When a Stop error occurs, Windows Server 2003 displays information that can help you analyze the root cause of the problem. Windows Server 2003 writes the information to the paging file (Pagefile.sys) on the systemdrive root by default. When you restart the computer in Start Windows Normally mode (commonly called “normal mode”) or Safe Mode after a Stop error occurs, Windows Server 2003 uses the paging file information to create a memory dump file in the systemroot or systemroot\Minidump folder. Analyzing dump files can provide more information about the root cause of a problem and lets you perform offline analysis by running analysis tools on another computer.
Configuring Memory Dump Files
You can configure your system to generate one of three different types of dump files:
• Small memory dump files. Sometimes referred to as “mini” dump files, these dump files contain the least information. Small memory dump files can be written to disk quickly, which minimizes server downtime by allowing the operating system to restart sooner.
• Kernel memory dump files. Records the contents of kernel memory. Kernel memory dump files require a larger paging file on the boot device than small memory dump files and take longer to create when a failure has occurred. However, they record significantly more information and are more useful when you need to perform in-depth analysis.
• Complete memory dump files. Records the entire contents of physical memory when the Stop error occurred. A complete memory dump file’s size will be slightly larger than the amount of physical memory installed at the time of the error. This option is not available for computers with more than 2 gigabytes (GB) of RAM.
By default, Windows Server 2003 is configured to create complete memory dump files. You can change the locations of the dump files by using System in Control Panel. By default, small memory dump files are saved in the systemroot\Minidump folder, and kernel and complete memory dump files are saved to a file named systemroot\Memory.dmp.
Servers that use Physical Address Extensions (PAE) can create only small and kernel memory dump files. PAE enables x86-based computers running Windows Server 2003, Enterprise Edition to access up to 32 GB of memory by using the /PAE parameter in the Boot.ini file. This same parameter enables Windows Server 2003, Datacenter Edition to potentially access more than 32 GB of memory, as allowed by the hardware platform. For more information about PAE, see “PAE” in Help and Support Center for Windows Server 2003, Enterprise Edition.
Configuring Small Memory Dump Files
Small memory dump files contain the least information, but they also consume the least disk space: 64 KB for 32-bit systems and 128 KB for 64-bit systems. By default, Windows Server 2003 stores small memory dump files in the systemroot\Minidump folder. The small dump file format is identical for x86-based and Itanium-based systems.
Windows Server 2003 always creates a small memory dump file when a Stop error occurs, even when you choose the kernel or complete memory dump file options. One of the services that use small memory dump files is the Error Reporting Service. The Error Reporting Service reads the contents of a small memory dump file to help diagnose problems that cause Stop errors.
A small memory dump file records the smallest set of information that might identify the cause of the system stopping unexpectedly. For example, the small memory dump includes some of the following information:
• Stop message information. Includes the error number and additional parameters that describe the Stop error.
• A list of drivers running on the system. Identifies the modules in memory when the Stop error occurred. This device driver information includes the file name, date, version, size, and manufacturer.
• Processor context information for the process that stopped. Includes the processor and hardware state, performance counters, multiprocessor packet information, deferred procedure call information, and interrupts.
• Kernel context information for the process that stopped. Includes offset of the directory table and the page frame number database, which describes the state of every physical page in memory.
• Kernel context information for the thread that stopped. Identifies registers and interrupt request levels, and includes pointers to operating system data structures.
• Kernel-mode call stack information for the thread that stopped. Consists of a series of memory locations, and includes a pointer to the initial location.
A small memory dump file requires a paging file of at least 2 MB on the boot volume. The operating system saves each dump file with a unique file name every time a Stop error occurs. The file name includes the date the Stop error occurred. For example, Mini011003-02.dmp is the second small memory dump generated on January 10, 2003.
Small memory dump files are useful when space is limited or when you are using a slow connection to send information to technical support personnel. Because of the limited amount of information that can be included, these dump files do not include errors that were not directly caused by the thread that was running when the problem occurred.
To configure Windows Server 2003 to generate only a small memory dump file
1. In Control Panel, double-click System, and then click the Advanced tab.
2. Under Startup and Recovery, click Settings.
3. In the Write debugging information list, click Small memory dump.
4. Click OK twice, and then restart the operating system if prompted.
By default, Windows Server 2003 saves small memory dump files to the systemroot\Minidump folder. You can change the folder location by typing a new path in the Small dump directory box under the Write debugging information list.
Configuring Kernel Memory Dump Files
By default, Windows Server 2003 systems create kernel memory dump files. The kernel memory dump file is an intermediate-size dump file that records only kernel memory and can occupy several megabytes (MB) of disk space. Kernel memory dumps take longer to create than a small dump file, and thus increase the downtime associated with a system failure. On most systems, the increase in downtime is minimal. Kernel memory dumps contain additional information that might assist troubleshooting the problem. When a Stop error occurs, Windows Server 2003 saves a kernel memory dump file to a file named systemroot\Memory.dmp and creates a small memory dump file in the systemroot\Minidump folder.
Note
When debugging Windows Server 2003, it is useful to know the memory range the kernel occupies to identify components that run within that space. On 32-bit systems, the kernel occupies memory from 0x80000000 to 0xFFFFFFFF. On 64-bit systems, the kernel occupies 0x6FC0000000000000 to 0xFFFFFFFF00000000.
A kernel memory dump file records only kernel memory information, which expedites the dump file creation process. The kernel memory dump file does not include unallocated memory or any memory allocated to user-mode programs. It includes only memory allocated to the Executive, kernel, hardware abstraction layer (HAL), and file system cache, in addition to nonpaged pool memory allocated to kernel-mode drivers and other kernel-mode routines.
The size of the memory dump file will vary, but is always less than the size of the system memory. When Windows Server 2003 creates the dump file, it first writes the information to the paging file. Therefore, the paging file might grow to the size of the physical memory. Later, the dump file information is extracted from the paging file to the actual memory dump file. To ensure that you have sufficient free space, verify that the system drive would have free space greater than the size of physical memory if the paging file were extended to the size of physical memory.
For most purposes, a kernel memory dump file is sufficient for troubleshooting Stop errors. It contains more information than a small memory dump file and is smaller than a complete memory dump file. It omits those portions of memory that are unlikely to have been involved in the problem. However, there are problems that require a complete memory dump for troubleshooting. If you have configured a kernel memory dump and you experience a Stop error that requires a complete memory dump to isolate the problem, you must specify that the operating system generate a complete memory dump and reproduce the Stop error to continue troubleshooting.
To configure Windows Server 2003 to generate a kernel memory dump file
1. In Control Panel, double-click System, and then click the Advanced tab.
2. Under Startup and Recovery, click Settings.
3. In the Write debugging information list, click Kernel memory dump.
4. Click OK twice, and then restart the operating system if prompted.
By default, Windows Server 2003 saves a kernel memory dump file to systemroot\Memory.dmp. You can change the default output location by typing a new value in the Dump file box under the Write debugging information list.
Note
By default, a new kernel memory dump file overwrites an existing one. To change the default setting, clear the Overwrite any existing file check box. You can also archive or move an existing dump file to another location prior to troubleshooting.
Configuring Complete Memory Dump Files
A complete memory dump file, sometimes referred to as a “full” dump file, contains everything that was in physical memory when the Stop error occurred. This includes all of the information included in a kernel memory dump file, plus user-mode memory. Therefore, complete memory dump files can be examined to reveal the contents of memory contained within applications, although this is rarely necessary or feasible when troubleshooting application problems.
If you choose to use complete memory dump files, you must have available space on the systemdrive partition large enough to hold the contents of the physical RAM. Additionally, you must have a paging file equal to the size of your physical RAM. Complete memory dump files for Itanium-based systems typically require more disk space than complete dump files for x86-based systems.
When a Stop error occurs, the operating system saves a complete memory dump file to a file named systemroot\Memory.dmp and creates a small memory dump file in the systemroot\Minidump folder. A Microsoft technical support engineer might ask you to change this setting to facilitate data uploads over slow connections. Depending on the speed of your Internet connection, uploading the data might not be practical and you might be requested to provide the memory dump file on removable media.
To configure Windows Server 2003 to generate a complete memory dump file
1. In Control Panel, double-click System, and then click the Advanced tab.
2. Under Startup and Recovery, click Settings.
3. In the Write debugging information list, click Complete memory dump.
4. Click OK twice, and then restart the operating system if prompted.
By default, Windows Server 2003 saves a complete memory dump file to systemroot\Memory.dmp. You can change the default location by typing in a new path in the Dump file box of the Write debugging information list.
Note
By default, new complete memory dump files overwrite existing files. To change this, clear the Overwrite any existing file check box. You can also choose to archive or move a dump file prior to troubleshooting.
Ensuring Dump File Saves
To help ensure that your operating system can properly save memory dump files, verify that the system drive has adequate free space, check for adequate hard disk space, and check for disk corruption.
Verifying System Drive Free Space
Verify that adequate free space exists on the systemdrive to accommodate the maximum paging file size for the selected dump file. For example, for complete memory dump files, the available space must be at least equal to the amount of physical memory present.
To view the maximum paging file size for each disk volume
1. In Control Panel, double-click System, and then click the Advanced tab.
2. Under Performance, click Settings.
3. In the Performance Options dialog box, click the Advanced tab.
4. Under Virtual memory, click Change.
5. In the Virtual Memory dialog box, view the paging file information. Under Total paging file size for all drives, the Currently allocated value indicates the paging file disk space used.
If you click Custom size, you can specify different paging file sizes by entering values for Initial size (MB) and Maximum size (MB).
6. Verify that systemdrive has adequate disk space available to accommodate the maximum paging file size specified.
To avoid disk fragmentation when creating a memory dump, set the Initial size to a value greater than that required by the memory dump file, so that the paging file does not have to be expanded while the memory dump is created.
Checking for Adequate Hard Disk Space
Verify that the memory dump file path (by default, systemroot\Memory.dmp) contains sufficient free space to store the memory dump file. For more information about specifying disk dump file locations, see “Configuring Memory Dump Files” earlier in this chapter.
Checking for Disk Corruption
Verify that systemdrive, the volume containing the memory dump file, is not corrupted. To test hard disk or volume integrity, you can run check disk from the recovery console
