We help IT Professionals succeed at work.
Troubleshooting Question

How do we enable & look for the location of dump files in Windows Server 2016?

94 Views
Last Modified: 2020-09-22
Our Windows Server 2016 w/ Hyper-V rebooted by itself & would like to check the corresponding dump file & possibly search for the root cause?

How do we enable that feature & location of the dump file?
Comment
Watch Question

CERTIFIED EXPERT

Commented:
The file is usually C:\windows\system32\memory.dmp.  If it is configured for a minidump, look in c:\windows\system32\minidmp.

I usually use BlueScreenView from Nirsoft to analyze the files either in place on a running system or manually where I've copied them elsewhere.
https://www.nirsoft.net/utils/blue_screen_view.html

CERTIFIED EXPERT

Commented:
I would also look in Event Viewer, System to see if there is any evidence.  If it rebooted gracefully, there will be messages there to clue you in.  If not, you'll find an entry after the restart that the previous reboot wasn't proper.
GiboSystems Engineer

Author

Commented:
I cannot find those files in that folder?
GiboSystems Engineer

Author

Commented:
Found it at c:\windows\memory.dmp but the time stamp was back in July 2020?

Unexpected reboot happened this morning?

How do you enable or disable that dump file?
CERTIFIED EXPERT
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION
GiboSystems Engineer

Author

Commented:
The memory dump file is old, did not see same file for today's unexpected reboot?
GiboSystems Engineer

Author

Commented:
& checked that it's enabled
CERTIFIED EXPERT

Commented:
If it didn't actually crash, it won't make the DMP file.  What does the Event Viewer show?  It should be clear there if it crashed or rebooted more properly.  In the latter case, you'll see entries for what initiated it, entries for many items shutting down, and no "improper shutdown" message when it starts back up.
GiboSystems Engineer

Author

Commented:
It says only shutdown physical server & virtual machine but what's strange was that event log was found under administrative events not in the system events?
CERTIFIED EXPERT

Commented:
To be sure.... was it the host that rebooted or just the VM?  In any case, you'll want to look for the files on whichever one rebooted.

Did you try BlueScreenView?  If the DMP file (if there is one) is programmed to be elsewhere, it should find it.

Do you see any entries about what initiated the shutdown?

CERTIFIED EXPERT

Commented:
"administrative events not in the system events "
Where are you finding "administrative events"?

I don't see that in my Event Viewer.  Under Windows Logs I have Application, Security, Setup, System, and Forwarded Events.
GiboSystems Engineer

Author

Commented:
the physical server shutdown first followed by that specific VM in like 2 minutes apart, no shutdown events from other VMs though

what's bluescreenview?

didn't find any entries that may have initiated the shutdown or reboot?
GiboSystems Engineer

Author

Commented:
administrative events is under custom views
CERTIFIED EXPERT

Commented:
I usually use BlueScreenView from Nirsoft to analyze the files either in place on a running system or manually where I've copied them elsewhere.
https://www.nirsoft.net/utils/blue_screen_view.html 

It's a very handy program.

Can you copy the last 20-30 Event Viewer, System entries from the end of the last shutdown?  You can highlight the entries, right-click on them, and then Save....
CERTIFIED EXPERT

Commented:
OK.  I don't usually check Custom Views.  You didn't find those same entries in Windows Logs, System?

Seth SimmonsLead Systems Administrator
CERTIFIED EXPERT

Commented:
you can also use WinDbg from the microsoft store on windows 10; i found it useful

the physical server shutdown first followed by that specific VM in like 2 minutes apart
how did the host shutdown before the guest?  if the host failed, the guest would have failed with it
if the dump file is dated 2 months ago, that says 1) it crashed before (did you determine root cause of that?) and 2) either it had a reset of some sort or failed to create a dump file

determining the cause of the july crash might help to see if this failure is related; especially if it is a hardware issue
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
i found the results from bluescreenview differs often from Windbg, which i also use; but it's not as easy to use
in case you need it, here's how to set the system to make dmps :
How to Enable Minidump logs in Windows 10
  1. Now click System and Security from within the Control Panel:
  2. Then click System from the list:
  3. Now, click Advanced System Settings:
  4. Under the Start-up and Recovery section, click Settings:
  5. Finally, select Small Memory Dump from the debugging drop-down menu, then click OK:

GiboSystems Engineer

Author

Commented:
"OK.  I don't usually check Custom Views.  You didn't find those same entries in Windows Logs, System?"

No, I did not find the shutdown event under the system windows logs

CERTIFIED EXPERT

Commented:
That's very surprising.  Do you find any part of the shutdown or startup process in System?
GiboSystems Engineer

Author

Commented:
"determining the cause of the july crash might help to see if this failure is related; especially if it is a hardware issue"

that was a storage firmware issue that was resolved
Seth SimmonsLead Systems Administrator
CERTIFIED EXPERT

Commented:
that was a storage firmware issue that was resolved
so if there is no dump file for this last failure, your only option is to comb through event logs just prior to the restart


GiboSystems Engineer

Author

Commented:
true & we cannot find an issue that caused the unexpected reboot, I'm thinking to open a case w/ Microsoft to make a diagnostics root cause analysis to find out the real issue since our vendor support cannot find anything from the hardware side

Gain unlimited access to on-demand training courses with an Experts Exchange subscription.

Get Access
Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Empower Your Career
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE

Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

  • Troubleshooting
  • Research
  • Professional Opinions
Unlock the solution to this question.
Join our community and discover your potential

Experts Exchange is the only place where you can interact directly with leading experts in the technology field. Become a member today and access the collective knowledge of thousands of technology experts.

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.