How to get a Complete Memory Dump on Windows Server 2003 Enterprise when the server hangs or is not responsive

Issue

Windows Server 2003 Enterprise can recognise greater than 4GB of memory, but the limit for a pagefile which is used to used to dump memory to is 4095MB.

When a server hangs, or becomes unresponsive a STOP error is not generated, and must be triggered manually. This can cause some difficulty on servers that may not have an attached keyboard such as Blades.

Resolution

1) Limit the memory to less than 4095MB
Update BOOT.INI with the /maxmem switch

[boot loader]
redirect=UseBiosSettings
timeout=5
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="4GB: Windows Server 2003, Enterprise" /maxmem=4044 /noexecute=optout /fastdetect /redirect /pae
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows Server 2003, Enterprise" /noexecute=optout /fastdetect /redirect /pae


2) Set the pagefile to 4095MB
The pagefile on the system driver (C:) needs to be set to 4095 initial and maximum sizes.

- Ensure there is sufficient space on the system drive (C:) for the additional pagefile space

- Right click on My Computer and select Properties from the context menu
- Select the Advanced tab
- Click Settings under Performance
- Select the Advanced tab
- Click Change under Vitual Memory
- Select C:
- Select the Custom size radio button
- Enter 4095 for Initial size (MB)
- Enter 4095 for Maximum size (MB)
- Click Set
- Click Yes to the warning about memory size
- Click OK
- Click OK
- Click OK

3) Enable Crash Dump Registry Entries
Set the following registry entries:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl]
; Enable Complete Memory Dump
"CrashDumpEnabled"=dword:00000001
; Allow Crash Dump via NMI 
"NMICrashDump"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters]
; Allow Crash Dump via PS/2 Keyboard
"CrashOnCtrlScroll"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdhid\Parameters]
; Allow Crash Dump via USB Keyboard 
"CrashOnCtrlScroll"=dword:00000001


If there is insufficient space on C: the memory dump can be written to another drive
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl]
"DumpFile"=<path to MEMORY.DMP>


4) Reboot the server
This will activate all the changes made above.

5) Generate a test crash dump
For a PS/2 or USB keyboard, or from the console of VMware virtual machine:

Press Right CTRL + Scroll Lock + Scroll Lock

For an HP blade from the HP BladeSystem Onboard Administrator:

- Select the server under Device Bays
- Select iLo
- Select Web Administrator
- Select Diagnostics
- Click Generate NMI to System

This should BSOD the server and create a memory dump. If none of the above methods work the crash dump can be generated using the Citrix SystemDump utility

References

How to generate a kernel dump file or a complete memory dump file in Windows Server 2003
http://support.microsoft.com/kb/972110

Pagefile Size Limited to 4,095 MB
http://support.microsoft.com/kb/197776

How to overcome the 4,095 MB paging file size limit in Windows
http://support.microsoft.com/kb/237740

Windows feature lets you generate a memory dump file by using the keyboard
http://support.microsoft.com/kb/244139

How to generate a complete crash dump file or a kernel crash dump file by using an NMI on a Windows-based system
http://support.microsoft.com/kb/927069/en-us

SystemDump 3.1 for 32-bit and 64-bit platforms
http://support.citrix.com/article/CTX111072

Products

Microsoft Windows Server 2003 (any)

Created: 27th May 2010
Updated: 27th May 2010


© 2005-2014 Jamie Morrison