Use crash dumps to troubleshoot hardware/OS issues

Using manually initiated crash dumps to troubleshoot hardware and OS issues.

When Windows 2000 and XP encounter a serious system problem, the result is what has become known as the "Blue Screen

of Death" or BSOD -- a screen of white text on a blue background that provides information about why the system crashed. The administrator can also configure the computer to dump memory to a crash file to disk for analysis (provided that the crash wasn't because of the disk itself being unavailable!). The admin also has the option at the next reboot to send this crash dump to Microsoft for analysis, which can in theory help Microsoft.

Sometimes a system will simply hang -- become unresponsive to keyboard or mouse input -- without a BSOD or crash dump report being generated. Situations like these can be the hardest to debug, since there may be multiple reasons why the system becomes unresponsive: bus contention issues, overheating, kernel-level device drivers, etc.

To that end, Microsoft introduced a special function into the PS/2 keyboard mouse driver that allows the user to manually initiate a BSOD / dump action. If the system becomes outwardly unresponsive, but the user is able to manually initiate a crash, this indicates a problem with the operating system which could in turn be traced and debugged from the crash dump. If the user can't even trigger a manually-initiated crash, then the problem is most likely with the hardware and not the software.

To allow the user to manually trigger a crash report, a PS/2 keyboard must be plugged in and enabled. (This cannot be done with a USB keyboard plugged into the motherboard, since Windows does not use the BIOS-emulated keyboard but accesses it directly through the USB bus.) Edit the Registry and under the key HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesi8042prtParameters add a REG_DWORD value named CrashOnCtrlScroll with a value of 1.

After rebooting, the user can then trigger a manual crash by holding the right Ctrl key and pressing the Scroll Lock key twice. The user should also have crash reporting enabled by going to Control Panel | System | Advanced | Startup and Recovery Settings and selecting "Kernel memory dump" and "Overwrite any existing file" under Write debugging information.


Serdar Yegulalp is the editor of the Windows 2000 Power Users Newsletter. Check out his Windows 2000 blog for his latest advice and musings on the world of Windows network administrators – please share your thoughts as well!


This was first published in May 2004

Dig deeper on Windows Server Troubleshooting

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

SearchServerVirtualization

SearchCloudComputing

SearchExchange

SearchSQLServer

SearchWinIT

SearchEnterpriseDesktop

SearchVirtualDesktop

Close