Use crash dumps to troubleshoot hardware/OS issues

When Windows 2000 and XP encounter a serious system problem, the result is what has become known as the "Blue Screen of Death" or BSOD -- a screen of white text on a blue background that provides information about why the system crashed. The administrator can also configure the computer to dump memory to a crash file to disk for analysis (provided that the crash wasn't because of the disk itself being unavailable!). The admin also has the option at the next reboot to send this crash dump to Microsoft for analysis, which can in theory help Microsoft.

Sometimes a system will simply hang -- become unresponsive to keyboard or mouse input -- without a BSOD or crash dump report being generated. Situations like these can be the hardest to debug, since there may be multiple reasons why the system becomes unresponsive: bus contention issues, overheating, kernel-level device drivers, etc.

To that end, Microsoft introduced a special function into the PS/2 keyboard mouse driver that allows the user to manually initiate a BSOD / dump action. If the system becomes outwardly unresponsive, but the user is able to manually initiate a crash, this indicates a problem with the operating system which could in turn be traced and debugged from the crash dump. If the user can't even trigger a manually-initiated crash, then the problem is most likely with the hardware and not the software.

To allow the user to manually trigger a crash report, a PS/2 keyboard must be plugged

Requires Free Membership to View

in and enabled. (This cannot be done with a USB keyboard plugged into the motherboard, since Windows does not use the BIOS-emulated keyboard but accesses it directly through the USB bus.) Edit the Registry and under the key HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesi8042prtParameters add a REG_DWORD value named CrashOnCtrlScroll with a value of 1.

After rebooting, the user can then trigger a manual crash by holding the right Ctrl key and pressing the Scroll Lock key twice. The user should also have crash reporting enabled by going to Control Panel | System | Advanced | Startup and Recovery Settings and selecting "Kernel memory dump" and "Overwrite any existing file" under Write debugging information.

Serdar Yegulalp is the editor of the Windows 2000 Power Users Newsletter. Check out his Windows 2000 blog for his latest advice and musings on the world of Windows network administrators – please share your thoughts as well!

This was first published in May 2004

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.