Solved

Page File too low to generate crash dump?

Posted on 2014-09-16
4
727 Views
Last Modified: 2014-10-01
Hey everyone, I have interesting issue here that I'm hoping you can help with.  I currently have a server running WS 2008 R2 SP1 with 130 GB of memory installed.  I have the crash settings configured to capture a kernel dump followed by a reboot.  Recently, the server crashed and no dump was generated, I can see in the event logs when the crash occurred but there is no reference to the dump / why it may not have generated.

The ONLY thing I can think of here is that the PF may not be large enough to accommodate the dump, as it is currently set to ~8 GB.  However, I could see that being more of an issue if it were set to get a full dump instead of a kernel.  

Any thoughts on this and whether it might be the issue?  Alternatively, is there anything I can check (without having to crash the server) to see that things are configured correctly under the covers?

Thanks in advance
0
Comment
Question by:blinkme323
  • 2
4 Comments
 
LVL 14

Expert Comment

by:Michael Dyer
Comment Utility
Microsoft does provide instructions on forcing a memory dump for testing at this page:  http://support.microsoft.com/default.aspx?scid=kb;EN-US;244139

you might want to try this after hours just to confirm your settings are correct.
0
 
LVL 19

Accepted Solution

by:
marsilies earned 500 total points
Comment Utility
For a full dump you'd need at least 130GB + 128MB sized page file.

For a kernel dump, the required page file size is a bit trickier.

From:
http://blogs.technet.com/b/askperf/archive/2008/01/08/understanding-crash-dump-files.aspx
Remember that the size of the kernel memory dumps will vary depending on the amount of kernel-mode memory allocated and the drivers loaded.  On systems with more RAM, it is reasonable to expect that the dump file will be larger.  There is no way to predict the exact size of a kernel memory dump.  When you configure kernel memory dumps the system checks to see if the page file is large enough.  There are some guidelines for the minimum page file size needed for kernel memory dumps, however given that the size of kernel mode memory will vary, there is no accurate measure for the maximum.

If the server is 32-bit, the kernel dump can't exceed 2GB. However, a 64-bit server could have a kernel dump that's the full size of the RAM. From:
http://support.microsoft.com/kb/889654
Therefore, a Windows Server 2003 x64 SP1-based server in 64-bit mode with 32GB of RAM could have a 32 GB kernel memory dump file, where you would expect only a 1 to 2 GB dump file in 32-bit mode. This behavior occurs because of the greatly increased memory pools.

This link mentions making the page file RAM size + 257MB for header info. It also suggests the alternative of creating a dedicated dump file, which is a feature Windows Server 2008 R2 has:
http://support.microsoft.com/kb/2860880
A dedicated dump file is a page file that is not used for paging. Instead, it is “dedicated” to back a system crash dump file (memory.dmp) when a system crash occurs. Dedicated dump files can be put on any disk volume that can support a page file. We recommend that you use a dedicated dump file when you want a system crash dump but you do not want a page file.
0
 

Author Comment

by:blinkme323
Comment Utility
Thank you both for the follow up.  So I guess in short, the size of the kernel dump is wholly dependent on the amount of resident kernel memory at that time?  If so, would anything have hit the logs indicating that the dump could not be written?
0
 
LVL 19

Expert Comment

by:marsilies
Comment Utility
http://support.microsoft.com/kb/949052
Kernel memory dump files may not be generated on Windows Server 2008-based or Windows Vista Service Pack 1 (SP1)-based computers.

You may also notice the following event is logged in the System event log:
Event ID: 49
Event Type: Error
Event Source: volmgr
Description: Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.

Cause:
This behavior occurs when more physical memory (RAM) is installed than the initial size that is set for the page file. If a STOP error occurs when the system is configured to generate a kernel or complete memory dump, no memory dump file will be generated

I think this error may show up at boot.
0

Featured Post

Why spend so long doing email signature updates?

Do you spend loads of your time carrying out email signature updates? Not very interesting are they? Don’t let signature updates get you down. Let Exclaimer Cloud - Signatures for Office 365 make managing email signatures a breeze.

Join & Write a Comment

You might have come across a situation when you have Exchange 2013 server in two different sites (Production and DR). After adding the Database copy in ECP console it displays Database copy status unknown for the DR exchange server. Issue is strange…
New Windows 7 Installations take days for Windows-Updates to show up and install. This can easily be fixed. I have finally decided to write an article because this seems to get asked several times a day lately. This Article and the Links apply to…
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

8 Experts available now in Live!

Get 1:1 Help Now