XPe does not generate a full memory dump file after a blue screen

[Tony Y]

We're trying to capture a full memory dump after a blue screen system
crash. We've added the following components to our configuration:
--Disk Dump Drivers
--Save Dump
--Primitive: Dbghelp

Additionally, we've changed the settings in System Properties >
Advanced > Startup and Recovery Settings:

Write debugging information => Complete memory dump
Dump file => %SystemRoot%\MEMORY.DMP

XPe is not generating a full memory dump file after a blue screen.
Is there something we're missing from our configuration?

 

[KM]

Tony,

Do you have pagefile enabled on the boot partition (%systemroot% partition) and is it large enough to generate the full dump? (IIRC,
it must be at least as large as Physical RAM + 11MB)
It is important to have the memory dump generated on the boot partition (this all comes to the same volume limitation of
NtSetFileInformation API operations)

How do the values under [HKLM\System\CurrentControlSet\Control\CrashControl] reg.key look after you made all the changes required?
(verify it with http://www.microsoft.com/resources/documentation/Windows/2000/server/reskit/en-us/regentry/27670.asp)

After you see a BSOD and reboot, check Event Log - do you see info there about the memory dump generated? (Source: Save Dump, IIRC)

If you specify a non-existent path, a dump file will not be written. For example, if you specify the path as C:\Dumpfiles\Memory.dmp
and no C:\Dumpfiles folder exists, a dump file will not be written.

Certain computers and SCSI controllers do not permit the crash dump information to be created. To determine if more information is
available, query on the following words in the Microsoft Knowledge Base: your computer model and "Memory.dmp" (without the
quotation marks)

Test the Crash control with CrashOnCtrlScroll (http://support.microsoft.com/kb/244139/EN-US/).

--
Regards,
KM, BSquare Corp.

PS. More "hacks" could be done to analyze the problem if the memory dump is still not created.
E.g., when BSOD occurs, you shutdown the device and explorer the registry offline. There must be a key
[HKLM\SYSTEM\CurrentControlSet\Control\CrashControl\MachineCrash]. If it is not there, it the the kernel fault. If it is there, the
savedump.exe tool's fault.

 

[Tony Y]

From msinfo32.exe report:

Total Physical Memory 256.00 MB
Available Physical Memory 83.55 MB
Total Virtual Memory 994.21 MB
Available Virtual Memory 677.22 MB
Page File Space 746.73 MB
Page File F:\pagefile.sys

Note:
The OS files are on partition 4, drive F:

The boot files (WERUNTIME.INI, NTLDR, NTDETECT.COM, BOOT.INI) are on
partition 1, drive C:

The dump path is %systemroot%\memory.dmp

 

[Tony Y]

I think I know why the memory.dmp file was not generated. If the path
for the dump file is %SystemRoot%\MEMORY.DMP the dump file is not
generated even though the string type in the registry is REG_EXPAND_SZ.
However, if the path is set to C:\MEMORY.DMP the dump file is
generated without problem. I believe it has to do with the environment
variable not being expanded correctly. %SystemRoot% exists and it is
defined so I don't know why it the memory dump does not work using this
string.

 

[KM]

Tony,

I thought I have mentioned that known issue with the environment vars not being expanded while dumping but I obviously didn't.
(although I used the right note about C:\... )
Glad you figured that out!

 

[Tony Y]

Since there was some pain involved on my part, now I will never forget.
Thanks.

 

[rkp728]

same problem in win server 2008

I am facing the same problem in windows server 2008. I tried the solution mentioned. But it did not work.
Also in the startup and recovery the settings are proper.
Will you pls let me know how to generate kernel dump in windows server 2008.