You need a full dump if something interesting w.r.t. the debug is paged out.
If something in memory gets corrupted enough that the dump data can't be written then you won't get one. Also if your I/O stack gets FUBAR'ed or you have a hardware issue that's another thing. The way this happens is the dump is written during the crash into the page file. When the system boots, the WinLogon process checks inside the page file and if it discovers the dump it moves it into that memory.dmp, produces the mini, etc. Thanks, Brian Desmond [email protected] c - 312.731.3132 Active Directory, 4th Ed - http://www.briandesmond.com/ad4/ Microsoft MVP - https://mvp.support.microsoft.com/profile/Brian -----Original Message----- From: Ken Schaefer [mailto:[email protected]] Sent: Tuesday, April 07, 2009 9:32 PM To: NT System Admin Issues Subject: RE: Memory.dmp Generally for debugging a BSOD only kernel memory is important. A kernel dump is usually around 800MB or so (max). You do not need a full dump, nor do you need a 4GB page file. Just configure something around the 1GB mark (for the purposes of capturing these dumps). Only configure a full dump if you've got someone debugging these dumps that requests it. You should always be getting a minidump file (even if you have kernel or full selected). If you are getting no minidump files then you have a problem like storage controller driver problems (which prevent writing to hard disk) or power issues (which would result in no dump files) etc. Cheers Ken ________________________________________ From: Kurt Buff [[email protected]] Sent: Wednesday, 8 April 2009 9:43 AM To: NT System Admin Issues Subject: Re: Memory.dmp RAM plus, IIRC, 2mbytes, though it might be a bit more. 1.5xRAM is wayyyyy safe. On Tue, Apr 7, 2009 at 16:39, Sam Cayze <[email protected]> wrote: > I can't find anywhere if it's the initial size, or the max size that has > to be larger than the RAM? > > Don't recall ever changing the page file settings on this box (or > anywhere). I'm not well versed in page file technology. > > > > -----Original Message----- > From: Ben Scott [mailto:[email protected]] > Sent: Tuesday, April 07, 2009 6:32 PM > To: NT System Admin Issues > Subject: Re: Memory.dmp > > On Tue, Apr 7, 2009 at 5:44 PM, Sam Cayze <[email protected]> > wrote: >> I think the Page File might have been too small :( > > That will do it. To get a full memory dump, a page file has to be on > the System Drive (the drive containing Windows), and that page file has > to be at least the size of RAM plus a few MB extra for dump metadata. > > -- Ben > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ > <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ > ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
