Configuring a Complete Memory Dump for Troubleshooting

Products

• Endpoint Protection
• Data Center Security Server Advanced
• Carbon Black App Control
• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Enterprise EDR
• Carbon Black EDR
• Endpoint Security Complete
• Endpoint Security
• CBX Complete
• CBX Essentials

Issue/Introduction

This article explains how to generate a complete memory dump (sometimes referred to as a full memory dump) for troubleshooting system hangs/ BSOD events.

Suport Disclaimer:

• The configurations and steps outlined below fall outside the scope of Broadcom Support. If you require assistance configuring these Windows settings, please contact Microsoft Support.

Before you Begin:

• We highly recommend reviewing the following Microsoft documentation for best practices and additional guidance on configuring memory dumps:
• Overview of memory dump file options for Windows
• How to configure system failure and recovery options in Windows

Why a Complete Memory Dump is Required

• Complex issues require detailed data for an effective root cause analysis. While kernel dumps or other partial dumps may capture a baseline of information, Broadcom often requires the exhaustive data provided by a complete dump to accurately determine the root cause. Mini-dumps (the Microsoft default) and ADPlus dumps generally lack the necessary detail to properly resolve complex crashes.

Environment

• Microsoft Windows

Resolution

Step 1: Check the Page File Settings

When a blue screen crash occurs, it will write the contents of system memory to the page file. The page file needs to be bigger than the amount of available memory.

1. In Windows, navigate to Start > Control Panel > System > Advanced system settings. The System Properties window appears
2. In the Advanced tab, under Performance, click Settings
3. Click the Advanced tab
4. Under Virtual Memory, click Change
5. Ensure that the page file on the boot drive is large enough to store the entire contents of the computer's memory, plus one megabyte. For example, if the computer has 1 gigabyte of memory (1024 megabytes), the "Initial size" field should be at least 1025 (memory size plus 1 MB). Adjust the page file size if necessary
6. Click Set
7. Click OK
8. Dismiss any "reboot required" dialog boxes; you will restart later
9. Click OK
10. Leave the System Properties window open and proceed to the next section

Step 2: Enable Complete Memory Dumps

Memory dumps represent the entire contents of all system memory written to disk.  The standard rule of thumb to ensure that there is enough free disk space to capture a full memory dump is:

Free Disk Space = All of Physical Memory + 1 MB

If the computer itselt cannot provide enough free disk space, you can attach an NTFS formatted USB drive that has enough free disk space

To enable complete memory dumps:

1. Open Control Panel and navigate to System and Security > System > Advanced System Settings
   • Alternatively: Run > SystemPropertiesAdvanced
2. Under Startup and Recovery, click Settings.
3. From the Write debugging information drop-down menu, select Complete memory dump
4. Check Overwrite any existing file
5. Click OK
6. A message about pagefile requirements may appear; if it does, click Yes
7. Click OK

Note: If the Complete memory dump option is missing from the drop-down menu, you can enable it through the registry instead.  See How to generate a kernel or a complete memory dump file in Windows Server on Microsoft.com for more information.

Optional: Force a Crash

You may need to initiate the memory dump as an administrator if the issue under investigation does not cause the system to crash. There are three commonly accepted methodologies for causing a computer to generate a memory dump:

• Keyboard initiated dump
  • This Windows feature lets you generate a memory dump file by using the keyboard.
  • Usage:
    • http://support.microsoft.com/kb/244139
    • http://msdn.microsoft.com/en-us/library/ff545499.aspx
• NotmyFault
  • Sysinternal Crash on Demand Utility
  • Usage:
    • NotMyFault64.exe /crash then press enter.  For x86 systems, use NotMyFault.exe
    • See NotMyFault
• BANG!
  • Crash on Demand Utility
  • Usage:
    • bang [-s] : where -s indicates to automatically crash the system

Step 3: Collecting the .DMP

1. If applicable, write down the Stop Code displayed on-screen.
2. Legacy Operating Systems:
   • Upon restarting, a process called savedump.exe copies the contents from the page file to the MEMORY.DMP file on disk. Do not interrupt the savedump.exe process while it is running; otherwise the MEMORY.DMP file will be truncated and possibly corrupted.
   • To confirm that the memory dump process is finished, watch the process in Task Manager until it is completed, to ensure the memory dump is completely written.
3. Compress the file:
   • The resulting MEMORY.DMP file can be quite large.  However most of the contents are zeroed memory, so it should compress to a much smaller size. A one gigabyte memory dump will usually compress down to 100-300 megabytes, which will allow for much easier transfer across the network.
   • Some zip compression routines have been known to corrupt the original file if it is over 2GB in size. For original files over 2GB in size, Broadcom recommends RAR compressions.

Additional Information

• To learn how to generate a kernel or a complete memory dump file in Windows Server 2008, see http://support.microsoft.com/kb/969028
• Collecting a complete memory dump on Windows 2000, XP, or 2003 computers with over 2 GB of RAM can be difficult. You can work around this issue by limiting the amount of memory visible to Windows, using one of the following options:
  • Use the /maxmem switch. See http://msdn.microsoft.com/en-us/library/ff557127.aspx
  • Use the /burnmemory switch, which is recommended for Windows XP or 2003. See http://msdn.microsoft.com/en-us/library/ff556246.aspx
• If the file is too large or compression keeps corrupting the file, copy the original file to a removable, NTFS formatted USB drive and ship it to Broadcom. Broadcom's policy is to return the media once the data analysis is complete.