Sometimes you might need to generate a Kernel Memory dump file to troubleshoot the issues related to Kernel Mode components. There are three methods you can use to do so as described below:
- Crash.exe
- CrashOnCTRLScroll
- NMI (NMICrashDump)
The Crash.exe is available in both command line and GUI version.
To use CrashOnCTRLScroll, you need to create a registry entry at the following location in the registry:
- KEY Name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters
- Entry Name: CrashOnCTRLScroll
- Type: DWORD
- Value: 1(enabled), 0(disabled)
You need to restart the server for changes to take effect. After you have restarted the server, use the "CTRL+Scroll Lock Scroll Lock" to crash the server. A memory dump file will be generated at the default location on system drive.
To use the third method (NMI), you need to make sure that your server support the Non-Maskable Interrupt (NMI) capabilities. To use this method you need to create a registry entry at the following location and then press a switch located on the server to crash and generate a Kernel Memory dump file:
-
KEY Name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl
-
Entry Name: NMICrashDump
-
Type: DWORD
-
Value: 1
