Dump Picking

Should you ever be unfortunate enough to uncover a bug in Windows 2003 itself - a painful process that begins with mysterious server failures and progresses to long, arduous calls to Microsoft's technical support staff - you'll probably have to create a crash dump for their use.

Reading crash dumps is well beyond the ken of ordinary system or network administrators. You just need to recognize the term and know how to create a crash dump for some expert to peruse at his or her leisure.

Therefore, we begin with a definition: A crash dump is a snapshot of everything in memory when a Windows 2003 system configured to capture a crash dump actually crashes. It includes information about the operating system, the hardware, applications, and all types of other information that Windows 2003 usually keeps hidden from view and uses to manage its own operations.

Experts can pick through a crash dump to pinpoint causes of a crash and use their knowledge to start formulating fixes or workarounds. This is one of the things that drives the creation of the patches and fixes that eventually show up in the service packs - in case you were wondering where that stuff comes from.

To enable a crash dump, your computer must first meet the following criteria:

• Your paging file must reside on the same partition where the Windows 2003 system files reside. This is called boot partition in Windows 2003-speak. The paging file contributes to the bulk of the crash dump and must be accessible after the system quits working - that means it must be on the same drive where the crash dump utility resides.

• You must have sufficient free space on the boot partition to capture everything in RAM plus everything in the paging file. This means that the free space must equal the sum of those values (RAM and the paging file). To determine the amount of free space you need, open Task Manager, click the Performance tab, and look at the number reported in the Limit box in the Commit Charge pane. (To launch Task Manager, right-click any open area on the taskbar and choose Task Manager.) This represents the number of kilobytes of free space you'll need (to convert to MB, divide this number by 1024).

After you meet these criteria, you can enable crash dumps in the Startup and Recovery dialog box. To display this dialog box, choose Control Panel System, click the Advanced tab, and click the Settings button under Startup and Recovery. The Write Debugging Information section contains a pull-down list where you can select to write a small dump file, a kernel-only dump file, a complete dump file, or none at all. The default filename ( %systemroot%\MEMORY.DMP ) is defined in the Dump File box. You don't need to change this default. The Startup and Recovery dialog box is shown in Figure 19-3.

Figure 19-3: Selections to capture a crash dump.

After you select the dump file settings, the next time your system experiences a STOP error (a serious error that can result in data corruption if left unresolved ), it writes the MEMORY.DMP file to your Windows 2003 system directory. By default, the value of the symbol %systemroot% is equal to C:\WINDOWS, assuming that you installed Windows Server 2003 on the C: drive with the default system root directory name .

A crash dump creates two interesting problems. First, because the sum of RAM and the paging file is probably 200MB or more, you must find a way to get a copy to technical support. (You'd better have a fast Internet link.) Second, you must remember to delete that file after you copy it; otherwise , your server is likely to run out of space on the boot partition.

Tip 

Compressing crash dumps usually reduces them by 70 percent or more, so we recommend that you zip them (using a utility such as WinZip, which can be found at http://www.winzip.com) before you send them.