Analyzing crash dumps - more info?

[Hans-Jochen Trost]

All,

I am still struggling with 0xD1 and a few other blue screen events. I
have noted that minidumps are left ehind, and also how to set up to
get full dumps instead. I have half a dozen minidumps from one
machine at a customer site, but no full dumps yet.

I have run

dumpchk -v

on the minidumps (copies of them on my machine) and found that,e.g.,
for the 0xD1 dumps the analysis log does not mention the message code
IDRL_NOT_LESS_OR_EQUAL nor the driver involved (serial.sys), both of
which the original blue screen does show.

Questions:

1. Does the minidump contain that information, and if so, how to I
get to see it?

2. If the minidump does not contain that information, does the full
dump do? How would I get to see it?

Note that I cannot lay my hands on the troubled machines (4 or maybe
5), and I have to tell the user remotely what to do, and keep the
burden on them low, because despite the blue screens and other
problems, they have beneficial use of their machines (PC104+ based
systems controlling printing machines).

I appreciate any suggestions.

Cheers,

Jochen

hjtrost at microfab dot com


Nil nimium studeo, Caesar, tibi velle placere,
nec scire ut an sis albus an ater homo.
Catullus

 

[Jason Hall [MSFT]]

--------------------

From: Hans-Jochen Trost <[email protected]>
Subject: Analyzing crash dumps - more info?
Date: Mon, 07 Jun 2004 15:21:05 -0500

All,

I am still struggling with 0xD1 and a few other blue screen events. I
have noted that minidumps are left ehind, and also how to set up to
get full dumps instead. I have half a dozen minidumps from one
machine at a customer site, but no full dumps yet.
[snip]
Questions:

1. Does the minidump contain that information, and if so, how to I
get to see it?

2. If the minidump does not contain that information, does the full
dump do? How would I get to see it?

Note that I cannot lay my hands on the troubled machines (4 or maybe
5), and I have to tell the user remotely what to do, and keep the
burden on them low, because despite the blue screens and other
problems, they have beneficial use of their machines (PC104+ based
systems controlling printing machines).

I appreciate any suggestions.

----------------

If you look at the 4th parameter of the 0xD1 stop error, that is the memory
address that made the illegal memory reference. The mini-dump will show you
the module (driver) that encompasses the memory location.

**** LINKS ****

Q254649: "Overview of memory dump file options for Windows 2000, for
Windows XP, and for Windows Server 2003"
support.microsoft.com/?id=254649

Bugcheck Codes and Info:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ddtools/hh/
ddtools/bcintro_3dkj.asp

Debugging Tools Download:
http://www.microsoft.com/downloads/details.aspx?FamilyID=7c6ec49c-a8f7-4323-
b583-6a7a6aeb5e66&displaylang=en

Debugging Tools and Symbols: Getting Started
http://www.microsoft.com/whdc/devtools/debugging/debugstart.mspx


--
~~ JASON HALL ~~
~ Performance Support Specialist,
~ Microsoft Enterprise Platforms Support
~ This posting is provided "AS IS" with no warranties, and confers no
rights.
~ Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
~ Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.