Citrix states in their article: CTX448066

CTX448066 - Preparation for Examining a MetaFrame 1.x Crash Dump

This document was published at: http://support.citrix.com/kb/entry.jspa?externalID=CTX448066

Document ID: CTX448066, Created on: Jun 5, 2000, Updated: Apr 23, 2003

Products: Citrix MetaFrame 1.8 for Microsoft NT 4.0 Server Terminal Server Edition

The kernel crash dump file, usually called Memory.dmp, is the size of the physical memory installed on the server. In many instances, this file is too large to upload to Citrix Technical Support.

Make sure that the various system recovery settings are set in Control Panel\System\Recovery. You must enable the setting Write
debugging information to:. Use %SystemRoot%\Memory.dmp as the filename (default). It is also recommended you enable the
setting Overwrite any existing file because the system will not write a dump file if one already exists with that name.

When a Crash Occurs

If Terminal Server or Windows 2000 crashes, it writes a memory image in the \Install directory called Memory.dmp. This file will be the size of the
machines physical memory. If the page file is not at least as large as the physical memory plus approximately 20MB and there is no
free drive space on the install partition equal to the physical memory size, the memory dump will be incomplete. An incomplete
memory dump is not useful for problem diagnosis.

The page file space is important because during the "blue screen" bug check, the system writes the memory image to the pagefile.
When the system reboots, it uses the remaining portion of the pagefile until it can copy the dump from the pagefile into Memory.dmp.
If the system is configured to start a large number of ICA connections, you can get "System is running out of virtual memory"
messages while the dump is copied from the pagefile. When the dump is saved to Memory.dmp, the space is automatically reclaimed.
Using the recommended pagefile size of two times physical memory avoids these restart messages.

Symbols

Before the dump can be examined, the Terminal Server or Windows 2000 and MetaFrame symbols must be copied to the server. If any service packs,
hotfixes, or third-party drivers are installed, the symbols for them MUST be installed also.

Open the kernal dump in Windbg (Microsoft’s Windows Debugger.) When the dump opens it will provide you basic inforation and inform you to run the following command “!analyze –v”

Example below:

Symbol search path is: c:\websymbols\winsta.dbg\38bb1faac000

Executable search path is:

Windows 2000 Kernel Version 2195 (Service Pack 2) MP (8 procs) Free x86 compatible

Product: Server, suite: Enterprise TerminalServer

Kernel base = 0x80400000 PsLoadedModuleList = 0x804836e0

Debug session time: Wed Jan 22 08:27:45 2003

System Uptime: 3 days 20:00:10.625

Loading Kernel Symbols

...............................................................................................

Loading unloaded module list

...............................

Loading User Symbols

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck E2, {0, 0, 0, 0}

Probably caused by : i8042prt.sys ( i8042prt!I8xProcessCrashDump+55 )

Followup: MachineOwner