Dedicated Dump File feature on Windows Server

The dedicated dump file is basically a page file that is reserved for use only by the system crash dump routines. It is not used for paging virtual memory. Like a page file, the system process keeps an open handle to the dedicated dump file, which prevents it from being deleted. When you manually initiate a memory dump, or the system crashes on its own, the data is written into the dedicated dump file instead of the page file on the system drive.

You can use dedicated dump file feature when you don’t have sufficient space on system drive.

To configure Dedicated dump file you have to create below registry entries:-

Location: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl

Name: DedicatedDumpFile

Type: REG_SZ

Value: A dedicated dump file together with a full path, such as D:\dedicateddumpfile.sys

The dedicated dump file can be stored on any local volume that can support a page file or volume which can mounted early in boot process. This volume must be considered a fixed disk device and must not be hosting Windows clustered storage.

Size Consideration:-

You can automatically allow the system to determine the size of the dedicated dump file, or you can manually set the size by using the DumpFileSize registry value.

A). System determined size:-

If you choose to let the system determine the size, then regardless of the dump file type set via the CrashDumpEnabled value, the dedicated dump file will be roughly the size of system visible RAM plus 256 MB. The extra 256 MB allows room for secondary dump data that may be written by driver bug check callback routines.

B). Manual size specified via the registry:-

The following registry value will allow you to manually set the dedicated dump file size in megabytes:

Location: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl

Name: DumpFileSize

Type: REG_DWORD

Value: The dump file size in megabytes

If you choose to set the DumpFileSize value manually, then you should also set the IgnorePagefileSize value under the CrashControl key to 1.

Set IgnorepagefileSize:-

  • Click Start Start button , type regedit in the Start Search box, and then click regedit in the Programs list.
  • User Account Control permission If you are prompted for an administrator password or for confirmation, type your password, or click Continue.
  • Locate and then click the following registry subkey:
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl
  • On the Edit menu, point to New, and then click DWORD Value.
  • Type IgnorePagefileSize, and then press ENTER.
  • Right-click IgnorePagefileSize, and then click Modify.
  • In the Value data box, type 1, and then click OK.
  • Exit Registry Editor.
  • Reboot the system for the change to take effect.

Final Dump File Location:-

After a bug check, the data will be written to the dedicated dump file on disk. However, the final memory dump location will be based on the following registry value:

Location: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl

Name: DumpFile

Type: REG_EXPAND_SZ

Value: The target dump file name together with the full path, such as D:\memory.dmp

The system will extract the dump data from the dedicated dump file and save the resultant file to the location and file name specified for the DumpFile value. The default for this value is %SYSTEMROOT%\MEMORY.DMP. Since we are using the dedicated dump file to overcome space limitations of the system drive, we will likely want to also set the DumpFile value to point to an alternate location than the default.

Reference:- https://blogs.msdn.microsoft.com/ntdebugging/2010/04/02/how-to-use-the-dedicateddumpfile-registry-value-to-overcome-space-limitations-on-the-system-drive-when-capturing-a-system-memory-dump/

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.