BSODs but no Dump Files?

jcgriff2

jcgriff2

Co-Founder / Admin
BSOD Instructor/Expert
Microsoft MVP (Ret.)
Staff member
Joined
Feb 19, 2012
Posts
21,541
Location
New Jersey Shore
`




No Kernel Memory Dump files being produced upon BSOD? ​

For dumps to be produced. . .
▪ Page file must be on OS drive​
▪ Page file base allocation size must be > than installed physical RAM​
▪ Windows Error Reporting (WER) system service should be set to MANUAL​
▪ Set page file to system managed, OS drive​

Set System Crash/ Recovery Settings to "Kernel Memory Dump" - this will produce. . .
--> a Full Kernel Memory Dump - c:\windows\memory.dmp
--> a Mini Kernel dump c:\windows\minidump

The Full Kernel is overwritten each BSOD; a new mini kernel dump is created w/ different name for each BSOD

To check your system's "Recoveros" (Recovery) and Page File settings via Windows Management Instrumentation (WMI), run the following -

HTML output - WMI - "Recoveros" and Page File Settings (HTML)
Text file output - WMI - "Recoveros" and Page File Settings (TEXT)

July 2012
A hotfix is available that enables a Windows 7-based or Windows Server 2008 R2-based computer to create a memory dump file without a page file

kb2716542 - A hotfix is available that enables a Windows 7-based or Windows Server 2008 R2-based computer to create a memory dump file without a page file

Additional Information -

​
To view page file settings, bring up an Admin cmd/DOS screen & paste this applet -

Or, click on START; paste the applet into the StartSearch box -
Code:
Code: 
[INDENT]SystemPropertiesPerformance.exe /pagefile[/INDENT]
​
​
​

Regards. . .

jcgriff2

.
 
Last edited:
Physical memory = 6 GB
Page File size = 5606 MB

Used NotMyFault to generate minidump.

Minidump generated successfully.
Hotfix has not been installed.
 
Erm, NotMyFault is for training purposes and is not designed to diagnose issues. I think he's just saying that he used NotMyFault to test his current config which worked. Just know that NotMyFault will create its own crashes; using it to force a crash in order to view a problem from something else is kinda counterproductive.
 
Agree - another option to see if OPs system can simply produce a dump.

I've used kb244139, ProcExp & TaskMgr to do the same.

I'm wondering now if NotMyFault belongs with the other 3 or not. Does it create a dump differently?

Any idea how karlsnooks created a dump if kb2716542 not installed & page file is ~400 MB < RAM?

I thought both current page file and page file base allocation size must be > installed physical RAM. . . or no dump will be produced.




@ karlsnooks - can you create a dump with Task Manager?

Process Explorer?

Same command for both - Right-click on an app, "Create Dump.."

Dump is written to your temp folder - \users\<username>\AppData\Local\Temp
 
Well, think of it this way, with those options you are manually triggering an exception which is technically legitimate, and the system sees that and will respond appropriately (like giving the proper bugcheck type for the key-triggered BSOD). There are no alterations done to the environment.

With NotMyFault, however, it is designed to cause corruption in the environment in one way or another, again for training purposes. This corruption will obviously complicate things if you're looking for a problem elsewhere, and may even alter the environment so that you won't find the answer you seek anyways.
 
Why Mark Russinovich wrote NotMyFault was for testing purposes to the best of my recollection.

I've never tried other methods of creating a dump file since NotMyFault gives one the opportunity to generate faults of all types.


Here is a write-up of conditions I found to be necessary to generate a dump:

[h=1]MEMORY DUMPS – REQUIREMENTS[/h]
CREATE MINIDUMP FOLDER
WIN | type %systemroot% | ENTER
If Minidump is not shown, Then
CTRL + SHIFT + N keycombo |
CONTINUE button | type Minidump | ENTER

Enable automatic management of the Paging file
WIN + PAUSE key combo |
Advanced system settings (left-hand side) |
Advanced tab, Performance section, Settings |
Advanced tab, Virtual Memory section, Change |
checkmark Automatically manage paging file size for all drives |
OK | OK | OK



STARTUP AND RECOVERY SETTINGS
WIN + PAUSE key combo |
Advanced system settings (left-hand side) |
Advanced tab, Startup and Recovery section, Settings |
System Failure section | checkmark Write an Event to the system log
| uncheck Automatically restart |


Under Write debugging information, select Small memory dump |
in the Small dump directory: box, enter %SystemRoot%\Minidump | OK

If Overwrite any existing file is checked, then:

  • Under Write debugging information, select Kernel memory dump
  • Uncheck Overwrite any existing file
  • Under Write debugging information, select Small memory dump
  • OK button

If you get a crazy message from Win 7 about your paging file being too small, then just ignore the message since we have already made sure that the paging file is set to be managed by Win 7.

ENABLE THE WINDOWS ERROR REPORTING SERVICE
WIN key | type SERVICES.MSC | ENTER |
Scroll down to Windows Error Reporting Service |
Rt-clk on Windows Error Reporting Service | Properties |
General tab | for Startup type, choose Automatic |
In Service status, Start button (unless grayed out) | OK


ASSURE THAT CCLEANER IS NOT DELETING DUMPS
CCLEANER | Cleaner icon | Windows tab | System category |
Uncheck Memory Dumps


WINDOWS ERROR REPORTING SERVICE must NOT be disabled!

  • WIN | Services.msc | Enter
  • Under Name, locate Windows Error Reporting Service
  • If Status is not Started, then
    Right-click on Windows Error Reporting Service |choose START
  • If Startup Type is not Automatic, then
    Right-click on Windows Error Reporting Service |
    choose Properties | General tab |
    set Startup type to Automatic
  • Close Services.msc (I like to use ALT + F4)

After a crash, the minidump file will be in %SystemRoot%\Minidump
%SystemRoot% is generally C:\Windows
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top