none
Issue with capturing crash dump on Windows 8 RTM ... RRS feed

  • Question

  • Hello:

    Despite the fact that I configure my Windows 8 box to capture a "kernel dump" when encounter a system crash, it does not reliably generate memory dump when it needs to. Most of the time it does not generate any dump file when a crash occur. But I have seen it does it occasionally.

    Just in case that you are wondering, yes, I configure system crash dump capture under: System Properties->Startup and Recovery-> System failure.

    Any idea ?

    Kiet


    KAL

    Friday, October 12, 2012 12:01 AM

Answers

  • ignore the storage stack issue.  a crash dump file is not a guarantee, period. doesn't matter who crashed. everything has to align PERFERCTLY for a crash dump file to be written out. anything less than that, and it won't.

    d -- This posting is provided "AS IS" with no warranties, and confers no rights.

    Friday, October 12, 2012 5:09 PM

All replies

  • Hmmm, not sure that I understood your comment. When I said "system crash", I am referring to BSOD, bugcheck. When a bugcheck occurs, and the system is configured to capture a kernel dump, a dump must be captured reliably every single time. If this is not the case, there is a bug somewhere that needs to be fix.

    Again, this is ONLY an issue with Windows 8, I never seen this issue in Windows 7.

    Now, you may ask why is this an issue? Now, I can't capture a dump for analysis of a kernel issue.

    Can someone from Microsoft please confirm the issue, and perhaps suggest a workaround before the issue is being resolved.

    thanks,

    Kiet


    KAL

    Friday, October 12, 2012 2:21 AM
  • the machine is in an unknown state when a BSOD occurs. that means that the OS makes a best effort to create a dump, BUT, there is no guarantee. for instance, a bug in the storage stack may make it quite difficult to write a dump to disk later. 

    d -- This posting is provided "AS IS" with no warranties, and confers no rights.

    Friday, October 12, 2012 4:42 AM
  • Doron:

    This is not just any mysterious crash in storage stack or in a way that would cause windows to not able to write dump file. This is the same crash in Wdftester.sys which calls DbgPrint with a passed in UNICODE string at an elevated IRQL calling thread.   This same bug that I reported in my other thread on Windows 7. Since the same Wdftester.sys, I would expect the same crash when running the same test on Windows 8. Since this is a bugcheck in Wdftester.sys, I would expect the memory dump would just work.

    As a matter of fact, I rarely get kernel dump works on windows 8, occasionaly it does work.

    Kiet


    KAL

    Friday, October 12, 2012 2:21 PM
  • ignore the storage stack issue.  a crash dump file is not a guarantee, period. doesn't matter who crashed. everything has to align PERFERCTLY for a crash dump file to be written out. anything less than that, and it won't.

    d -- This posting is provided "AS IS" with no warranties, and confers no rights.

    Friday, October 12, 2012 5:09 PM
  • Apart from the problems that have been mentioned, for a complete memory dump to get written out you need to have a pagefile on the system partition with at least the size of your RAM + 1MB. Then you will need at least that amount of free disk space as well because after rebooting, the crash dump file is extracted from the pagefile and copied to the new crash dump file. 

    For a kernel memory dump the same is true except that less memory is required in the pagefile and on disk as only kernel memory and not entire RAM is written out to disk.

    //Daniel

    Sunday, October 14, 2012 8:41 AM
  • yes, but not reliably.

    KAL

    Wednesday, October 17, 2012 8:12 PM