Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

An API that attaches header information to the memory image is available for OEM computers that have "capture memory image" capability in Windows Server 2003


View products that this article applies to.

Introduction

Some computers can capture a memory image when they stop responding, when performance is extremely slow, or when they crash without providing a crash dump file. After the computer captures the memory image, the computer requires a Microsoft Windows application programming interface (API) to analyze the image with debug tools. This API attaches information that is required for debugging the image. An API for attaching the header information to the memory image is now available. This API is scheduled to be included in Service Pack 1 (SP1) for Microsoft Windows Server 2003.

↑ Back to the top


More information

Update information

A supported feature that modifies the default behavior of the product is available from Microsoft. However, this feature is intended to modify only the behavior that this article describes. Apply this feature only to systems that specifically require it. This feature might receive additional testing. Therefore, if the system is not severely affected by the lack of this feature, we recommend that you wait for the next software update that contains this feature.

If the feature is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the feature.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific feature. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site: Note The "Hotfix download available" form displays the languages for which the feature is available. If you do not see your language, it is because the feature is not available for that language.

Prerequisites

Prerequisites are supplied by the OEMs that provide the feature to capture a memory image from a non-responding computer.

Restart requirement

The restart requirement is supplied by the OEMs that provide the feature to capture a memory image from a non-responding computer.

Hotfix replacement information

Hotfix replacement information is supplied by the OEMs that provide the feature to capture a memory image from a non-responding computer.

File information

The English version of this update has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.
   Date         Time   Version         Size       File name
   ------------------------------------------------------------
   06-Mar-2004  00:44  5.2.3790.139    2,407,424  Ntkrnlmp.exe
   06-Mar-2004  00:30  5.2.3790.139    2,064,896  Ntkrnlpa.exe
   06-Mar-2004  00:30  5.2.3790.139    2,108,416  Ntkrpamp.exe
   06-Mar-2004  00:47  5.2.3790.139    2,207,232  Ntoskrnl.exe

API information

The following information applies to this API:
  • The API is restricted to full dumps only. For example, the API is restricted to complete memory images of the computer.
  • The API will not account for any dynamic data, such as contact information or secondary dump callbacks.
  • The API may also lack certain information if the image is captured early in the startup process of the operating system.
  • The API is named "KeInitializeCrashDumpHeader." This API will be documented in the driver development kit (DDK) for Windows Server 2003 SP1 and in the Debug documentation.
Note If the computer can capture a crashed system image "off-line" without the use of Crashdump.sys, set the Startup and Recovery setting for Write debugging information to (none). To do this:
  1. In Control Panel, double-click System.
  2. Click the Advanced tab.
  3. Under Startup and Recovery, click Settings.
  4. In the Write debugging information box, click (none).
The API does not have to have the crash dump selection set in the Write debugging information box to capture the image in memory. You do not have to specify Small Memory dump (64KB) or Kernel memory dump in this box because the new API captures the full image. The API only works for full memory images. The full memory image may be required to completely understand an issue. A small memory dump or a kernel memory dump may not provide enough information to resolve the issue.

For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
824684 Description of the standard terminology that is used to describe Microsoft software updates

↑ Back to the top


Keywords: KB838461, kbhotfixserver, kbqfe, kbwinserv2003presp1fix, kbbug, kbinfo, kbhowto, kbautohotfix

↑ Back to the top

Article Info
Article ID : 838461
Revision : 10
Created on : 6/2/2006
Published on : 6/2/2006
Exists online : False
Views : 728