RE: Sometimes I just can't get crash dump files to g enerate...

WINDBG
1

It happened to me once that Win2K SP3 did not generate crash dump because my
boot disk did not have enough free space. I had to increase free disk space
(by deleting unused files) for crash dump file to be generated.

-----Original Message-----
From: Nate Bushman [mailto:xxxxx@powerquest.com]
Sent: Wednesday, September 03, 2003 12:06 PM
To: Kernel Debugging Interest List
Subject: [windbg] RE: Sometimes I just can’t get crash dump files to g
ener ate…

That may be, although the one that I’m seeing is
KMODE_EXCEPTION_NOT_HANDLED but no crash dump file is being generated.
I’m positive that this bug check does (if possible) generate dump files.

-----Original Message-----
From: McDowell, Steve [mailto:xxxxx@softek.fujitsu.com]
Sent: Wednesday, September 03, 2003 9:36 AM
To: Kernel Debugging Interest List
Subject: [windbg] RE: Sometimes I just can’t get crash dump files to g
ener ate…

I believe that bugcheck INACCESSIBLE_BOOT_DEVICE doesn’t generate a
dump. Maybe that’s the one they’re seeing?

-----Original Message-----
From: Nate Bushman [mailto:xxxxx@powerquest.com]
Sent: Wednesday, September 03, 2003 8:20 AM
To: Kernel Debugging Interest List
Subject: [windbg] RE: Sometimes I just can’t get crash dump files to g
ener ate…

Now that’s a good and useful insight. Thank you, MaryBeth.

-----Original Message-----
From: Croci, MaryBeth [mailto:xxxxx@stratus.com]
Sent: Wednesday, September 03, 2003 7:03 AM
To: Kernel Debugging Interest List
Subject: [windbg] RE: Sometimes I just can’t get crash dump files to g
ener ate…

They might have a driver installed on their machine with a buggy
BugCheckCallback routine.

-----Original Message-----
From: Phung, Tri T [mailto:xxxxx@unisys.com]
Sent: Wednesday, September 03, 2003 8:54 AM
To: Kernel Debugging Interest List
Subject: [windbg] RE: Sometimes I just can’t get crash dump files to
gener ate…

Did you verify that the “Write Debugging Information” option in the
“Startup
and Recovery” popup is set to “Kernel Memory Dump” or “Complete Memory
Dump”? The “Startup and Recovery” popup can be brought up by clicking
the
“Startup and Recovery” button in the “Advanced” tap of the System
Properties
screen.

Tri

-----Original Message-----
From: Nate Bushman [mailto:xxxxx@powerquest.com]
Sent: Tuesday, September 02, 2003 6:29 PM
To: Kernel Debugging Interest List
Subject: [windbg] Sometimes I just can’t get crash dump files to
generate…

Every once in a while I run across a customer who experiences a blue
screen but just can’t seem to generate a crash dump file. I have them
make sure that their page file is on their boot volume, and that their
page file size is greater than the amount of installed RAM, but still no
crash dump file is generated during the BSOD.

What am I missing here? What are some of the other requirements for
successful dump file generation?

I just heard a (likely distorted) third-hand rumor, supposedly sourced
at Microsoft, that crash dump files will never be generated for certain
bug check codes. Can this be true? If so, why, and for which codes?

Nate

You are currently subscribed to windbg as: xxxxx@unisys.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

You are currently subscribed to windbg as: xxxxx@stratus.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

You are currently subscribed to windbg as: xxxxx@powerquest.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

You are currently subscribed to windbg as: xxxxx@softek.fujitsu.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

You are currently subscribed to windbg as: xxxxx@powerquest.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

You are currently subscribed to windbg as: xxxxx@unisys.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

2

I’m a fan of using CrashOnCtrlScroll to verify that a dump can be generated

  • it increases confidence that a dump will be written at the next failure.

http://support.microsoft.com/default.aspx?scid=kb;en-us;244139

Compaq Automatic System Recovery (ASR) being active has meant that we’ve
only got partial dumps in the past.

I’ve also been victim of “issues” on machines with 4Gb of ram - resolved
with hotfixes.

Alastair.

-----Original Message-----
From: Andreas Hansson [mailto:xxxxx@briljant.se]
Sent: 03 September 2003 16:17
To: Kernel Debugging Interest List

I have had this exact same problem on my own computer. I’ve been trying
various settings - full memory dump, kernel dump, reboot automatically or
not, but I never got a dump from my blue screens.

The specs:

Windows 2000 Professional, sp3, swedish
Pentium III, 256 MB ram
500-some MB swap file on C:, which runs NTFS and is boot drive

In one instance, the blue screen was generated by a double irp completion in
a capture card driver I was developing. I have no reason to believe that the
driver would be corrupting anything to disrupt the dump writing.

When the system blue screened, I could see hard drive activity as if the
dump was being written, but when the system got back up, there was no dump.
I don’t know exactly how the dump writing works, but it seems to me like the
dump was written down to hard drive but not copied out of the pagefile on
the next reboot?

I have since upgraded the system to 768 MB ram and sp4 and haven’t tried to
generate any crash dumps since, but if anyone has any ideas for getting dump
writing working I’d be happy to try again.

Andreas

----- Original Message -----
From: “Nate Bushman”
To: “Kernel Debugging Interest List”
Sent: Wednesday, September 03, 2003 12:29 AM
Subject: [windbg] Sometimes I just can’t get crash dump files to generate…

Every once in a while I run across a customer who experiences a blue
screen but just can’t seem to generate a crash dump file. I have them
make sure that their page file is on their boot volume, and that their
page file size is greater than the amount of installed RAM, but still no
crash dump file is generated during the BSOD.

What am I missing here? What are some of the other requirements for
successful dump file generation?

I just heard a (likely distorted) third-hand rumor, supposedly sourced
at Microsoft, that crash dump files will never be generated for certain
bug check codes. Can this be true? If so, why, and for which codes?

Nate

—
You are currently subscribed to windbg as:
xxxxx@services.fujitsu.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Well, I don’t know how helpful this is, but I can tell you that this does
NOT sound like the symptom of a buggy BugCheckCallback routine. In that
case, the KeBugCheck code wouldn’t even execute the crash dump code. Since
you are seeing the dump reporting from 0 to 100%, this rules out that
possibility.

Your statement “After it had completed and been quiet for 10 or so seconds,
I proceeded to reset the machine…” might be a clue. Once the OS has
completed writing the crash dump, it should reboot on its own. You
shouldn’t have to reset it. Exactly what did you do to “reset” it?

Sorry I can’t provide anything more useful, other than don’t waste your time
looking for BugCheckCallback routines. Maybe someone else will be able to
add more…

Marybeth Croci

-----Original Message-----
From: Andreas Hansson [mailto:xxxxx@briljant.se]
Sent: Monday, September 08, 2003 8:38 AM
To: Kernel Debugging Interest List
Subject: [windbg] Re: Sometimes I just can’t get crash dump files to
generate…

Hej Nate, and the list

I have tried generating a crash dump again, and had no success. I increased
my paging file to 1024 MB on C: (boot drive, 14 GB free space) (768 MB RAM
in the machine). I set the recovery options to write an event log entry,
send an administrative alert, dump kernel memory to %SystemRoot%\MEMORY.DMP
and overwrite any existing file.

I then tried to generate a crash dump using BANG! from OSR online,
http://www.osronline.com/article.cfm?id=153, but was unsuccessful. I got a
blue screen, claiming to write a crash dump, with disk activity and the
counter going from 0 to 100 %. After it had completed and been quiet for 10
or so seconds, I proceeded to reset the machine and look for the crash dump
and found nothing. No crash dump, no event log entry. The only entries I got
were “Microsoft (R) Windows 2000 (R) 5.0 2195 Service Pack 4 Uniprocessor
Free.” and that the EventLog service had been started.

I have a Seagate ST3120026A 120 GB IDE hard drive, sitting as a single
master connected to the primary onboard IDE channel on a Giga-Byte
GA-6VX7-4X motherboard. There is no anti-virus software running on the
machine.

How can I check for drivers with BugCheckCallback functions? Or check the
storage stack for misbehaving drivers?

Unfortunately, the only machine anywhere near this one is a 486 running
Windows 95 that I don’t think windbg will run on, and a modern laptop
without a serial port, which makes windbg kernel debugging hard.

Grateful for any advice / tacksam f?r r?d

Andreas

----- Original Message -----
From: “Nate Bushman”
To: “Kernel Debugging Interest List”
Sent: Wednesday, September 03, 2003 5:34 PM
Subject: [windbg] Re: Sometimes I just can’t get crash dump files to
generate…

Tjena,

As I understand it, when a blue screen occurs and the system is
configured to generate a crash dump file, some or all of the data in RAM
(depending on the dump configuration) will be written (if possible) to
the page file. When the system reboots, before paging is activated the
crash data is copied out of the page file into the dump file. For this
reason you need to ensure that, for full memory dumps, the page file
size is at least as large as the amount of installed RAM. I’ve also
heard that it’s necessary to ensure that the page file resides on the
boot volume if you want to successfully generate crash dump files.

I don’t know if this flush of RAM data to the paging file involves the
drivers in the paging path. My guess is that it doesn’t, but that there
are some smarts built into the kernel to be able to write to the page
file independent of the storage stack drivers. Anyone?

So maybe failed crash dump file generation is caused when the crash
interferes with the kernel’s built-in ability to write to the page file
(independent of the storage stack) or as MaryBeth suggested, perhaps
someone has a bad BugCheckCallback in their driver.

Ha det bra!

Nate

—
You are currently subscribed to windbg as: xxxxx@stratus.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

Well, the reset might be safe, but it’s worth ruling out. Since you no
longer have the 64kb dump configured, and you know that the bug check code
seems to be writing the dump, you might want to configure the automatic
reboot and see if that helps.

If savedump had trouble writing MEMORY.DMP, I think it should log something,
and you said you’re not seeing that, right?

-----Original Message-----
From: Andreas Hansson [mailto:xxxxx@briljant.se]
Sent: Monday, September 08, 2003 10:15 AM
To: Kernel Debugging Interest List
Subject: [windbg] Re: Sometimes I just can’t get crash dump files to
generate…

The reason it didn’t reset automatically was that I hadn’t set that option
in the crash recovery settings. Originally it was set to write a small 64kb
memory dump and automatically reset, which made it seem like the machine
just spontaneously rebooted - the dump was “written” so fast, and then the
machine rebooted without a trace of dump or event logs.

When I first got a blue screen on this machine, this quick reboot had me
thinking it was a triple fault or an overheating CPU. It wasn’t until I
removed the automatic reboot that I realized I was actually seeing a
bluescreen. I’ve left it off to make sure I see the difference between
bluescreens and self-resets.

To reset the machine now, when testing, I just hit the physical reset
switch. Since the hard drive activity had stopped, and I had left it time to
settle, I think resetting it should be safe.

Andreas

----- Original Message -----
From: “Croci, MaryBeth”
To: “Kernel Debugging Interest List”
Sent: Monday, September 08, 2003 2:45 PM
Subject: [windbg] Re: Sometimes I just can’t get crash dump files to g
enerate…

Well, I don’t know how helpful this is, but I can tell you that this does
NOT sound like the symptom of a buggy BugCheckCallback routine. In that
case, the KeBugCheck code wouldn’t even execute the crash dump code. Since
you are seeing the dump reporting from 0 to 100%, this rules out that
possibility.

Your statement “After it had completed and been quiet for 10 or so seconds,
I proceeded to reset the machine…” might be a clue. Once the OS has
completed writing the crash dump, it should reboot on its own. You
shouldn’t have to reset it. Exactly what did you do to “reset” it?

Sorry I can’t provide anything more useful, other than don’t waste your time
looking for BugCheckCallback routines. Maybe someone else will be able to
add more…

Marybeth Croci

-----Original Message-----
From: Andreas Hansson [mailto:xxxxx@briljant.se]
Sent: Monday, September 08, 2003 8:38 AM
To: Kernel Debugging Interest List
Subject: [windbg] Re: Sometimes I just can’t get crash dump files to
generate…

Hej Nate, and the list

I have tried generating a crash dump again, and had no success. I increased
my paging file to 1024 MB on C: (boot drive, 14 GB free space) (768 MB RAM
in the machine). I set the recovery options to write an event log entry,
send an administrative alert, dump kernel memory to %SystemRoot%\MEMORY.DMP
and overwrite any existing file.

I then tried to generate a crash dump using BANG! from OSR online,
http://www.osronline.com/article.cfm?id=153, but was unsuccessful. I got a
blue screen, claiming to write a crash dump, with disk activity and the
counter going from 0 to 100 %. After it had completed and been quiet for 10
or so seconds, I proceeded to reset the machine and look for the crash dump
and found nothing. No crash dump, no event log entry. The only entries I got
were “Microsoft (R) Windows 2000 (R) 5.0 2195 Service Pack 4 Uniprocessor
Free.” and that the EventLog service had been started.

I have a Seagate ST3120026A 120 GB IDE hard drive, sitting as a single
master connected to the primary onboard IDE channel on a Giga-Byte
GA-6VX7-4X motherboard. There is no anti-virus software running on the
machine.

How can I check for drivers with BugCheckCallback functions? Or check the
storage stack for misbehaving drivers?

Unfortunately, the only machine anywhere near this one is a 486 running
Windows 95 that I don’t think windbg will run on, and a modern laptop
without a serial port, which makes windbg kernel debugging hard.

Grateful for any advice / tacksam f?r r?d

Andreas

—
You are currently subscribed to windbg as: xxxxx@stratus.com
To unsubscribe send a blank email to xxxxx@lists.osr.com