Compartilhar via

Windows 8 and Windows Server 2012: Automatic Memory Dump

  • Artigo

There is a new memory dump option introduced in Windows 8 and Windows Server 2012 called “Automatic memory dump.” This is the default option selected when you install Windows.

clip_image001

The “Automatic memory dump” type was created to support the “System Managed” page file configuration.

clip_image002

The “System Managed” page file has been updated to reduce the page file size on disk, primarily for small SSDs but will also benefit servers with large amounts or ram.

The “Automatic memory dump” is not really a new memory dump type. In previous versions of Windows, we already have Mini, Kernel, and Complete memory dump options. The Automatic memory dump option produces a Kernel memory dump, the difference is when you select Automatic it allows the SMSS process to reduce the page file smaller than the size of RAM.

We use the registry to store the memory dump configuration, which can be located in

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl

The value CrashDumpEnabled contains one of the following values to identify the memory dump setting

When configured for Automatic memory dump, and the page file is set to System Managed, the page file should have a minimum size large enough to ensure that a kernel dump can be captured most of the time. Because the minimum size is only large enough most of the time, there is an additional feature to increase the minimum size of the page file. If your system experiences a bug check, we will create the registry key

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\LastCrashTime

For the next 4 weeks after this crash, the system managed page file will now have a minimum size that at least that of the amount of ram in the system.

As an example, the screenshots for this were taken from a system that has 16GB of ram installed. For the normally running system my page file is about 5.5GB

clip_image003

After the system experienced a bug check the page file size was increased to about 16.5GB

clip_image004

Now that the page file is larger than the amount of ram installed in the system, we will be able to capture the kernel memory dump in the situations where the smaller size was not large enough.

One question that may come up is “What happens if I change the memory dump type to Kernel instead of Automatic?” The system managed page file will have a minimum size that at least the size of ram.

On a final note, once the system is stable for 4 weeks we will go back to using the smaller reduced page file size. If you have fixed the issue causing the bug check and you want the page file size to return to its reduced size more quickly, you can delete or rename the LastCrashTime value listed above.

Robert Simpkins
Senior Support Escalation Engineer
Microsoft Enterprise Platforms Support

Comments

  • Anonymous
    January 01, 2003
    Thanks for the info. I have 2 questions:What happens when you have LastCrashTime set and there is not enough free space on the drive to create the system managed page file larger than the amount of RAM? What happens when there is not enough free space to write the dump file after system managed pagefile has been expanded as a result of LastCrashTime value and system crash?

  • Anonymous
    January 01, 2003
    So after I change the settings to create a complete memory dump, as well as change its save to path do I need to restart the server? I too have to wonder how this will work as my c drive does not have enough room for a 16 gb pagefile

  • Anonymous
    September 17, 2012
    What about performance impacts ?I knew that was better to set minimum and maximum limits at same value to avoid disk fragmentation..

  • Anonymous
    February 28, 2013
    Good Stuff.  Regarding NMI dumps. Does the NMICrashDump reg entry still need to be enabled within 2012?

  • Anonymous
    April 03, 2014
    Great Article! Thank you very much for sharing.

  • Anonymous
    March 31, 2015
    This is easy but what if we change the location for the dump file lik ediferent volume as I heard it can be a pain.

  • Anonymous
    May 14, 2015
    Nice blog! Very informative.

  • Anonymous
    March 30, 2016
    How to interpret the value of LastCrashTime ? A sample value as follows:LastCrashTime REG_QWORD 0x1d184e3de36a93b (131031978391021883)