Memory dump unreadable - what to do?

[Christoph Peus]

Hello experts,

one of our w2k3 servers is experiencing unmotivated crashes from time to
time, and I would like to use windbg to find the cause for this behaviour.
Unfortunately every attempt to open the crash dump - no matter wether
it's a minidump, kerneldump, or complete memory dump - only gives this
type of error message:

"Could not find the C:\WINDOWS\MEMORY.DMP Dump File, Win32 error 1392
The file or the directory is corrupt or unreadable." (translated from
german)

But I'm sure that the file I try to open is the rigth one, and it has
the correct size (e.g. 2GB for a complete memory dump.)

What might be the cause for this? What do I do wrong here? After I have
exchanged nearly the complete hardware of this server, reinstalled it
from scratch and updated the drivers, debugging the crash dump seems to
be my last chance to find the cause finally...

Your help is much appreciated

Christoph

[Drew Bliss [MSFT]]

It is possible that the situation causing the crash also makes it impossible
to get a valid dump. A live two-machine kernel debugger would be the only
option at that point.

There should be more specific error text above the "file or directory is
corrupt", can you show everything that the debugger outputs when attempting
to open the dump?

A dump file has header information so the page file for a complete dump must
be larger than physical memory. An extra megabyte should be sufficient for
a complete dump. A kernel-only dump has extra header information and might
need even more space, but unless you have 512MB or less in the machine it
usually isn't necessary to go beyond the physical memory size.

Post by Christoph Peus
Hello experts,
one of our w2k3 servers is experiencing unmotivated crashes from time to
time, and I would like to use windbg to find the cause for this behaviour.
Unfortunately every attempt to open the crash dump - no matter wether it's
a minidump, kerneldump, or complete memory dump - only gives this type of
"Could not find the C:\WINDOWS\MEMORY.DMP Dump File, Win32 error 1392
The file or the directory is corrupt or unreadable." (translated from
german)
But I'm sure that the file I try to open is the rigth one, and it has the
correct size (e.g. 2GB for a complete memory dump.)
What might be the cause for this? What do I do wrong here? After I have
exchanged nearly the complete hardware of this server, reinstalled it from
scratch and updated the drivers, debugging the crash dump seems to be my
last chance to find the cause finally...
Your help is much appreciated
Christoph

[Philip McGraw]

Based on the kb article at:

http://support.microsoft.com/kb/274598/

I thought one could not obtain full memory dumps on systems with 2GB or
more of RAM, even on w2k3, and even if you have a sufficiently sized
pagefile on the %SystemDrive%. Has this restriction been lifted in SP1
or some hotfix?

Philip McGraw [Bentley]

Post by Drew Bliss [MSFT]
It is possible that the situation causing the crash also makes it impossible
to get a valid dump. A live two-machine kernel debugger would be the only
option at that point.
There should be more specific error text above the "file or directory is
corrupt", can you show everything that the debugger outputs when attempting
to open the dump?
A dump file has header information so the page file for a complete dump must
be larger than physical memory. An extra megabyte should be sufficient for
a complete dump. A kernel-only dump has extra header information and might
need even more space, but unless you have 512MB or less in the machine it
usually isn't necessary to go beyond the physical memory size.

Post by Christoph Peus
Hello experts,
one of our w2k3 servers is experiencing unmotivated crashes from time to
time, and I would like to use windbg to find the cause for this behaviour.
Unfortunately every attempt to open the crash dump - no matter wether it's
a minidump, kerneldump, or complete memory dump - only gives this type of
"Could not find the C:\WINDOWS\MEMORY.DMP Dump File, Win32 error 1392
The file or the directory is corrupt or unreadable." (translated from
german)
But I'm sure that the file I try to open is the rigth one, and it has the
correct size (e.g. 2GB for a complete memory dump.)
What might be the cause for this? What do I do wrong here? After I have
exchanged nearly the complete hardware of this server, reinstalled it from
scratch and updated the drivers, debugging the crash dump seems to be my
last chance to find the cause finally...
Your help is much appreciated
Christoph

[Drew Bliss [MSFT]]

I don't have anything to do with the KB articles so I can't comment on that
article specifically, but you can generate complete dumps for machines with
more than 2GB of RAM. The control panel doesn't allow it to encourage
people to use smaller dumps, but if you tweak the registry it should produce
good dumps on Windows Server 2003.

Post by Philip McGraw
http://support.microsoft.com/kb/274598/
I thought one could not obtain full memory dumps on systems with 2GB or
more of RAM, even on w2k3, and even if you have a sufficiently sized
pagefile on the %SystemDrive%. Has this restriction been lifted in SP1 or
some hotfix?
Philip McGraw [Bentley]

Post by Drew Bliss [MSFT]
It is possible that the situation causing the crash also makes it
impossible to get a valid dump. A live two-machine kernel debugger would
be the only option at that point.
There should be more specific error text above the "file or directory is
corrupt", can you show everything that the debugger outputs when
attempting to open the dump?
A dump file has header information so the page file for a complete dump
must be larger than physical memory. An extra megabyte should be
sufficient for a complete dump. A kernel-only dump has extra header
information and might need even more space, but unless you have 512MB or
less in the machine it usually isn't necessary to go beyond the physical
memory size.

Post by Christoph Peus
Hello experts,
one of our w2k3 servers is experiencing unmotivated crashes from time to
time, and I would like to use windbg to find the cause for this behaviour.
Unfortunately every attempt to open the crash dump - no matter wether
it's a minidump, kerneldump, or complete memory dump - only gives this
"Could not find the C:\WINDOWS\MEMORY.DMP Dump File, Win32 error 1392
The file or the directory is corrupt or unreadable." (translated from
german)
But I'm sure that the file I try to open is the rigth one, and it has the
correct size (e.g. 2GB for a complete memory dump.)
What might be the cause for this? What do I do wrong here? After I have
exchanged nearly the complete hardware of this server, reinstalled it
from scratch and updated the drivers, debugging the crash dump seems to
be my last chance to find the cause finally...
Your help is much appreciated
Christoph