From: Vandervecken on
Hi all,
So I have set Event logging with small memory dump in XP 64 bit, in the
System Properties/Startup & Recovery, in order to diagnose a BSOD in
win32k.sys, page_fault_in_nonpaged_area.
Unfortunately, when my PC blue screens, no event is written, and no minidump
appears in the minidump folder.
I have tried this both with letting the PC reboot automatically, and without.
How do I ensure a minidump appears, and a system log entry is written?

Cheers
Vandervecken

PS I accidentally cross-posted this in the Media Center Edition page. Sorry!
From: Jeff Layman on

"Vandervecken" <Vandervecken(a)discussions.microsoft.com> wrote in message
news:36CF8F1E-41B7-4193-B338-2D9E38C03E7C(a)microsoft.com...
> Hi all,
> So I have set Event logging with small memory dump in XP 64 bit, in the
> System Properties/Startup & Recovery, in order to diagnose a BSOD in
> win32k.sys, page_fault_in_nonpaged_area.
> Unfortunately, when my PC blue screens, no event is written, and no
> minidump
> appears in the minidump folder.
> I have tried this both with letting the PC reboot automatically, and
> without.
> How do I ensure a minidump appears, and a system log entry is written?
>
> Cheers
> Vandervecken
>
> PS I accidentally cross-posted this in the Media Center Edition page.
> Sorry!

Would any of the Sysinternals utilities be of help?

--

Jeff

From: RCan on
check system settings if your system is configured to be able to write a
full memory dump.
Normally these type of bluescreens will be generated (90%) by an
uncompatibel driver or AV.

How to configure system failure and recovery options in Windows
http://support.microsoft.com/kb/307973

Regards
Ramazan

"Jeff Layman" <jmlayman(a)invalid.invalid> wrote in message
news:#cW3sgzrKHA.5036(a)TK2MSFTNGP02.phx.gbl...
>
> "Vandervecken" <Vandervecken(a)discussions.microsoft.com> wrote in message
> news:36CF8F1E-41B7-4193-B338-2D9E38C03E7C(a)microsoft.com...
>> Hi all,
>> So I have set Event logging with small memory dump in XP 64 bit, in the
>> System Properties/Startup & Recovery, in order to diagnose a BSOD in
>> win32k.sys, page_fault_in_nonpaged_area.
>> Unfortunately, when my PC blue screens, no event is written, and no
>> minidump
>> appears in the minidump folder.
>> I have tried this both with letting the PC reboot automatically, and
>> without.
>> How do I ensure a minidump appears, and a system log entry is written?
>>
>> Cheers
>> Vandervecken
>>
>> PS I accidentally cross-posted this in the Media Center Edition page.
>> Sorry!
>
> Would any of the Sysinternals utilities be of help?
>
> --
>
> Jeff

From: Vandervecken on
I thought I had found the source and removed a small Firewire card that had
some errors, but it isn't the cause. They are back.

In answer to your question, I am asking the system to do a small memory
dump. It's either that or a full Kernel dump, and I believe that dumps the
entire 4GB of memory to disk.
Regardless, I stillc an't fix the fact that these crashes do not log
anything to the event log, despite being told to.

Also, what are the sysinternals utilities?

Regards,
Vandervecken
From: RCan on
Hi Vandervecken,

if this is a important system then you should definitly open a call at MS
PSS (support) cause this can also be a faulty 3rd party kernel driver (like
AV).

It is too complex to explain in a newsgroup how to read that dumps but if
you anyway want to have a look on your dump file, check the following posts
if they help you:
http://thebackroomtech.com/2008/01/31/howto-use-the-windows-debugging-tools-to-analyze-a-crash-dump-bsod/
http://technet.microsoft.com/en-us/library/cc740105(WS.10).aspx

Sysinternals - procmon, proxexp can also help you to identify hungry
processes but also here you need a good understanding of your systems
ressources (kernel, user, non- paged pools, handles, threads....).

Regards
Ramazan

"Vandervecken" <Vandervecken(a)discussions.microsoft.com> wrote in message
news:8C77B94A-3FB3-4251-98BF-D9D58968D51A(a)microsoft.com...
> I thought I had found the source and removed a small Firewire card that
> had
> some errors, but it isn't the cause. They are back.
>
> In answer to your question, I am asking the system to do a small memory
> dump. It's either that or a full Kernel dump, and I believe that dumps
> the
> entire 4GB of memory to disk.
> Regardless, I stillc an't fix the fact that these crashes do not log
> anything to the event log, despite being told to.
>
> Also, what are the sysinternals utilities?
>
> Regards,
> Vandervecken