Sharing Custom Analysis Windows MEMORY.DMP Information

Content Authoring
1

(imported topic written by SystemAdmin)

We found some time ago that the windows dump file can sit out there and take up GBs of space

so I wrote this Analysis to determine which servers have a dump file on them, I also included

MEMORY.DMP File Date Time

AutoReboot info

CrashDumpEnabled info

LogEvent to Eventlog info

Overwrite Logfile info

SendAlert info

DumpFile Location

Minidump Location

The CrachDumpEnabled field is actually pretty complicated depending on Physical memory, Patch level, SP

and some other factors, so I simplified this one with 4 values only

Off, Kernel, Complete, Small 64K

for more information look here http://support.microsoft.com/kb/885117

2

(imported comment written by SystemAdmin)

Update for 2 fields

looks better, removes the %25…%25

%25SystemRoot%25\MEMORY.DMP --> C:\Windows\MEMORY.DMP

%25SystemRoot%25\Minidump --> C:\Windows\Minidump

DumpFile Location:

Q: if (exists value “DumpFile” of key “HKLM\SYSTEM\CurrentControlSet\Control\CrashControl” of registry) then expand environment string of substring before “%00” of (value “DumpFile” of key “HKLM\SYSTEM\CurrentControlSet\Control\CrashControl” of registry as string) else “”

A: C:\Windows\MEMORY.DMP

Minidump Location:

Q: if (exists value “MinidumpDir” of key “HKLM\SYSTEM\CurrentControlSet\Control\CrashControl” of registry) then expand environment string of substring before “%00” of (value “MinidumpDir” of key “HKLM\SYSTEM\CurrentControlSet\Control\CrashControl” of registry as string) else “”

A: C:\Windows\Minidump

3

Hi,

i am looking for exactly that kind of analysis… can you please re-upload it?
Thanks!