Where are BSOD crash files stored?

tony22 · 14 Sep 2010

I got an IRQL not less or equal BSOD last night. I was shocked to say te least. I've been using this syetm for at least a year in this exact physical configuration with not a lick of trouble. I was so taken aback that I did not notice from the information provided where the crash files were dropped. All I can remember is that there are two: one somewhere in the bowels of my Documents and Settings\User\Local\.... and the other somewhere in one of the Windows subdirectories. I looked in Windows\MiniDump but there was nothing with the correct date. I even did a seach of my entire C: directory looking for files Modified yesterday but nothing obvious showed up.

Where would these files be located?

ttran · 14 Sep 2010

They should be located in the C:\window\minidump. Make sure that you have set your system to create minidump correctly. Does the BSODs occur frequently? Please check the "Set minidump" below to make sure that you have set system to create minidump in appropriate way.

Code:

Windows 7:
Go to Start and type in "sysdm.cpl" (without the quotes) and press Enter
Click on the Advanced tab
Click on the Startup and Recovery Settings button
Ensure that "Automatically restart" is unchecked
Under the Write Debugging Information header select "Small memory dump (64 kB)" in the dropdown box
Ensure that the Small Dump Directory is listed as "%systemroot%\Minidump" (without the quotes)
Click OK twice to exit the dialogs, then reboot for the changes to take effect.

Also, make sure you don't use program such as CCcleaner, because they might clean out your minidmp folder anytime

Jonathan_King · 14 Sep 2010

Please follow these directions: https://www.sevenforums.com/crashes-d...tructions.html

Hopefully that will tell us what we need to know to solve it.

Just want to let you know, though, that a BSOD can be caused even by a power glitch. Since this is your first one, I wouldn't worry about it.

tony22 · 14 Sep 2010

ttran said:

They should be located in the C:\window\minidump. Make sure that you have set your system to create minidump correctly. Does the BSODs occur frequently?

I'll have to check when I start Win7 back up. I'm running memtest86+ right now. I've only ever had this one BSOD. In fact, the last time I had a crash in Windows at all was (I think) back in the earliest days of Windows XP. :)

What has me scratching my head is the screen that indicated where the two files were located (which is what I can't remember). Neither one of them had a "minidump" in the path name.

Jonathan, thanks. I saw that thread after I posted this one. Once I get Win7 cranked up again I'll follow the instructions and hopefully will get something to post.

tony22 · 14 Sep 2010

Jonathan_King said:

Please follow these directions: https://www.sevenforums.com/crashes-d...tructions.html

Hopefully that will tell us what we need to know to solve it.

Just want to let you know, though, that a BSOD can be caused even by a power glitch. Since this is your first one, I wouldn't worry about it.

Here it is. You can see there are two older dmp files that were in the minidump directory, but neither one of these was a BSOD (I don't even recall the circumstances for these). And there is none from yesterday. Hopefully one of the other files will contain something.

Thanks for the help!

Oh, you can see my system specs, but as far as the other info:

Installed on a new bare drive
Full retail version
Installed 7/13/2009
Never reinstalled
Motherboard is a little over two years old
Other bits vary in age

Jonathan_King · 14 Sep 2010

Looks like VMware is causing the problem. Try removing it and see what happens.

Also, install these nVidia drivers: NVIDIA DRIVERS 258.96 WHQL

Finally, remove Acronis True Image, at least for the time being.

It may also pay to test RAM: RAM - Test with Memtest86+

...Summary of the Dumps:

Code:


Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Sun Aug 22 23:21:02.266 2010 (GMT-4)
System Uptime: 7 days 13:16:33.465
BugCheck 124, {0, fffffa8006338038, b2000040, 800}
Probably caused by : hardware
BUGCHECK_STR:  0x124_GenuineIntel
PROCESS_NAME:  vmware-authd.e
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Sat Dec 19 09:58:02.782 2009 (GMT-4)
System Uptime: 0 days 0:04:50.016
BugCheck A, {8, 2, 0, fffff80002b7a50b}
Probably caused by : memory_corruption ( nt!MiStoreSetEvictPageFile+b )
BUGCHECK_STR:  0xA
PROCESS_NAME:  SearchProtocol
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨

tony22 · 14 Sep 2010

Okay Jonathan. But did you find anything at all from yesterday?

BTW, ran memtest86+ for 5 passes. No problems. Just finished running linpack at max memory, 64 bit, 2 threads, 10 passes. Both came up spotless.

Ran Prime 95 Blend last night, overnight. It was still running when I got up this morning with no errors.

I know these utilities should run longer for better certainty, but if I can't get one peep out of the three of them put together that's gotta mean something.

I'm still scared because real BSODs (at least in the old days) were usually signs of hardware trouble.

tony22 · 15 Sep 2010

So I risked it and did a video rendering last night. Came through fine.

I wonder if the BSOD I had on the 13th was caused in part by the significant increase in video rendering that I've been doing. I rarely reboot my system; it runs 24/7 and sometimes doesn't get restarted for weeks at a time. Over the last few weeks I've often been doing one video job a night. I use Vegas Pro. Maybe there was just a lot of debris left over that caused this BSOD?

I looked through a few of those files in the Zip package and could not find anything dated 9-13 at around 1900 hours, which was when it happened. So I wonder where those two files (or at least the two paths that I saw that suggested there were two files)?

Jonathan_King · 15 Sep 2010

Well I'll be honest, I wasn't paying attention to the dates.

One is dated December 2009, the other August 2010. Forget my last post.

Digging through event logs, I found these corresponding items:

Code:

Event[181]:
  Log Name: Application
  Source: Windows Error Reporting
  Date: 2010-09-13T19:06:35.000
  Event ID: 1001
  Task: N/A
  Level: Information
  Opcode: Info
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: WINTONY
  Description: 
Fault bucket X64_0xA_nt!MiResolveProtoPteFault+6a, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: 
P2: 
P3: 
P4: 
P5: 
P6: 
P7: 
P8: 
P9: 
P10: 

Attached files:
C:\Windows\Minidump\091310-25343-01.dmp
C:\Users\tony\AppData\Local\Temp\WER-32562-0.sysdata.xml
C:\Users\tony\AppData\Local\Temp\WER79BF.tmp.WERInternalMetadata.xml

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_0_0_cab_09ed8a0b

Analysis symbol: X64_0xA_nt!MiResolveProtoPteFault+6a
Rechecking for solution: 0
Report Id: 091310-25343-01
Report Status: 0

That doesn't tell us much, unfortunately.

I would hope that this was a one-time event, not a real problem, but if you would like to look for driver issues, go ahead and enable driver verifier: Driver Verifier - Enable and Disable

This will make your computer crash much more, until you disable it. Hopefully the dumps will be of use though.

tony22 · 15 Sep 2010

7:06 PM - that's the one. Now I wonder why this 091310-25343-01.dmp wasn't in the minidump directory? If I can find any of this stuff you want me to post it?

Where are BSOD crash files stored?

Where are BSOD crash files stored?

Dump files for review