Preparation for Examining a MetaFrame 1.x Crash Dump
Preparation for Examining a MetaFrame 1.x Crash Dump Preparation for Examining a MetaFrame 1.x Crash Dump
Citrix states in their article: CTX448066
CTX448066 - Preparation for Examining a MetaFrame 1.x Crash Dump
This document was published at: http://support.citrix.com/kb/entry.jspa?externalID=CTX448066
Document ID: CTX448066, Created on: Jun 5, 2000, Updated: Apr 23, 2003
Products: Citrix MetaFrame 1.8 for Microsoft NT 4.0 Server Terminal Server Edition
The kernel crash dump file, usually called Memory.dmp, is the size of the physical memory installed on the server. In many instances, this file is too large to upload to Citrix Technical Support.
Make sure that the various system recovery settings are set in Control Panel\System\Recovery. You must enable the setting Write
debugging information to:. Use %SystemRoot%\Memory.dmp as the filename (default). It is also recommended you enable the
setting Overwrite any existing file because the system will not write a dump file if one already exists with that name.
When a Crash Occurs
If Terminal Server or Windows 2000 crashes, it writes a memory image in the \Install directory called Memory.dmp. This file will be the size of the
machines physical memory. If the page file is not at least as large as the physical memory plus approximately 20MB and there is no
free drive space on the install partition equal to the physical memory size, the memory dump will be incomplete. An incomplete
memory dump is not useful for problem diagnosis.
The page file space is important because during the "blue screen" bug check, the system writes the memory image to the pagefile.
When the system reboots, it uses the remaining portion of the pagefile until it can copy the dump from the pagefile into Memory.dmp.
If the system is configured to start a large number of ICA connections, you can get "System is running out of virtual memory"
messages while the dump is copied from the pagefile. When the dump is saved to Memory.dmp, the space is automatically reclaimed.
Using the recommended pagefile size of two times physical memory avoids these restart messages.
Symbols
Before the dump can be examined, the Terminal Server or Windows 2000 and MetaFrame symbols must be copied to the server. If any service packs,
hotfixes, or third-party drivers are installed, the symbols for them MUST be installed also.
Open the kernal dump in Windbg (Microsoft’s Windows Debugger.) When the dump opens it will provide you basic inforation and inform you to run the following command “!analyze –v”
Example below:
Symbol search path is: c:\websymbols\winsta.dbg\38bb1faac000
Executable search path is:
Windows 2000 Kernel Version 2195 (Service Pack 2) MP (8 procs) Free x86 compatible
Product: Server, suite: Enterprise TerminalServer
Kernel base = 0x80400000 PsLoadedModuleList = 0x804836e0
Debug session time: Wed Jan 22 08:27:45 2003
System Uptime: 3 days 20:00:10.625
Loading Kernel Symbols
...............................................................................................
Loading unloaded module list
...............................
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck E2, {0, 0, 0, 0}
Probably caused by : i8042prt.sys ( i8042prt!I8xProcessCrashDump+55 )
Followup: MachineOwner
User login
Who's new
- Preatercelepe
- Kxtuzjgv
- Maitacewwisat
- abnonsoks
- themopoty