Some computers can capture a memory image when they stop responding, when performance is extremely slow, or when they crash without providing a crash dump file. After the computer captures the memory image, the computer requires a Microsoft Windows application programming interface (API) to analyze the image with debug tools. This API attaches information that is required for debugging the image. An API for attaching the header information to the memory image is now available. This API is scheduled to be included in Service Pack 1 (SP1) for Microsoft Windows Server 2003.
Update information
A supported feature that modifies the default behavior of the product is available from Microsoft. However, this feature is intended to modify only the behavior that this article describes. Apply this feature only to systems that specifically require it. This feature might receive additional testing. Therefore, if the system is not severely affected by the lack of this feature, we recommend that you wait for the next software update that contains this feature.
If the feature is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the feature.
Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific feature. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:
Note The "Hotfix download available" form displays the languages for which the feature is available. If you do not see your language, it is because the feature is not available for that language.
Prerequisites
Prerequisites are supplied by the OEMs that provide the feature to capture a memory image from a non-responding computer.
Restart requirement
The restart requirement is supplied by the OEMs that provide the feature to capture a memory image from a non-responding computer.
Hotfix replacement information
Hotfix replacement information is supplied by the OEMs that provide the feature to capture a memory image from a non-responding computer.
File information
The English version of this update has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the
Time Zone tab in the Date and Time tool in Control Panel.
Date Time Version Size File name
------------------------------------------------------------
06-Mar-2004 00:44 5.2.3790.139 2,407,424 Ntkrnlmp.exe
06-Mar-2004 00:30 5.2.3790.139 2,064,896 Ntkrnlpa.exe
06-Mar-2004 00:30 5.2.3790.139 2,108,416 Ntkrpamp.exe
06-Mar-2004 00:47 5.2.3790.139 2,207,232 Ntoskrnl.exe
API information
The following information applies to this API:
- The API is restricted to full dumps only. For example, the API is restricted to complete memory images of the computer.
- The API will not account for any dynamic data, such as contact information or secondary dump callbacks.
- The API may also lack certain information if the image is captured early in the startup process of the operating system.
- The API is named "KeInitializeCrashDumpHeader." This API will be documented in the driver development kit (DDK) for Windows Server 2003 SP1 and in the Debug documentation.
Note If the computer can capture a crashed system image "off-line" without the use of Crashdump.sys, set the Startup and Recovery setting for
Write debugging information to
(none).
To do this:
- In Control Panel, double-click System.
- Click the Advanced tab.
- Under Startup and Recovery, click Settings.
- In the Write debugging information box, click (none).
The API does not have to have the crash dump selection set in the
Write debugging information box to capture the image in memory. You do not have to specify
Small Memory dump (64KB) or
Kernel memory dump in this box because the new API captures the full image. The API only works for full memory images. The full memory image may be required to completely understand an issue. A small memory dump or a kernel memory dump may not provide enough information to resolve the issue.
For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
824684Â
(http://kbalertz.com/Feedback.aspx?kbNumber=824684/
)
Description of the standard terminology that is used to describe Microsoft software updates