Blue screen and no dump file

vbremaud · 08 Mar 2013

Hello,

I have been having a very strange problem since a few weeks. I am developing a driver, and fatally got a few blue screens here and there. However, I noticed that since a few weeks the blue screens don't give a dump file anymore, despite the fact that the dump seems to be done (says it begins physical dump on disk, counts to 100, says the dump has been written, etc). Of course, I didn't touch the dump settings. I have checked everything, including the following:
- Checked that the dump settings are correct (*many* times) , tried both Small memory dump and Kernel memory dump, checked paths of course. Full memory isn't available, probably because I have more than 2Gb of RAM.
- Checked that pagefile.sys is on the boot partition (with OS). I have a single drive with a single partition anyway.
- Checked that pagefile.sys is more than physical RAM. RAM is 2,44 Gb , pagefile.sys is 2,562 Gb .
- Checked that page file is system managed. It is, but I tried to set values by hand too, without results.
- Checked that WER service is set to manual, or so it is said on various forums I visited. I tested with setting it to automatic too, just in case.
- Checked that there is enough room on the disk (12.9 Gb free out of 39.8 Gb).

I also checked a few other things without remembering which ones exactly, I have been very careful to set them back to previous values, especially the ones I was not sure about (such as WER for example). According to the last modified date of the directory C:\Windows\Minidump , I would guess the last dump file was 20/2/2013 or before. To be on the safe side, I uninstalled 1 software I had installed since that date (git) , but of course it didn't change anything (of course I didn't forget to reboot).

I tried to use SF Diagnostic Tool to see if it could find something that I had missed. However, when I click on "MINIDUMP" it says the crash dump has been copied successfully, but I still can't find anything in the SF_DD_MM_YYYY folder that it creates on the desktop.

"Hardware" is virtualized (KVM on a Linux Debian). Disk drive is "Red Hat VirtIO SCSI Disk Device" and driver is standard Microsoft disk driver (disk.sys version 6.1.7600.16385 dated 21/6/2006 with no known more recent version) .

Windows updates hadn't been done since November 2012, so I assume they had nothing to do with the problem. Just to be sure though, I activated them. As far as I know, everything is now up to date, but again nothing changed regarding the lack of dump files.

For clarification, I test that the dump files are written by reproducing the bug that causes the blue screen. But since the bug itself could cause some instabilities in the system that might prevent the dump file from being written, I also tried by having my driver directly call the function KeBugCheck on demand. No change of course.

I'm pretty sure I checked everything that was humanely conceivable, except of course for the one thing that prevents the dumps to appear ;-) Either extremely obscure, or shamely obvious :-/

I would apreciate if someone could hint me in other directions I would have missed

Arc · 09 Mar 2013

If you are not getting crash dumps on BSOD, follow it: Dump Files - Configure Windows to Create on BSOD
Go to Option Two, Point 2. Download the .reg file and merge it in registry by double clicking it.

After the next BSOD, search the .dmp files manually in the default path: C:\Windows\Minidump or %SystemRoot%\Minidump.

vbremaud · 11 Mar 2013

Thanks for your answer.

However it didn't solve the problem. Before importing the reg file I exported the previous values, and I compared the 2 files. With the exception of the autoreboot (which I had deactivated to make sure I can see what happens during the blue screen), everything is absolutely the same.

vbremaud · 12 Mar 2013

I found a workaround. While searching for a solution to the problem, I finally found this article about how to have a dump file without a page file. I didn't expect it to yield any result in my case, but it didn't cost a lot to try it. So I added the key DedicatedDumpFile, rebooted, and saw that the file had been created with roughly 2824 Mb . I caused a blue screen, and finally found a dump file in C:\Windows\Minidump . Just out of curiosity I removed the key and set the page file to the exact size of 2824 Mb , but this didn't cause a dump file to be created. It seems I can have a dump file only with this trick. Changing the actual size to 512 Mb still allowed the dump file to be created. So I kept these settings, with the page file left managed by the system:

Code:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl
DedicatedDumpFile  C:\dumpfile
DumpFileSize       512 (dec)