Analyse memory.dump

[Marta]

Hello everybody,

I have a memory.dump file of a blue screen from one server; I know how to obtain the memory address of the driver that caused the error with dumpchk, but after I don??t know how to discover which driver was the responsible in the moment of the dump of the exception.
Can you help me??
Do you know how to troubleshoot the stop errors??
Thank you very much for your help.

[Jamie Hughes]

Hello Marta,

Pstat, from the resource kit, will give you a picture of the processes and drivers running on the system and it can help you match the exception address to the driver name.

http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q192463

Which OS are you running - NT or W2K? Hopefully that article will help you track down the culprit. If not, post some more details and maybe we can help - OS version and sp level and full stop code and parameters.

Best regards,
Jamie Hughes

[Marta]

Hello Jamie,
thank you very much for your interest.
I had read the article before, but I have some doubts.
One I know the excepcion address, I need to find the driver. But I can??t run pstat in the moment of the crash....are the memory addresses used by each driver always the same, in each restart of the server?? So if I suppose they are always the same, I run pstat. At the end of pstat I see a part where addresses match drivers name. My "problematic" address isn??t in that list. Do I take the module which has the nearest memory address?
If I do so (I don??t know if it is correct), I obtain "ntosknl.exe". What more I can do?? Look in the Knowledge Base and look for it with the four parameters?? I haven??t found anything!
Can you help me, Jamie? I suppose the memory.dmp has a lot of information about the crash! Am I wrong?
Thank you very much for your help!!

[Jamie Hughes]

Hi Marta,

Yes, if someone loaded the debug symbols and looked thru the stack trace they would probably be able to identify the offender and what was happening at the time of the crash. Unfortunately, dump reading is not for the faint of heart. Unless you are used to reading stack traces and interpreting the info, I would suggest that you have someone read the dump for you. HP, Microsoft, etc all have folks that read dumps so if you have a support contract, or want to pay per incident, give your vendor of choice a call.

Sometimes reading the entire dump is not necessary though so we might be able to help more here if you want to supply more information.

What OS and sp level are you running? What is the servers function - domain controller, member server, file and print, dns, wins, sql server, etc - list versions and sp levels of all apps running on the server? What is the make and model of the hardware? What is the stop code, four parameters, and error message in the stop code? How many times has the server crashed? Are there any errors in any of the event logs leading up to the blue screen?

Best regards,
Jamie Hughes

[Keld]

Definently put it to HP. We anaylyze these dumps for breakfast :-) You will get a response with 24h

Keld