locked
Crash dump is not generated RRS feed

  • Question

  • Hi, experts!

    As practice shows, on some computers is not generated crash dump at system
    crash, with on parameter of generation kernel memory dump (or mini dump). Having
    carried out small research, I have found out that for to save of a file the
    kernel uses the type driver dump_atapi.sys (or dump_portdrvname) which is loaded
    into memory by means of MmLoadSystemImage, in a context smss, by means of
    IopLoadDumpDriver. It becomes at creation of a paging file, as a part
    NtCreatePagingFile-> IoInitializeCrashDump. On systems in which the crash dump
    does not remain, port-driver (dump _) in memory is not present. Having debugged
    a kernel, I have found out that a problem that MmLoadSystemImage returns
    0xc000026c (3221226092) - {Unable to Load Device Driver} at loading atapi.sys.
    There can be a reason in something else. What will you tell?
    Monday, April 5, 2010 8:51 AM

All replies

  • Hi Artem,

    there are various reasons why a kernel dump is not generated. For instance, if the page file is disabled in the system, the kernel has no means of storing the dump on the disk. Also, if the reason for the crash is severe, the kernel might not even be able to show the blue screen.

    To better understand your question, it would be great if you could provide a scenario or system context in which you encountered the above mentioned error code.

    Best regards,

    Alex


    http://www.dcl.hpi.uni-potsdam.de/research/WRK
    Tuesday, April 27, 2010 9:05 AM
  • The paging file is active and on it enough place for dump file. Probably, a problem in KB130536.

    Wednesday, April 28, 2010 12:17 PM