The dedicated dump file is basically a page file that is reserved for use only by the system crash dump routines. It is not used for paging virtual memory. Like a page file, the system process keeps an open handle to the dedicated dump file, which prevents it from being deleted. When you manually initiate a memory dump, or the system crashes on its own, the data is written into the dedicated dump file instead of the page file on the system drive.
You can use dedicated dump file feature when you don’t have sufficient space on system drive.
To configure Dedicated dump file you have to create below registry entries:-
Location: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl
Name: DedicatedDumpFile
Type: REG_SZ
Value: A dedicated dump file together with a full path, such as D:\dedicateddumpfile.sys
The dedicated dump file can be stored on any local volume that can support a page file or volume which can mounted early in boot process. This volume must be considered a fixed disk device and must not be hosting Windows clustered storage.
Size Consideration:-
You can automatically allow the system to determine the size of the dedicated dump file, or you can manually set the size by using the DumpFileSize registry value.
A). System determined size:-
If you choose to let the system determine the size, then regardless of the dump file type set via the CrashDumpEnabled value, the dedicated dump file will be roughly the size of system visible RAM plus 256 MB. The extra 256 MB allows room for secondary dump data that may be written by driver bug check callback routines.
B). Manual size specified via the registry:-
The following registry value will allow you to manually set the dedicated dump file size in megabytes:
Location: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl
Name: DumpFileSize
Type: REG_DWORD
Value: The dump file size in megabytes
If you choose to set the DumpFileSize value manually, then you should also set the IgnorePagefileSize value under the CrashControl key to 1.
Set IgnorepagefileSize:-
- Click Start Start button , type regedit in the Start Search box, and then click regedit in the Programs list.
- User Account Control permission If you are prompted for an administrator password or for confirmation, type your password, or click Continue.
- Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl - On the Edit menu, point to New, and then click DWORD Value.
- Type IgnorePagefileSize, and then press ENTER.
- Right-click IgnorePagefileSize, and then click Modify.
- In the Value data box, type 1, and then click OK.
- Exit Registry Editor.
- Reboot the system for the change to take effect.
Final Dump File Location:-
After a bug check, the data will be written to the dedicated dump file on disk. However, the final memory dump location will be based on the following registry value:
Location: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl
Name: DumpFile
Type: REG_EXPAND_SZ
Value: The target dump file name together with the full path, such as D:\memory.dmp
The system will extract the dump data from the dedicated dump file and save the resultant file to the location and file name specified for the DumpFile value. The default for this value is %SYSTEMROOT%\MEMORY.DMP. Since we are using the dedicated dump file to overcome space limitations of the system drive, we will likely want to also set the DumpFile value to point to an alternate location than the default.
Reference:- https://blogs.msdn.microsoft.com/ntdebugging/2010/04/02/how-to-use-the-dedicateddumpfile-registry-value-to-overcome-space-limitations-on-the-system-drive-when-capturing-a-system-memory-dump/