- The Windows 2000\XP\.NET Resource Index
Home | About Us | Search

Last Updated December 10, 2003

  Where to Start
  General Guides
  Boot.ini files
  Boot & Startup Issues
  Emergency Repair Disks
  Error Codes
  Event Logging
  Dr Watson
  Hang Conditions
  How to Guides
  Memory Dumps
  Memory Leaks
  Performance Tuning
  Recovery Console
  Task Manager
  Technical Articles
  Win2k Install Bugs
  WinNT Upgrade Bugs
  Win9x Upgrade Bugs

 Related Resources
  Hardware Guides
  Printer Mgmt
  Service Packs






Analyzing Windows 2000 Memory Dumps

One of the useful diagnostic tools available in Windows 2000 is a memory dump. This is an output file generated by the Operating System during a crash and can very useful in determining what caused a crash.
Where to Start

Gathering Blue Screen Information After Memory Dump 
Microsoft Knowledge Base Article: 192463 - This article describes how to gather more information about a blue-screen error message. Note that these steps may not always provide conclusive answers and may only be a symptom of another problem. 

How to Generate a Memory Dump File When a Server Stops Responding (Hangs)
Microsoft Knowledge Base Article: 303021 - If a Windows NT 4.0-based or a Windows 2000-based server stops responding (hangs), you can create a memory dump file to troubleshoot the issue. When you create a memory dump file, it is similar to forcing a bug check or a Stop error on the server. To perform the procedure that is described in this article, you must have second computer called Remote Debugger and a NULL modem cable. 

How to Use Dumpchk.exe to Check a Memory Dump File
Microsoft Knowledge Base Article: 156280 Dumpchk is a command-line utility you can use to verify that a memory dump file has been created correctly. Dumpchk does not require access to symbols.

How to Use Hot Keys to Capture a Crash Dump of a Process 
Microsoft Knowledge Base Article: 282421 - This article describes how to use hot keys to capture a crash dump of a process. 

Windows 2000 Memory Dump Options Overview
Microsoft Knowledge Base Article: 254649 - You can configure Windows 2000 to generate any one of the following three dump file types: 

Useful Articles and Links...
Complete Memory Dump Setting Is Default Using 2 GB of RAM or More
Microsoft Knowledge Base Article: 246182 - When you install 2 gigabytes (GB) or more physical RAM on your computer, Windows 2000 Startup and Recovery option uses the Complete Memory Dump setting by default.

New Crash Dump Options in Windows 2000 Reduce Memory.dmp Size
Microsoft Knowledge Base Article: 228524 - Windows 2000 includes two new options to speed up the time it takes to write the debugging information and limit the disk space needed to store the crash dump file in the event of a fatal error. 

Reading Small Memory Dump Files Created by Windows 2000
Microsoft Knowledge Base Article: 254723 - One of the options for generating dump files in Windows 2000 is the Small Memory Dump (64 KB) option. You can read small memory dump files by using Dumpchk.exe. Information obtained from the dump file can provide a basic starting point for troubleshooting the cause of the problem. 

Savedump.exe Now Provides More Security to Memory.dmp
Microsoft Knowledge Base Article: 173817-
Savedump.exe creates a Memory.dmp file with the NTFS permissions inherited from the parent directory. In most cases, this includes the Everyone group with Full Control. 

Support Added to Ntoskrnl.exe and Savedump.exe to Save Mini Dumps
Microsoft Knowledge Base Article: 262077 - Windows 2000 Service Pack 1 (SP1) and Windows 2000 Datacenter Server include the ability for the Windows 2000 kernel and the Savedump.exe tool to extract a mini dump from a full kernel dump. 

Windows 2000 Feature Allows a Memory.dmp File to Be Generated with Keyboard
Microsoft Knowledge Base Article: 244139 - Windows 2000 includes a feature that allows you to crash the system and generate a Memory.dmp file (if configured to do so). The "Stop" screen that is generated contains the following parameters: *** STOP: 0x000000E2 (0x00000000,0x00000000,0x00000000,0x00000000) The end-user manually generated the crashdump.  

Known Bugs and Issues
DUMPCHK.EXE Incorrectly Reports Some Dump Files as Invalid
Microsoft Knowledge Base ArticleQ166482 - While in the phase where Dumpchk.exe validates all virtual addresses, the program reports that specific memory dump files are corrupt. These same memory dump files are not corrupt and may be debugged without any problems.

Cannot Create a Memory.dmp File on Computers with over 4 GB RAM
Microsoft Knowledge Base Article: 241046 -
If your computer contains more than 4 gigabytes (GB) of Random Access Memory (RAM), you may not be able to get a complete memory dump in a Memory.dmp file. 

CPU Context Is Not Saved in the Memorydump File When NMI Occurs
Microsoft Knowledge Base Article: 262686 -
When you view the crashdump by using the kernel mode debugger, the processor registers for one more processor on a multiple-processor computer are all zero (0): 1: kd> r eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=00000000 edi=00000000... 

Dump File Not Created Correctly with More Than Four GB of Memory and PAE Turned On
Microsoft Knowledge Base Article: 326333 - If your computer has more than four gigabytes (GB) of memory and Physical Addressing Extensions (PAE) is turned on, dump files may not be created correctly. 

Memory Dump Creation Stops When NMI Occurs
Microsoft Knowledge Base Article: 268378 - Memory dump writing stops when a nonmaskable interrupt (NMI) occurs. This problem is specific to symmetric multiprocessor (SMP) computers. When Windows is writing a memory dump, it usually has a counter on the screen to indicate the progress of the memory dump writing. However, this counter is not displayed at all if this problem occurs. 

Memory Dump May Be Missing or Corrupted on Dynamic Mirrored Drive
Microsoft Knowledge Base Article: 253935 -  When a server stops responding (hangs) at a blue screen, the dump file may be missing or corrupted after you restart the server. Running Dumpchk.exe against the dump file may return the following message: 

Memory Dump Stops When the PAE Option Is Enabled
Microsoft Knowledge Base Article: 266251 - The writing of memory dumps may stop or stall under certain circumstances when the Physical Addressing Extension (PAE) option is enabled. 

Memory.dmp File Is Missing or Contains Corrupted Data
Microsoft Knowledge Base Article: 257299 - If the system partition is built with the dynamic mirrored volume, the Memory.dmp file may not be generated or may contain corrupted data.

Small Memory Dump Does Not Work with PAE Mode Enabled
Microsoft Knowledge Base Article: 260878 - If you start your computer with the /pae switch and the recovery options are set to generate a small memory dump on a system failure, the Minidump.dmp file that is generated may be corrupted.

Windows 2000 Does Not Enable Complete Memory Dumps Between 2 and 4 Gigabytes 
Microsoft Knowledge Base Article: 274598 - Microsoft Windows 2000-based servers do not enable complete memory dumps that are between 2 and 4 gigabytes (GB) in size. The only options available under the Write Debugging Information section are: Small Memory Dump (64 KB) and Kernel Memory Dump. The Complete Memory Dump option is missing 

Windows Does Not Save Memory Dump File After a Crash 
Microsoft Knowledge Base Article: 130536 - You can configure Windows to dump system memory to a file called Memory.dmp when a severe error (called a STOP error or fatal system error) occurs. This log file can be valuable for debugging the cause of the STOP error. 

Entire contents
© 1999-2003 and TechTarget
All rights reserved

This site and its contents are Copyright 1999-2003 by Microsoft, NT, BackOffice, MCSE, and Windows are registered trademarks of Microsoft Corporation. Microsoft Corporation in no way endorses or is affiliated with The products referenced in this site are provided by parties other than makes no representations regarding either the products or any information about the products. Any questions, complaints, or claims regarding the products must be directed to the appropriate manufacturer or vendor.