Network Home  Network Map  Our Publications
Windows 2000 Magazine Logo
  - Log On
  - Subscribe/Renew
  - Advertise
Windows 2000 Magazine Logo

  Home  |  Back Issues  |  Web Exclusives   |  Topics  |  Authors  |  Contact Us

search for  on    power search   help
 







<-- prev. page     1 2 [3]     next page -->

February 2001 / Features / Mark Russinovich
Crash Dump Analysis

You can use the dot commands to load and unload debugger plug-in DLLs (also called debugger-extension DLLs) and control the behavior of a live debugging target. A live target is an operational system that you're actively debugging. Like the built-in commands, dot commands either don't facilitate crash dump analysis or they require advanced knowledge.

Debugger-extension DLLs implement the bang commands. WinDbg and Kd automatically load the kdextx86.dll basic kernel-debugging extension DLL, which provides commands that let you display information about various Win2K or NT kernel objects. Start with some initial data gathering by running the !process pid command. This command dumps information about the process that was being executed when the crash occurred. To obtain a complete list of processes, use the !process 0 0 command. The command !thread tid dumps data about the thread that was being executed, including its stack trace. Simply determining which process was running at the time of a crash might provide a useful clue to the crash's cause, and the stack trace might list a driver that was responsible for the crash. If you run !thread tid on a crash dump you generated with BSOD, you'll see a stack trace that identifies crashdd.sys.

If you see text such as TrapFrame @ 8013eee8 on the right side of the stack trace's line, run the .trap nnnn command, where nnnn is the hexadecimal number that appears after the ampersand in the text (8013eee8 in the sample text). Then, run the Kv command. WinDbg shows you the stack trace of a trap frame, which reflects the stack before a trap handler function took control. Although WinDbg isn't always able to display an accurate stack trace, when it does, the trap frame's stack trace reveals the actual trace that led to the crash. Do a Knowledge Base search for the names of any drivers you see in the stack trace on the chance that you've encountered a Microsoft-documented problem. Refer to the WinDbg Help for advanced tips about trying to determine a stack trace yourself.

The !drivers command dumps a list of load drivers that contains some of the same information that NT 4.0 presents on its blue screens. This command displays driver creation dates, which can alert you to out-of-date drivers. Check with vendors for updates to old drivers. One way to determine a driver's vendor is to view the properties of the driver file in Windows Explorer (most drivers are stored in the \winnt\system32\drivers directory); the version information includes the developer's copyright notice and sometimes a description of the driver.

Numerous other bang commands exist (the !help command provides a complete list), but I've presented those that you can use without advanced knowledge of Win2K or NT internals. The WinDbg Help file describes various options that the bang, dot, and built-in commands support.

Good Luck with Your New Knowledge
Despite Kanalyze's best effort, no magic wand exists that you can wave at every crash dump to precisely identify the cause. I hope I've provided some guidance that helps you extract from a crash dump information that you might not otherwise have obtained. As I wrote at the start of this article, spending a few minutes with Kanalyze or WinDbg might save you from repeated crashes or from spending hours reinstalling the OS. Thus, learning about these tools is worth your while even if they don't always help you.

Related Reading
"MEMORY.DMP File Not Created on Compaq DeskPro XL 566"
http://support.microsoft.com/support/kb/articles/q126/9/75.asp

"MEMORY.DMP File Not Created on Some NCR Computers"
http://support.microsoft.com/support/kb/articles/q136/3/76.asp

"No MEMORY.DMP File Created with RAM Above 1.7 GB"
http://support.microsoft.com/support/kb/articles/q173/2/77.asp

"Windows NT Does Not Save Memory Dump File After a Crash"
http://support.microsoft.com/support/kb/articles/q130/5/36.asp

"WinNT Fails to Create a Memory.dmp On Any Other LUN Than 0"
http://support.microsoft.com/support/kb/articles/q168/1/05.asp

 



Find related articles
Find related products


<-- prev. page     1 2 [3]     next page -->



ARTICLE INFORMATION
InstantDoc ID: 16425
TOOLS
Email to a friend
Printer-friendly
Find related articles
Find related products

TOPICS
 · Systems Administration
 · Administration Tools
 · Windows NT and Windows 2000

READER COMMENTS
Post a comment
Fernando G. Giorgetta - Dear, I have installed the application OEM Support Tools but when I execute the application " Kanalyze " from the command prompt in any moment the " Wizard " it appears. All the process run in D.O.S. environment. Is it necessary that I download the version of 32bit? From where can I download...


Read all 3 comments...



   Stop the Fax Machine Madness & Send FAXES from Email (Eval CD)

   Intense School Boot Camps-No Money Down, No Payments for One Year

   Aelita solutions close your Windows enterprise security gap

   New! Diskeeper 7.0 Set It and Forget It defragmenter for Windows

   Data Replication: Real-Time or Scheduled – LinkPro’s PowerSync

   CommVault Systems® -Unified enterprise data management solutions

   OpalisRobot - task scheduler; automate IT processes & daily tasks


 
Tour our connected home & enter to win a copy of XP Pro!

 
Windows 2000 Magazine - get a free sample issue!

 
Find the right IT vendor - without the sales pitch!


Network Channels:  Windows NT/2000  |  SQL Server  |  T-SQL Solutions  |  .NET  |  Exchange & Outlook Administrator  |  IIS & Web Admin  |  Security Administrator  |  Training & Certification  |  IT Buyer’s Network  |  Development  |  Windows Scripting Solutions  |  Storage Admin

Advertising Information  |  Our Publications  |  Affiliate Programs  |  Network Map  |  About Us
Copyright © 2001, Penton Media, Inc. All Rights Reserved.  

Legal, Site Privacy, and Corporate Privacy Notices