ If using NMI : HKLM\SYSTEM\CurrentControlSet\Control\CrashControl - NMICrashDump REG_DWORD value of 0x01.
When using Dedicated Dump Files:
þ HKLM\SYSTEM\CurrentControlSet\Control\CrashControl - DedicatedDumpFile REG_SZ value of <drive>:\dedicateddumpfile.sys>
þ HKLM\SYSTEM\CurrentControlSet\Control\CrashControl - DumpFileSize REG_DWORD value in Decimal as required (This will be treated in megabytes)
þ HKLM\System\CurrentControlSet\Control\CrashControl - DumpFile REG_EXPAND_SZ value as <drive>:\Memory.dmp>
Additional Information:
þ In case you see the following event after setting up server for dump, but no dump generated, add the below key - Optional
Event ID: 49; Event Source: volmgr; Configuring the Page file for crash dump failed.
HKLM\System\CurrentControlSet\Control\CrashControl - IgnorePagefileSize REG_DWORD value as 1.
þ A server restart is required for these changes to take effect – Mandatory.
þ Recommended to do a test dump after these changes so as to ensure that the settings are correct – Optional.
þ iLO / KVM / DRAC access to be available so that you can check the console for the progress when dump is being generated – Optional.
Complete / Full Memory Dump:
þ Page File can be on C drive if there is enough space, no split page files allowed. If no space available, page file can be on other drives as well.
þ When no free space and you choose to use other drive you need to add additional registry keys. (DedicatedDumpFile & DumpFileSize)
þ Even when using DedicatedDumpFile, there must be at least one paging file on any of the partitions. Size of the paging file is not important in this case.
(DedicatedDumpFile key will be used as the placeholder for writing the data rather than using the actual page file)
þ Memory.dmp file location can be redirected to any location as per available Disk space (C:\ or D:\ etc.,)
þ Page File Size: Usually RAM + 200MB (Additional 200MB is to ensure that there is enough page file space to include dump header information)
þ Check Free Disk Space ( Should accommodate new Page File Size + Memory Dump file size as per setup )
þ Disable ASR (Automatic System Restore - Hardware Feature) if exist
þ Dump will be generated only if the disks are available at system boot, SAN boot servers may not generate a dump, including Spanned, Striped or RAID 5 volumes
Registry Keys to be set:
þ HKLM\SYSTEM\CurrentControlSet\Control\CrashControl - CrashDumpEnabled REG_DWORD 0x1.
þ If using PS2 keyboard: HKLM\System\CurrentControlSet\Services\i8042prt\Parameters - CrashOnCtrlScroll REG_DWORD value of 0x01.
þ If using USB Keyboard: HKLM\System\CurrentControlSet\Services\kbdhid\Parameters - CrashOnCtrlScroll REG_DWORD value of 0x01.
þ If using NMI: HKLM\SYSTEM\CurrentControlSet\Control\CrashControl - NMICrashDump REG_DWORD value of 0x01.
When using Dedicated Dump Files:
þ HKLM\SYSTEM\CurrentControlSet\Control\CrashControl - DedicatedDumpFile REG_SZ value of <drive>:\dedicateddumpfile.sys>
þ HKLM\SYSTEM\CurrentControlSet\Control\CrashControl - DumpFileSize REG_DWORD value in Decimal as required (This will be treated in megabytes)
þ HKLM\System\CurrentControlSet\Control\CrashControl - DumpFile REG_EXPAND_SZ value as <drive>:\Memory.dmp>
Additional Information:
þ Only In case you see the following event after setting up server for dump, but no dump generated, add the below key - Optional
Event ID: 49; Event Source: volmgr; Configuring the Page file for crash dump failed
HKLM\System\CurrentControlSet\Control\CrashControl - IgnorePagefileSize REG_DWORD value as 1
þ A server restart is required for these changes to take effect – Mandatory.
þ Recommended to do a test dump after these changes so as to ensure that the settings are correct – Optional.
þ iLO / KVM / DRAC access to be available so that you can check the console for the progress when dump is being generated – Optional.
**
Windows Server 2008 R2 / Windows 7, x86 (32bit OS) & x64 (64bit OS) as applicable
**
Kernel Memory Dump:
þ Page File can be present on any drive, no split page file allowed
þ If KB2716542 is installed then you do not need DedicatedDumpFile settings, page file can directly be set on any drives.
(Crashdmp.sys & Ntoskrnl.exe file version equal or greater than the one mentioned in the above KB. If you cannot get this installed for any reason, then you need to follow the same checklist for 2008/Vista as below)
þ Memory.dmp file location can be redirected to any location as per available Disk space (C:\ or D:\ etc.,)
þ Page File Size: Usually 2GB + 200MB if x86 system. In case of x64 servers you can choose anything between 4GB or 8GB or 16GB (depends on server usage & RAM). (Additional 200MB is to ensure that there is enough page file space to include dump header information)
þ Check Free Disk Space ( Should accommodate new Page File Size + Memory Dump file size as per setup )
þ Disable ASR (Automatic System Restore - Hardware Feature) – if exist
þ Dump will be generated only if the disks are available at system boot, SAN boot servers may not generate a dump, if the disk is not available.
Registry Keys to be set:
þ HKLM\SYSTEM\CurrentControlSet\Control\CrashControl - CrashDumpEnabled REG_DWORD 0x2.
þ If using PS2 keyboard: HKLM\System\CurrentControlSet\Services\i8042prt\Parameters - CrashOnCtrlScroll REG_DWORD value of 0x01.
þ If using USB Keyboard: HKLM\System\CurrentControlSet\Services\kbdhid\Parameters - CrashOnCtrlScroll REG_DWORD value of 0x01.
þ If using NMI: HKLM\SYSTEM\CurrentControlSet\Control\CrashControl - NMICrashDump REG_DWORD value of 0x01.
If you are using Dedicated Dump Files:
þ HKLM\SYSTEM\CurrentControlSet\Control\CrashControl - DedicatedDumpFile REG_SZ value of <drive>:\dedicateddumpfile.sys>
þ HKLM\SYSTEM\CurrentControlSet\Control\CrashControl - DumpFileSize REG_DWORD value in Decimal as required (This will be treated in megabytes)
þ HKLM\System\CurrentControlSet\Control\CrashControl - DumpFile REG_EXPAND_SZ value as <drive>:\Memory.dmp>
Additional Information:
þ A server restart is required for these changes to take effect.
þ Recommended to do a test dump after these changes so as to ensure that the settings are correct – Optional.
þ iLO / KVM / DRAC access to be available so that you can check the console for the progress when dump is being generated – Optional.
Complete / Full Memory Dump:
þ Page File can be present on any drive, no split page file allowed.
þ If KB2716542 is installed then you do not need DedicatedDumpFile settings, page file can directly set on any drives.
(Crashdmp.sys & Ntoskrnl.exe file version equal or greater than the one mentioned in the above KB. If you cannot get this installed for any reason, then you need to follow the same checklist for 2008/Vista as below)
þ Memory.dmp file location can be redirected to any location as per available Disk space (C:\ or D:\ etc.,)
þ Page File Size: Usually RAM + 200MB. (Additional 200MB is to ensure that there is enough page file space to include dump header information)
þ Check Free Disk Space (Should accommodate new Page File Size + Memory Dump file size as per setup).
þ Disable ASR (Automatic System Restore - Hardware Feature) – if exist
þ Dump will be generated only if the disks are available at system boot, SAN boot servers may not generate a dump, if the disk is not available.
Registry Keys to be set:
þ HKLM\SYSTEM\CurrentControlSet\Control\CrashControl - CrashDumpEnabled REG_DWORD 0x1.
þ If using PS2 keyboard : HKLM\System\CurrentControlSet\Services\i8042prt\Parameters - CrashOnCtrlScroll REG_DWORD value of 0x01.
þ If using USB Keyboard : HKLM\System\CurrentControlSet\Services\kbdhid\Parameters - CrashOnCtrlScroll REG_DWORD value of 0x01.
þ If using NMI : HKLM\SYSTEM\CurrentControlSet\Control\CrashControl - NMICrashDump REG_DWORD value of 0x01.
If you are using Dedicated Dump Files:
þ HKLM\SYSTEM\CurrentControlSet\Control\CrashControl - DedicatedDumpFile REG_SZ value of <drive>:\dedicateddumpfile.sys>
þ HKLM\SYSTEM\CurrentControlSet\Control\CrashControl - DumpFileSize REG_DWORD value in Decimal as required (This will be treated in megabytes)
þ HKLM\System\CurrentControlSet\Control\CrashControl - DumpFile REG_EXPAND_SZ value as <drive>:\Memory.dmp>
Additional Information:
þ A server restart is required for these changes to take effect.
þ Recommended to do a test dump after these changes so as to ensure that the settings are correct – Optional.
þ iLO / KVM / DRAC access to be available so that you can check the console for the progress when dump is being generated – Optional.
**Windows Server 2012 & 2012 R2 / Windows 8 & 8.1, x86 (32bit OS) & x64 (64bit OS) as applicable
**
Kernel Memory Dump:
þ No Page File required for a memory Dump generation. However, you can also set a minimum page file as in 2008 R2 and get a dump as well.
þ Dump can also be generated using the (DedicatedDumpFile & DumpFileSize) as well if required.
þ Even when using DedicatedDumpFile, there must be at least one paging file on any of the partitions. Size of the paging file is not important in this case.
(DedicatedDumpFile key will be used as the placeholder for writing the data rather than using the actual page file)
þ Memory.dmp file location can be redirected to any location as per available Disk space (C:\ or D:\ etc.,)
þ Page File Size: Usually 2GB + 200MB if x86 system . In case of x64 servers you can choose anything between 4GB or 8GB or 16GB (depends on server usage & RAM. (Additional 200MB is to ensure that there is enough page file space to include dump header information)
þ Check Free Disk Space ( Should accommodate new Page File Size + Memory Dump file size as per setup )
þ Disable ASR (Automatic System Restore - Hardware Feature) if exist
þ Dump will be generated only if the disks are available at system boot, SAN boot servers may not generate a dump, if the disk is not available.
Registry Keys to be set:
þ HKLM\SYSTEM\CurrentControlSet\Control\CrashControl - CrashDumpEnabled REG_DWORD 0x2.
þ If using PS2 keyboard: HKLM\System\CurrentControlSet\Services\i8042prt\Parameters - CrashOnCtrlScroll REG_DWORD value of 0x01.
þ If using USB Keyboard: HKLM\System\CurrentControlSet\Services\kbdhid\Parameters - CrashOnCtrlScroll REG_DWORD value of 0x01.
þ If using NMI: HKLM\SYSTEM\CurrentControlSet\Control\CrashControl - NMICrashDump REG_DWORD value of 0x01.
If you are using Dedicated Dump Files:
þ HKLM\SYSTEM\CurrentControlSet\Control\CrashControl - DedicatedDumpFile REG_SZ value of <drive>:\dedicateddumpfile.sys>
þ HKLM\SYSTEM\CurrentControlSet\Control\CrashControl - DumpFileSize REG_DWORD value in Decimal as required (This will be treated in megabytes)
þ HKLM\System\CurrentControlSet\Control\CrashControl - DumpFile REG_EXPAND_SZ value as <drive>:\Memory.dmp>
Additional Information:
þ A server restart is required for these changes to take effect.
þ Recommended to do a test dump after these changes so as to ensure that the settings are correct – Optional.
þ iLO / KVM / DRAC access to be available so that you can check the console for the progress when dump is being generated – Optional.
Complete / Full Memory Dump:
þ No Page File required for a memory Dump generation. However, you can also set a minimum page file as in 2008 R2 and get a dump as well.
þ Dump can also be generated using the (DedicatedDumpFile & DumpFileSize) as well if required.
þ Even when using DedicatedDumpFile, there must be at least one paging file on any of the partitions. Size of the paging file is not important in this case.
(DedicatedDumpFile key will be used as the placeholder for writing the data rather than using the actual page file)
þ Memory.dmp file location can be redirected to any location as per available Disk space (C:\ or D:\ etc.,)
þ Page File Size: Usually RAM + 200MB (Additional 200MB is to ensure that there is enough page file space to include dump header information)
þ Check Free Disk Space ( Should accommodate new Page File Size + Memory Dump file size as per setup )
þ Disable ASR (Automatic System Restore - Hardware Feature) if exist
þ Dump will be generated only if the disks are available at system boot, SAN boot servers may not generate a dump, if the disk is not available.
Registry Keys to be set:
þ HKLM\SYSTEM\CurrentControlSet\Control\CrashControl - CrashDumpEnabled REG_DWORD 0x1.
þ If using PS2 keyboard : HKLM\System\CurrentControlSet\Services\i8042prt\Parameters - CrashOnCtrlScroll REG_DWORD value of 0x01.
þ If using USB Keyboard : HKLM\System\CurrentControlSet\Services\kbdhid\Parameters - CrashOnCtrlScroll REG_DWORD value of 0x01.
þ If using NMI : HKLM\SYSTEM\CurrentControlSet\Control\CrashControl - NMICrashDump REG_DWORD value of 0x01.
If you are using Dedicated Dump Files:
þ HKLM\SYSTEM\CurrentControlSet\Control\CrashControl - DedicatedDumpFile REG_SZ value of <drive>:\dedicateddumpfile.sys>
þ HKLM\SYSTEM\CurrentControlSet\Control\CrashControl - DumpFileSize REG_DWORD value in Decimal as required (This will be treated in megabytes)
þ HKLM\System\CurrentControlSet\Control\CrashControl - DumpFile REG_EXPAND_SZ value as <drive>:\Memory.dmp>
Additional Information:
þ A server restart is required for these changes to take effect.
þ Recommended to do a test dump after these changes so as to ensure that the settings are correct – Optional.
þ iLO / KVM / DRAC access to be available so that you can check the console for the progress when dump is being generated – Optional.
Note: Above details are based on my experience and working scenarios that I have tested. Should there be a change in the behavior, please feel free to contribute.
Other useful Links related to the Memory Dump configuration:
Overview of memory dump file options: http://support.microsoft.com/kb/254649
It is possible to generate memory dump with different key combinations other than right Ctrl+Scroll+lock: http://msdn.microsoft.com/en-us/library/windows/hardware/ff545499(v=vs.85).aspx
Automated tool for Memory Dump Configurations: http://www.codeplex.com/WinPlatTools/SourceControl/changeset/view/14600#256939
PowerShell script to list current Memory Dump configurations: http://gallery.technet.microsoft.com/scriptcenter/Get-MemoryDump-c5ab38d8
Until Next time, it's Edwin Rocky. I will come back with another interesting and useful post.