Generate a memory dump for a frozen VMware, windows virtual machine.

  1. Enable complete memory dump feature by changing following registry keys:

 

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl

CrashDumpEnabled    REG_DWORD    0x1

 

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management

PagingFiles    REG_MULTI_SZ    c:\pagefile.sys 13312 13312

 

  1. Enable keyboard crash dump feature by adding following registry keys:

 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters

Value Name: CrashOnCtrlScroll

Data Type:    REG_DWORD

Value:    1

 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdhid\Parameters

Value Name: CrashOnCtrlScroll

Data Type:    REG_DWORD

Value:    1

 

  1. Enable NMI crash dump feature by adding following key:

 

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl

Value Name: NMICrashDump

Data Type:  REG_DWORD

Value:   1

 

  1. Restart Server to take effects.

 

  1. Do a memory dump test with below steps:

 

  1. a)       Capture a kernel memory dump in following ways:

o    Send NMI to Guest OS

How to send NMI to Guest OS on ESXi 6.x (2149185)

 

Or

 

o   On VM console, press Right Ctrl + Scroll Lock button 2 times.

 

  1. b)       Machine crashes into blue screen and save a memory dump, restart automatically once dump generation reaches 100%. You should be able to see 12GB C:\Windows\MEMORY.DMP file.

Leave a Reply

Your email address will not be published. Required fields are marked *