Stop Message Overview


Stop messages described in this appendix report information that covers a wide variety of issues. Diagnosing a problem that caused a Stop message to appear, known as a Stop error, requires advanced knowledge of Windows XP Professional. Consider the following options when attempting to diagnose or troubleshoot Stop errors or interpreting information in a Stop message:

  • See the description and troubleshooting information for your Stop message in this appendix.

  • See the Microsoft Knowledge Base for related information. Before searching technical information sources, record as much information about the problem as possible. For guidelines about information to record when diagnosing or troubleshooting problems, see Troubleshooting Concepts and Strategies in this book. For information about the Microsoft Knowledge Base, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources

  • Obtain and install the Debugging Tools Help file that is available from the Microsoft Debugging Tools Web site for a list of Stop messages not covered in this appendix. The Debugging Tools Help file is part of the Microsoft Debugging Tools installation.

To install Debugging Tools, Debugging Tools Help, and view more information about Stop messages

  1. Click the Debugging Tools link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources This link takes you to the Microsoft Debugging Tools Web site.

  2. Click Debugging Tools for Windows.

    Follow the steps listed on the Installing Debugging Tools for Windows page to install debugging tools.

  3. Follow the on-screen setup instructions and when prompted, type a destination folder name.

    The Setup program copies files and creates a Start menu folder named Microsoft Debugging Tools.

  4. From the Start menu, point to All Programs, point to Microsoft Debugging Tools, and then click Debugging Help to view the Using Microsoft Debuggers Help file.

  5. Expand Using Microsoft Debuggers and then expand Reference. Expand Bugcheck Codes to see a list of dozens of Stop messages, also known as bugcheck codes.

    You can also download and install Microsoft Debugging Tools by following the instructions in Using Symbol Files and Debuggers later in this appendix.

    Note 

    The Using Microsoft Debuggers Help file contains extensive information about debugging techniques. It includes debugging examples that show you how to use debuggers to obtain more information about a Stop message. The Help file also documents Stop messages not covered in this appendix.

    • Obtain assistance from trained Microsoft support personnel. You might need to furnish specific information and perform certain procedures to provide technical support with the information needed to investigate your problem. For more information about Microsoft Product Support Services, see the Microsoft Product Support Services link on the Web Resources page at http://www.microsoft.com/ /windows/reskits/webresources. For more information about Microsoft technical support options, see the Support link on the Microsoft Web page at http://www.microsoft.com/

A basic understanding of Stop messages and the underlying causes improves your ability to locate and understand technical information or perform diagnostic procedures requested of you by technical support.

Defining Terms

Throughout this appendix, several important terms are used and it is necessary to define these terms to understand the content in this appendix.

Call Stack.

A stack is fundamental data structure that holds volatile data. The call stack is a type of stack used to track function calls and the parameters passed to these function calls. In debugging terminology, the call stack is sometimes referred to simply as the stack.

Exception.

An error condition caused by an illegal instruction. Exceptions can be hardware-related or software-related errors.

Hardware abstraction layer (HAL).

A kernel-mode component that contains hardware-specific code that handles low-level hardware operations such as input/output (I/O) interfaces, interrupt controllers, and multiprocessor communication mechanisms. The HAL abstracts, or hides, hardware-dependent details from the rest of the operating system.

Input/output (I/O) request packet.

A data structure used to represent an input/output request and control its process. The I/O request packet structure consists of a header and one or more stack locations.

Interrupt.

A condition that disrupts normal command implementation and transfers control to an interrupt handler. I/O devices (such as disks and network devices) requiring service from the processor typically initiate interrupts.

Interrupt request level (IRQL).

An internal priority level table used by the kernel to manage interrupt sources, such as hardware or software. Software interrupts are assigned the lowest priorities with hardware interrupt levels assigned higher priorities by the hardware abstraction table (HAL). Only kernel mode threads can change IRQLs.

Interrupt service routine (ISR).

Code that the kernel executes when an interrupt occurs. For example, device drivers provide ISRs for interrupting devices.

Kernel.

The kernel provides low-level operating system functions for managing processor activities such as thread scheduling and dispatching, interrupt and exception handling, and multiprocessor synchronization.

Kernel mode.

The processor access mode in which operating system components and drivers run. Kernel-mode processes can directly access system data and hardware, and are not restricted like user-mode processes. Performance-sensitive drivers and services run in kernel mode to interact with hardware more efficiently. All kernel-mode components are fully protected from applications running in user mode.

Nonpaged pool.

The portion of shared system memory that cannot be paged to the disk paging file. Nonpaged pool memory can be accessed at any time without causing a page fault.

Page fault.

A page fault occurs when a thread accesses a page that is not in memory. For more information about paging and other memory management topics, see Evaluating Memory and Cache Usage in the Operations Guide of the Microsoft Windows 2000 Server Resource Kit.

Page table.

A process-specific table that maps paging file virtual memory addresses to physical memory addresses.

Page table entry (PTE).

An item in the page table.

Paged pool.

The portion of shared system memory that can be paged to the disk paging file, systemdrive\Pagefile.sys. This includes memory already paged to the disk and memory that the operating system might page, but has not actually done so.

Paging.

A virtual memory operation in which the memory manager transfers pages from memory to the disk systemdrive\pagefile.sys file when physical memory becomes full. A page fault occurs when a thread accesses a page that is not in memory. For more information about paging and other memory management topics, see Evaluating Memory and Cache Usage in the Operations Guide of the Microsoft Windows 2000 Server Resource Kit.

Process.

A process is an instance of an application, together with the set of resources allocated to run the application.

Stack.

A data structure consisting of a series of memory locations and a pointer to the initial location (also referred to as top of the stack). All processors provide instructions for placing and retrieving values to and from the stack. The stack used most often in debugging is the call stack.

Thread.

A thread is an object within a process that contains central processing unit (CPU) state information, user, and kernel-mode stacks. Threads are allocated processor time by the operating system to run code. Threads, not processes, run program code. Every process must have at least one thread and a thread can belong to only one process. A thread allows a process to maintain parallel lines of operation.

User mode.

The processor access mode in which applications run. Applications and subsystems run on the computer in user mode. Processes that run in user mode do so within their own virtual address spaces. They are restricted from gaining direct access to many parts of the system, including system hardware, memory not allocated for user mode, and other portions of the system that might compromise system integrity. Processes that run in user mode are effectively isolated from kernel-mode processes and other user-mode processes.

Stop Message Screen Sections

Stop messages use a full-screen character mode format, as shown in Figure C-1. Each message is uniquely associated with alphanumeric characters followed by the error s symbolic name. The Stop error number is the first parameter listed, followed by up to four hexadecimal numbers (shown in parentheses), which identify related error parameters.

click to expand
Figure C-1: Stop message

As shown in Figure C-1, a Stop message screen has four major sections, which display the following information:

  • Bugcheck information

  • Recommended user action

  • Driver information

  • Debug port and dump status information

Bugcheck Information

This Bugcheck information section includes the Stop error number, also known as the bugcheck code, followed by up to four developer-defined parameters (enclosed in parentheses) and the symbolic name of the error. Stop error codes contain a 0x prefix, which indicates hexadecimal numerical format. For example, in Figure C-1, the Stop error hexadecimal code is 0x000000D1 and its symbolic name is DRIVER_IRQL_NOT_LESS_OR_EQUAL.

As shown in Figure C-1, the Bugcheck information section frequently includes a line that lists the specific hexadecimal memory address of the Stop error s source, along with the name of the driver or device.

Note 

Under certain conditions, the kernel cannot fully display all of the Stop message content; only the first line is visible. This occurs if the problem has caused video display services to stop functioning.

Recommended User Action

The Recommended user action section provides a list of suggestions for recovery. In some cases, restarting the computer might be sufficient because the problem is not likely to recur. But if the Stop error persists even after you restart the system, you must determine the root cause to return the system to an operable state. This might involve undoing recent changes, replacing hardware, or updating drivers to eliminate the cause of the problem.

Driver Information

The Driver information section identifies the driver associated with the Stop error. If a file is specified by name, you can use Recovery Console or safe mode to verify that the driver is signed or has a date stamp that coincides with other drivers. If necessary, you can replace the file manually, or use Driver Rollback. For more information about Recovery Console and Driver Rollback, see Tools for Troubleshooting in this book.

Debug Port and Status Information

The Debug port and status information section lists COM port parameters that a kernel debugger uses if enabled. If you have enabled memory dump file saves, this section also indicates whether one was successfully written.

Enabling kernel debugging requires that you:

For more information about debugging related Boot.ini parameters, see Debugging Tools Help.

Types of Stop Messages

A hardware or software problem can cause a Stop error, which causes a Stop message to appear. Stop messages typically fit into one of the following categories:

To find out more information about a Stop message, follow the instructions provided in Stop Message Overview earlier in this appendix.

Stop Messages Caused by Faulty Software

A Stop error can occur when a driver, service, application, or system component introduces an exception. For example, an application or driver attempts to perform an operation above its assigned IRQL or tries to write to an invalid memory address. A Stop message might seem to appear randomly, but through careful observations, you might be able to associate the problem with a specific activity. Verify that all installed software in question is fully Windows XP Professional compatible and if not, locate and install the latest updates.

Windows XP Professional compatibility is especially important for applications that might install file system filter drivers, such as antivirus, Internet firewall, multimedia, CD mastering, and backup software. File system filter drivers can perform value-added processing to enhance and extend file system functionality, but installing an incompatible file system filter driver might cause Stop errors.

Installation Stop Messages

For a new (non-upgrade) operating system installation, using outdated firmware might cause a Stop message. Update the computer s firmware to the version recommended by the computer manufacturer before installing Windows XP Professional. Consult your system documentation for information about checking and upgrading your computer s firmware.

Note 

Types of firmware include BIOS for x86-based computers and Extensible Firmware Interface (EFI) for Itanium-based systems. Verify that your system firmware is updated before installing Windows XP Professional, especially for computers using Advanced Configuration and Power Interface (ACPI) firmware. For more information about checking and updating firmware, see Troubleshooting Concepts and Strategies in this book.

If you are upgrading to Windows XP Professional from a previous version of Windows, such as Microsoft Windows 2000 Professional, Microsoft Windows NT 4.0 Workstation, Microsoft Windows 95, Microsoft Windows 98, or Microsoft Windows Millennium Edition, you can identify applications and drivers that might cause Stop errors.

To check system compatibility with Windows XP Professional

Do one of the following:

You can then uninstall the applications and drivers identified, complete the Windows XP Professional setup, and search for updates after you have completed the operating system upgrade.

For more information about upgrading to, or deploying Windows XP Professional, see Planning Deployments in this book.

Stop Messages Caused by Hardware Issues

Incorrectly configured or failing hardware can cause a Stop message to appear. For example, a video adapter with defective memory might cause the operating system to display a Stop message when writing to, or reading from, video RAM. A Stop message might also appear after adding a new device, if the device causes resource conflicts with existing hardware.

If the Stop message mentions a specific device, try replacing the device. If more than one device is a possible cause, you can try to isolate the problem hardware by temporarily simplifying your system configuration, removing hardware not required to start the computer or to complete installation. Leave the following essential devices installed:

Temporarily remove, disconnect, or disable these devices:

For most motherboards, you can disable integrated components by adjusting firmware or onboard jumper settings. Refer to your computer documentation for details about disabling built-in devices.

Completing Installation and Resolving Startup Problems

Continue to remove devices until you can successfully install or start Windows XP Professional. Re-enable or install devices one at a time, according to the manufacturer s instructions. For more information about resolving startup problems, see Stop Message Checklist later in this appendix and Troubleshooting Startup in this book.

Checking the Hardware Compatibility List

If you still cannot resolve your problem, verify that your computer system and hardware are compatible with Windows XP Professional by checking the latest revision of the Windows XP Professional Hardware Compatibility List (HCL) before contacting technical support. Microsoft includes computers and peripheral hardware on the HCL after performing rigorous component and compatibility testing that verifies that they work well with Windows XP Professional. If your computer or device is not in the HCL, contact the hardware manufacturer for more information. The manufacturer might be in the process of certifying the hardware or testing new drivers.

For more information about the HCL, see the Hardware Compatibility List link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources

Executive Initialization Stop Messages

Executive initialization Stop errors occur only during initialization of the Windows executive, a group of components that provides basic operating system services. Windows executive services comprise the low-level kernel mode portion of Windows XP Professional and are contained in the Ntoskrnl.exe file.

After the Windows loader (Ntldr) calls the kernel (Ntoskrnl.exe), executive initialization occurs in two phases:

Phase 0 Initialization Stop Messages

A Stop message during Phase 0 initialization might indicate a problem with outdated firmware or faulty hardware. If you receive one of the Phase 0 initialization Stop messages listed in Table C-1, run the hardware diagnostics program included with your devices or replace them with new parts. Also, verify that your motherboard and peripheral firmware revisions are current and try the suggestions provided in Stop Message Checklist later in this appendix. For more information about the startup process and recovering from hardware problems, see Troubleshooting Startup and Managing Devices in this book. For more information about checking firmware, see Troubleshooting Concepts and Strategies in this book.

If you cannot isolate any hardware problems, try running the Windows XP Professional setup again. If the same error message appears, contact a Microsoft support technician.

Table C-1: Phase 0 Initialization Stop Messages

Message ID

Symbolic Name

0x31

PHASE0_INITIALIZATION_FAILED

0x5C

HAL_INITIALIZATION_FAILED

0x5D

HEAP_INITIALIZATION_FAILED

0x5E

OBJECT_INITIALIZATION_FAILED

0x5F

SECURITY_INITIALIZATION_FAILED

0x60

PROCESS_INITIALIZATION_FAILED

Phase 1 Initialization Stop Messages

A Stop message during Phase 1 initialization might indicate a problem with outdated firmware, corrupted system files, or an incompatible HAL type. If you receive any of the Phase 1 initialization Stop messages listed in the Table C-2, reinstall Windows XP Professional and try to initialize it again. Verify that your motherboard and peripheral firmware revisions are current and try the suggestions provided in Stop Message Checklist later in this appendix. For more information about the startup process and recovering from hardware problems, see Troubleshooting Startup and Managing Devices in this book. For more information about checking firmware, see Troubleshooting Concepts and Strategies in this book. If you get the same message, contact a Microsoft support technician.

Table C-2: Phase 1 Initialization Stop Messages

Message ID

Symbolic Name

0x32

PHASE1_INITIALIZATION_FAILED

0x61

HAL1_INITIALIZATION_FAILED

0x62

OBJECT1_INITIALIZATION_FAILED

0x63

SECURITY1_INITIALIZATION_FAILED

0x64

SYMBOLIC_INITIALIZATION_FAILED

0x65

MEMORY1_INITIALIZATION_FAILED

0x66

CACHE_INITIALIZATION_FAILED

0x67

CONFIG_INITIALIZATION_FAILED

0x68

FILE_INITIALIZATION_FAILED

0x69

IO1_INITIALIZATION_FAILED

0x6A

LPC_INITIALIZATION_FAILED

0x6B

PROCESS1_INITIALIZATION_FAILED

0x6C

REFMON_INITIALIZATION_FAILED

0x6D

SESSION1_INITIALIZATION_FAILED

0x6E

SESSION2_INITIALIZATION_FAILED

0x6F

SESSION3_INITIALIZATION_FAILED

0x70

SESSION4_INITIALIZATION_FAILED

0x71

SESSION5_INITIALIZATION_FAILED

Memory Dump Files

When a Stop error occurs, Windows XP Professional writes information to the paging file (Pagefile.sys) on the systemdrive root by default. When you restart the computer in normal or safe mode after a Stop error occurs, Windows XP Professional uses paging file information to create a memory dump file in the systemroot folder. Analyzing the dump file can help provide more information about the root cause of a problem and enables offline analysis by using tools run on another computer. You can configure your system to generate one of three different types of dump files.

Small memory dump

Small memory dump files contain the least information, but consume the least disk space, 64 kilobytes (KB). Small memory dump files are sometimes referred to as mini dump files. Unlike kernel and complete memory dump files; Windows XP Professional stores small memory dump files in the systemroot\Minidump folder, instead of using the systemroot\Memory.dmp file name.

Windows XP Professional always create a small memory dump file when a Stop error occurs, even when you choose the kernel or complete memory dump file options. One of the services that use small memory dump files is the Error Reporting service. The Error Reporting service reads the contents of a small memory dump file to help diagnose problems that cause Stop errors. For more information about the Error Reporting service, see Using Memory Dump Files to Analyze Stop Errors later in this appendix.

Kernel memory dump

This is an intermediate size dump file that records only kernel-level memory and can occupy several megabytes (MB) of disk space. When a Stop error occurs, Windows XP Professional saves a kernel memory dump file to a file named systemroot\Memory.dmp and create a small memory dump file in the systemroot\Minidump folder. You cannot exactly predict the size of a kernel memory dump file because this depends on the amount of kernel-mode memory allocated by the operating system and drivers present on the machine when the Stop error occurred.

Complete memory dump

A complete memory dump file contains the entire contents of physical memory when the Stop error occurred. The file size is equal to the amount of physical memory installed plus 1 MB. When a Stop error occurs, the operating system saves a complete memory dump file to a file named systemroot\Memory.dmp and creates a small memory dump file in the systemroot\Minidump folder.

To help ensure that your system can save memory dump files:

To view the maximum paging file size for each disk volume

  1. In Control Panel, click Performance and Maintenance, and then click System.

  2. Select the Advanced tab, and then in the Performance box, click Settings.

  3. In the Performance Options dialog box, select the Advanced tab.

  4. In Virtual memory, click Change to view the Virtual Memory dialog box that contains paging file information.

    In Total paging file size for all drives, the Currently allocated value indicates the paging file disk space used. If you choose to enable the Custom size option, you can specify different paging file sizes by entering values for Initial size (MB) and Maximum size (MB). Verify that adequate disk space is available on systemdrive to accommodate the maximum paging file specified.

Infrequently, device driver problems might cause failure to save memory dump files. To minimize the potential for problems, use storage devices and controllers listed in the HCL and device drivers digitally signed by Microsoft.

Small Memory Dump File

A small memory dump file records the smallest set of useful information that might identify the cause of the system stopping unexpectedly. A small memory dump file includes the following:

A small memory dump file requires a paging file of at least 2 MB on the boot volume and specifies that the operating system save each dump file using a unique file name every time a Stop error occurs. Each minidump file has a unique file name, which includes the date encoded in the file name. For example, Mini062701-01.dmp is the first small memory dump generated on June 27, 2001.

Small memory dump files are useful when space is limited or when you are using a slow connection to send information to technical support. Because of the limited amount of information that can be included, errors not directly caused by the thread that was running when the problem occurred are not included.

To configure Windows XP Professional to generate a small memory dump file

  1. In Control Panel, click Performance and Maintenance, and then click System.

  2. Select the Advanced tab, and in Startup and Recovery, click Settings.

  3. In the Write Debugging Information list, select Small Memory Dump (64 KB).

  4. Click OK to close the Startup and Recovery dialog box.

  5. Click OK to close the System Properties dialog box, and then restart if prompted.

By default, Windows XP Professional saves small memory dump files to the systemroot\Minidump folder. You can change the folder location by typing a new path in the Dump File box of the Write Debugging Information list.

Kernel Memory Dump File

A kernel memory dump file records only kernel memory information, which expedites the dump file creation process. Although you cannot exactly predict the size of a kernel memory dump file, a good rule of thumb is that roughly 50 MB to 800 MB, or one-third the size of physical memory, must be available on the boot volume for the paging file.

The kernel memory dump file does not include unallocated memory or any memory allocated to user-mode programs. It includes only memory allocated to the kernel and HAL, as well as memory allocated to kernel-mode drivers and other kernel-mode programs. For most purposes, a kernel memory dump file is the most useful kind of file for troubleshooting Stop messages. It contains more information than the small memory dump file and is significantly smaller than the complete memory dump file. It omits only those portions of memory that are unlikely to have been involved in the problem.

To configure Windows XP Professional to generate a kernel memory dump file

  1. In Control Panel, click Performance and Maintenance, and then click System.

  2. Select the Advanced tab, and then in Startup and Recovery, click Settings.

  3. In the Write Debugging Information list, select Kernel Memory Dump.

  4. Click OK to close the Startup and Recovery dialog box.

  5. Click OK to close the System Properties dialog box, and then restart if prompted.

By default, Windows XP Professional saves a kernel memory dump file to systemroot\Memory.dmp. You can change the default output location by typing a new path in the Dump File box of the Write Debugging Information list.

Note 

By default, a new kernel memory dump file overwrites an existing one. To change this, you need to clear the Overwrite any existing file check box. You can also choose to archive or move a dump file prior to troubleshooting.

Complete Memory Dump File

A complete memory dump records the contents of physical memory. If you choose to use complete memory dump files, you must have available space on the systemdrive partition large enough to hold the contents of physical RAM, plus 1 MB. By default, Windows XP Professional systems create complete memory dump files. A Microsoft technical support engineer might ask you to change this setting to facilitate data uploads over slow connections. Depending upon the speed of your Internet connection, uploading the data might not be practical and you might be requested to provide the memory dump file on higher capacity removable media.

To configure Windows XP Professional to generate a complete memory dump file

  1. In Control Panel, click Performance and Maintenance, and then click System.

  2. Select the Advanced tab, and then in Startup and Recovery, click Settings.

  3. In the Write Debugging Information list, select Complete Memory Dump.

  4. Click OK to close the Startup and Recovery dialog box. Click OK to close the System Properties dialog box, and then restart if prompted.

By default, Windows XP Professional saves a complete memory dump file to systemroot\Memory.dmp. You can change the default location by typing in a new path in the Dump File box of the Write Debugging Information list.

Note 

By default, new complete memory dump files overwrite existing files. To change this, you need to clear the Overwrite any existing file check box. You can also choose to archive or move a dump file prior to troubleshooting.

For more information about memory dump files, see Windows XP Professional Help and Support Center. Also see Microsoft Knowledge Base articles Q254649, Windows 2000 Memory Dump Options Overview, Q254723, Reading Small Memory Dump Files Created by Windows 2000, and Q228524, New Crash Dump Options in Windows 2000 Reduce Memory.dmp Size. To find these articles, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources

Using Memory Dump Files to Analyze Stop Errors

Memory dump files record detailed information about the state of your system when the Stop error occurred. You can analyze memory dump files manually by using debugging tools or by using automated processes provided by Microsoft. The information obtained can help you understand more about the root cause of the problem.

You can use the following resources to upload your memory dump file information to Microsoft:

You can also use the following debugging tools to manually analyze your memory dump files.

Using Error Reporting

When enabled, the Error Reporting service monitors your system for kernel and user mode faults related to operating system components and applications. Using kernel-mode reporting enables you to obtain more information about the problem or condition that caused the Stop error.

Kernel Mode Reporting

When a Stop error occurs, Windows XP Professional displays a Stop message and writes diagnostic information to the memory dump file type specified in the Control Panel Advanced tab (as described in Memory Dump Files earlier in this appendix). For reporting purposes, the operating system also saves a small memory dump file. When you restart your system by using normal mode or safe mode (with networking) and logon to Windows XP Professional, the Error Reporting service gathers information about the problem and provides you with the option to send a report.

Displays an alert

A dialog box appears stating that Windows XP Professional detected a problem. You can click Send Error Report or Don t Send; or click here to view technical information about the problem before sending a report to Microsoft.

Provides the option to sends a problem report to Microsoft

If you click Send Error Report, the Error Reporting service anonymously sends the report, which includes the small memory dump file that was just generated, to Microsoft by using a Secure Socket Layer (SSL) encryption secured Internet connection. You might be prompted to provide additional information to complete your error report.

The Error Reporting service displays a dialog box when it has finished sending the report. A More Information button in the dialog box directs you to more information about the problem. When you click the Close button, you are directed to the Online Crash Analysis Web site, which provides options for tracking your report. For more information about this Web site, see Using the Online Crash Analysis Web Site later in this appendix.

To verify that Error Reporting is enabled for Stop messages

  1. In Control Panel, click Performance and Maintenance, and then click System.

  2. Select the Advanced tab, and then click Error Reporting to display the dialog box shown in Figure C-2.

  3. Select Enable error reporting.

  4. If not checked, click to select the Windows Operating System check box.


    Figure C-2: Error reporting options

The operating system always writes a supplemental small memory dump file when a Stop error occurs. Therefore, the Error Reporting service can send a problem report with small memory dump file information, even if you have configured your system to generate kernel or complete memory dump files.

For more information about additional reporting options provided by the Error Reporting service, such as using the Programs check box to add or exclude individual applications for monitoring, see Windows XP Professional Help and Support Center and Tools for Troubleshooting in this book.

Using the Online Crash Analysis Web Site

The Online Crash Analysis (OCA) Web site enables you to send error reports to Microsoft and track the status by using your Microsoft Passport information. You can access the Online Crash Analysis Web site by using the Error Reporting service or by using your Web browser. For more information about the Error Reporting service, see Using Error Reporting earlier in this appendix.

To visit the Online Crash Analysis Web site

  1. Click the Online Crash Analysis Web site link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources If using Error Reporting, the Error Reporting service client automatically directs you to the OCA Web site when you log on to Windows XP Professional in normal mode or safe mode with networking.

  2. Click Submit an event report and follow the on-screen instructions for logging on and sending a report. At the Contact Information page, you have two options.

    Send an acknowledged upload You have the option of providing your name, e-mail, and telephone number. You are informed of status and future developments about your problem by e-mail. Information sent to you might include news about updated drivers, patches, or Microsoft Knowledge Base articles with troubleshooting and support information. You can also choose to visit the OCA Web site again to check status and view information about your report.

    Send information to Microsoft anonymously If you choose not to provide your e-mail address, you do not receive e-mail updates from Microsoft. Your information is still processed and added to the error report database. To view status and information about your problem, you need to log on to the OCA Web site by using your Microsoft Passport information.

  3. At the Event Reports screen, specify the path and file name to your small memory dump file by clicking Browse.

You can leave a name, e-mail, and telephone number on the Contact Information page to submit an acknowledged upload or you can choose not to provide this information and submit your report anonymously.

If you choose to send an acknowledged or anonymous report, information is sent to Microsoft over the Internet by using Secure Sockets Layer (SSL) encryption.

Note 

Microsoft Windows 2000 Premier support customers are directed to a page that provides the option to submit a Windows 2000 or Windows XP Professional problem report.

Information sent to Microsoft includes the following:

Access to the OCA Web site is free of charge to all Windows XP Professional and Windows 2000 Premier support customers.

If you need an immediate response and analysis of your dump file is not yet complete, you can search the Microsoft Knowledge Base or submit a request to the Microsoft Product Support Services Web site. For more information about Microsoft Product Support Services, see the Microsoft Product Support Services link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources

Using Symbol Files and Debuggers

You can also analyze memory dump files by using a kernel debugger. Before using a debugger however, install symbol files to reduce debugging complexity. Symbol files enable you to view memory addresses as module and function names.

You can download symbol files directly from Microsoft.

To obtain symbol files from the Windows Downloads Web site

  1. Click the Windows Downloads link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources

  2. Click Tools and Utilities and then Windows Customer Support Diagnostics.

  3. Follow the on-screen instructions to install debugging tools, symbol files, or both.

For more information about symbol files, see Debugging Tools Help.

For information about other debugging options, see article Q121652, List of Debuggers Supported with Windows NT, in the Microsoft Knowledge Base and Debugging Tools Help. To find this article, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources

Note 

Because of the limited information contained in small memory and kernel memory dump files; you might need to perform other operations, such as setting kernel environment variables, in addition to installing symbol files. For more information about verifying small and kernel memory dump files, see Debugging Tools Help. Also, see article Q254723, Reading Small Memory Dump Files Created by Windows 2000, in the Microsoft Knowledge Base. To find this article, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources

Using Kernel Debugger (Kd.exe)

The Microsoft Kernel Debugger (Kd.exe) is a command-line debugging tool that you can use to analyze memory dump files, debug kernel-mode programs and drivers, or monitor the behavior of the operating system itself. Kd.exe also supports multiprocessor debugging. For more information about using the Microsoft Kernel Debugger, see Debugging Tools Help.

Using WinDbg Debugger (Windbg.exe)

The WinDbg Debugger (Windbg.exe) is a graphical user interface (GUI) mode debugging tool that you can use to analyze the contents of a memory dump file and debug kernel-mode and user-mode programs and drivers. For more information about using the WinDbg debugger, see Debugging Tools Help.

Kernel Debugger and WinDbg Debugger are just a few of the many tools provided. For more information about other kernel debugging tools, such as CDB and NTSD, see Debugging Tools Help.

Stop Message System Event Log Reporting

As an additional troubleshooting option, you can configure your system to write an entry in the system Event Log when a Stop message occurs.

To enable Stop message Event Log reporting

  1. In Control Panel, click Performance and Maintenance, and then click System.

  2. Click the Advanced tab, and then in the Startup and Recovery box, click Settings.

  3. In System Failure, verify that the Write an event to the system log check box is selected.

For details about interpreting the contents of the resulting log, see the Microsoft Knowledge Base article Q192463, Gathering Blue Screen Information After Memory Dump. To find this article, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources

Preventing System Restarts After a Stop Error

When a Stop error occurs, Windows XP Professional displays a Stop message related to the problem, followed by one of these events:

If Windows XP Professional restarts your system immediately after a Stop message occurs, you might not be able to record Stop message information quickly enough. Disabling this default behavior is useful when you want to record Stop message details before using other recovery options such as Driver Rollback, System Restore, or Recovery Console. This information could help you analyze the root cause after you have addressed the symptoms of a problem.

To disable restarts when the system stops unexpectedly

  1. In Control Panel, click Performance and Maintenance, and then click System.

  2. Select the Advanced tab. In the Startup and Recovery box, click Settings.

  3. Clear the Automatically reboot check box.

If you cannot start your system in normal mode, you can also perform the preceding steps in safe mode.




Microsoft Windows XP Professional Resource Kit 2003
Microsoft Windows XP Professional Resource Kit 2003
ISBN: N/A
EAN: N/A
Year: 2005
Pages: 338
BUY ON AMAZON

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net