How to be ready for the inevitable BSOD

[maxseven]

I've got years of experience with PCs, but (fortunately? unfortunately?) very little with BSODs, and I was hit with one last night on one of my W7HP PCs. I paid little attention to the BSOD itself, believing the info I needed had been captured to HDD before the crash. On reboot, I have a single file in \minidump and a memory.dmp in \windows but both of these are several weeks old--not apparently created from last nights BSOD. Also, on reboot, I did not see any message "Windows has recovered from a serious problem".

So my question is: what do I (or anybody) need to do to make sure they are prepared to respond to a BSOD? I already have in my System control panel failure settings:

"Write an event to the system log" -- checked
"Automatically restart" -- unchecked
"Write debugging information" -- Kernel memory dump
Dump file: %SystemRoot%\MEMORY.DMP
Overwrite any existing file -- unchecked

Is this right? Kernel dump vs. small dump? Is there any 3rd party utility I could be running to enhance the ability to tshoot a BSOD after?

Sorry if this has been asked 1000 times--I only looked at the one sticky here by jc & Jonathan and saw only "after" advice and not "prep for" afaict. TIA!

 

[zigzag3143]

I've got years of experience with PCs, but (fortunately? unfortunately?) very little with BSODs, and I was hit with one last night on one of my W7HP PCs. I paid little attention to the BSOD itself, believing the info I needed had been captured to HDD before the crash. On reboot, I have a single file in \minidump and a memory.dmp in \windows but both of these are several weeks old--not apparently created from last nights BSOD. Also, on reboot, I did not see any message "Windows has recovered from a serious problem".

So my question is: what do I (or anybody) need to do to make sure they are prepared to respond to a BSOD? I already have in my System control panel failure settings:

"Write an event to the system log" -- checked
"Automatically restart" -- unchecked
"Write debugging information" -- Kernel memory dump
Dump file: %SystemRoot%\MEMORY.DMP
Overwrite any existing file -- unchecked

Is this right? Kernel dump vs. small dump? Is there any 3rd party utility I could be running to enhance the ability to tshoot a BSOD after?

Sorry if this has been asked 1000 times--I only looked at the one sticky here by jc & Jonathan and saw only "after" advice and not "prep for" afaict. TIA!

If the name of the DMP file is memory.dmp it should not be located in the minidump folder but in C:\windows\memory.dmp

It gets over written everytime the system crashes so there should only be one.

 

[maxseven]

If the name of the DMP file is memory.dmp it should not be located in the minidump folder but in C:\windows\memory.dmp

It gets over written everytime the system crashes so there should only be one.

Yes.

On reboot, I have a single file in \minidump and a memory.dmp in \windows

 

[zigzag3143]

If the name of the DMP file is memory.dmp it should not be located in the minidump folder but in C:\windows\memory.dmp

It gets over written everytime the system crashes so there should only be one.

Yes.

On reboot, I have a single file in \minidump and a memory.dmp in \windows

Either will do for analysis. If you have more than one minidump we can use them.

There is no "prep" for BSOD's because there are so many varied causes.

 

[maxseven]

Thanks. In my surfing on this topic I have found a couple utilities of interest; BlueScreenView from Nirsoft and another called WhoCrashed which is nice looking though I dunno yet how useful. I've also changed my setting from Kernel Dump to Mini Dump mainly cuz I've seen a lot more discussion about using the minidump and none at all on Kernel.

 

[karlsnooks]

maxseven,

the .dmp file will have the info needed. Plus when you do post a dump, use the procedure given in Blue Screen of Death (BSOD) Posting Instructions

That gathers a lots of other info which can be useful at determining the cause of your blue screen. Sometime you might want to take a look at the overwhelming amount of info there.

Also be sure that the Windows Error Reporting Service is enabled. Some of the "bright" chaps who mess around with the services shoot themselves in the foot by disabling this service. Startup type should be Automatic.

The Nirsoft Blue Screen Viewer will give some info but, generally, not enough.

Good advice is to always create a restore point before any software or hardware changes.
http://www.sevenforums.com/tutorials/697-system-restore-point-create.html

 

[maxseven]

the procedure given in Blue Screen of Death (BSOD) Posting Instructions ... gathers a lots of other info which can be useful at determining the cause of your blue screen. Sometime you might want to take a look at the overwhelming amount of info there.

Yes I did take a look already. Overwhelming indeed! :shock:

Thanks for your help--it is appreciated.

 

[zigzag3143]

Thanks. In my surfing on this topic I have found a couple utilities of interest; BlueScreenView from Nirsoft and another called WhoCrashed which is nice looking though I dunno yet how useful. I've also changed my setting from Kernel Dump to Mini Dump mainly cuz I've seen a lot more discussion about using the minidump and none at all on Kernel.

Bluescreenview and who crashed are both decent tools for the average user. They do sometimes come to incorrect conclusions.

 

[maxseven]

In my surfing I found that MS does have apparently a super-tool for BSOD analysis but you have to belong to a secret society and spend hundreds of $ or something to get it. Why it wouldn't be distributed more readily I can't imagine...

 

[karlsnooks]

Pssst. Some of those members of that secret society work on this forum but don't tell anyone.

 

[zigzag3143]

You have to know the secret handshake

 

[maxseven]

Ha, ha! Yeah, I suspected as much. You MVP guys are like Illuminati or Knights Templar or some such except afaict you only have "online" meetings (and thus are alot scarier)!

 

[karlsnooks]

Just bitter you are because you weren't extended the secret handshake.