Preparation for Examining a MetaFrame 1.x Crash Dump
|
Citrix states in their article: CTX448066 CTX448066 - Preparation for Examining a MetaFrame 1.x Crash Dump This document was published at: http://support.citrix.com/kb/entry.jspa?externalID=CTX448066 Document ID: CTX448066, Created on: Jun 5, 2000, Updated: Apr 23, 2003 Products: Citrix MetaFrame 1.8 for Microsoft NT 4.0 Server Terminal Server Edition The kernel crash dump file, usually called Memory.dmp, is the size of the physical memory installed on the server. In many instances, this file is too large to upload to Citrix Technical Support. Make sure that the various system recovery settings are set in Control Panel\System\Recovery. You must enable the setting Write When a Crash Occurs If Terminal Server or Windows 2000 crashes, it writes a memory image in the \Install directory called Memory.dmp. This file will be the size of the The page file space is important because during the "blue screen" bug check, the system writes the memory image to the pagefile. Symbols Before the dump can be examined, the Terminal Server or Windows 2000 and MetaFrame symbols must be copied to the server. If any service packs, Open the kernal dump in Windbg (Microsoft’s Windows Debugger.) When the dump opens it will provide you basic inforation and inform you to run the following command “!analyze –v” Example below: Symbol search path is: c:\websymbols\winsta.dbg\38bb1faac000 Executable search path is: Windows 2000 Kernel Version 2195 (Service Pack 2) MP (8 procs) Free x86 compatible Product: Server, suite: Enterprise TerminalServer Kernel base = 0x80400000 PsLoadedModuleList = 0x804836e0 Debug session time: Wed Jan 22 08:27:45 2003 System Uptime: 3 days 20:00:10.625 Loading Kernel Symbols ............................................................................................... Loading unloaded module list ............................... Loading User Symbols ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck E2, {0, 0, 0, 0} Probably caused by : i8042prt.sys ( i8042prt!I8xProcessCrashDump+55 ) Followup: MachineOwner |
|