Crashes without crash dumps
I'm running the Windows 7 beta (x64) on a ThinkPad X61, and it frequently crashes (once every day or two), but leaves no crash dumps. Often the crashes are manually initiated from the keyboard, after the system has frozen (no response to keyboard or mouse input, and no updating of the clock for several minutes).The crash dump mechanismappears to proceed properly (with a full dump, I can see the hard drive activity, so I know it's writing), but after it finishes and reboots, there is simply no dump file (no C:\Windows\memory.dmp, and nothing in C:\Windows\Minidump). Minidumps are currently enabled, but I've tried kernel and full dumps as well, with the same result.In addition to a lack of crash dumps, the 'Reliability Monitor' shows no OS crashes (Windows failures). If this is the information being reported to Microsoft, then it is creating an illusion of reliability, when in fact the system is extremely unstable compared to Vista.Does anyone know of a way to troubleshoot this? It seems like a waste to run a beta if the crash dumps alldisappear into a black hole.
February 23rd, 2009 8:38am

Do the crashes end with a BSOD?What exactly do you mean with "manually initiated from the keyboard" while after that you say that the system is frozen? How do you manage to 'initiate" something from a frozen system?
Free Windows Admin Tool Kit Click here and download it now
February 23rd, 2009 11:27am

1. Yes, the crashes end with a blue screen, either automatically (in a few cases) or manually (more often). The blue screen reports the progress of the memory dump (with the percentage written when full or kernel dump is enabled and so on), but after it reboots there is no dump file, and the Reliability Monitor does not show that a crash occurred.2. After a few freezes where I had to power off, I enabled the manual crashdump feature:http://support.microsoft.com/default.aspx/kb/244139. When the system has been frozen for a few minutes, I type (right) Ctrl + Scroll Lock twiceto generate a crash dump. The blue screen appears etc, as described above.
February 23rd, 2009 1:19pm

You hould have a minidump in Windows\MiniDump. The name of the dump file is the report ID, so you should look at the time the file was written to find the right one, or search the eventlog for the error message.Note that the error message in the system eventlog is partly wrong, it says:A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 022309-21730-01.The report ID is the actual name of the dumpfile in MiniDump with dmp appended.
Free Windows Admin Tool Kit Click here and download it now
February 23rd, 2009 2:34pm

The excellent WhoCrashed program works in Windows 7. It may reveal the program/driver responsible for crashing your computer. It is more understandable that the Windows MiniDump reader. Download it here http://www.resplendence.com/whocrashed and install it. To run it click Analyze, then scroll down to see the error(s). Copy and paste the message back here if you dont understand it. When it is first run, it will download the Windows Debugging package, which is perfectly normal.
February 23rd, 2009 5:12pm

This looks like a neat tool, but I think it also relies on having crash dumps available. The information displayed in the screenshot looks like a more user-friendly version of what you'd see if you opened a dump file in WinDBG (which isn't too hard to understand on its own).Tasdk, I'm curious about your issue so I'll try to do some research/experiments for you until someone comes up with the solution. I assume you've disabled the automatic restart feature. Have you at least been able to get the STOP code? There is at least one crash that is the rare userland BSOD (0xC000021a) which was plaguing our systems for a while. It would never write a crash dump, so I had to rely on Dr. Watson logs to find the answer. Could this be your issue? I'd have expected the manual crash to write a dump anyway, but I don't know that for sure.Finally, I'm not sure hard drive activity is confirmation that a dump was being written. Small memory dumps are too short to notice, but a kernel dump should take long enough that you'll actually see the progress displayed as a percentage at the bottom of the BSOD.Good luck and have fun (am I sick for thinking these are fun?)!
Free Windows Admin Tool Kit Click here and download it now
February 23rd, 2009 5:27pm

Oh dear!I was going to have you try NotMyFault, but I ran it on my own system first. It crashed my system as I expected and the bugcheck reported that it was saving a dump. But after the reboot I can't find MEMORY.DMP, there's not so much as a blip on the Reliability Monitor (and WHY did I have to Google to find out where it's been moved?), and there's nothing in the Event Log!What a strange problem. I hope this is a bug and not intended.
February 23rd, 2009 6:26pm

If its of any use, this morning I created an entry in \Windows\Minidump\ named 022309-18938-01.dmp
Free Windows Admin Tool Kit Click here and download it now
February 23rd, 2009 6:32pm

That sounds very much like the same problem. The event log contains a Kernel-Powerevent indicating the system rebooted without cleanly shutting down, but nothing about the Stop-error/blue-screen (and the check box to write an event on system failure is set).I have tried kernel and full memory dumps, and then I can see the hard drive activity as the percentage dumped is filled in during the bugcheck, so I am fairly certain the bugcheck code is writing something to the drive.
February 23rd, 2009 7:39pm

I did a manual dump of Windows 7 and discovered that it creates the .DMP files in c:\Windows\Minidump. The files names are listed as a date-time name followed by .dmp extension. However, to find these file, you have to initiate an administrative command prompt (open command prompt as administrator) and issue a dir /S *.dmp at the c:\Windows prompt. Doing a search in the command prompt using normal credentials fill fail to yield this location. Likewise, when you manually navigate to C:\Windows\Minidump via Explorer, you will have to acknowledge a UAC prompt to gain access. Also, in c:\Windows is the memory.dmp dump. User initiated dumps from specific processes via Task Manger will create dump files in c:\Users\%userprofile%\AppData\Local\Temp folder. The dump name will be the name of the service with a.DMP extension. The dump files dont disappear into black holes.
Free Windows Admin Tool Kit Click here and download it now
February 23rd, 2009 8:04pm

I am aware of the proper locations for all of these dump types, but they just don't show up. I've no trouble finding them in XP or Vista. But I've looked everywhere and did a dir /S *.dmp on the whole drive and the only thing found is a process dump I took earlier today.I'm going to try to find them from my Ubuntu partition because if they are hidden in some bizarre way I will be able to see it from there. But otherwise I really don't think they're there.
February 23rd, 2009 8:26pm

Did you do the dir /S *.dmp from a command prompt you opened as administrator? If not, then the ones located in c:\windows\minidump wont show.
Free Windows Admin Tool Kit Click here and download it now
February 23rd, 2009 8:48pm

Yep, did that. And I've set it to do a Kernel dump, which means I should get a Memory.dmp in c:\Windows as well. I ran NotMyFault.sys in Vista on the same laptop and got a lovely memory.dmp file, too.Now, my drive for 7 shows a red bar for space instead of blue, but it has 1.18 GB free. Since a kernel dump and not a full dump is being taken, that shouldn't affect it, right?
February 23rd, 2009 8:57pm

Wow. I guess in your case the Large Hadron Collider actually did spawn off mini-black holes that are sucking your dump files. J
Free Windows Admin Tool Kit Click here and download it now
February 23rd, 2009 9:33pm

I did a quick search on your laptop. its a very powerful device. BUT! there is ( maybe) a problem running 64 bit (ultimate) product on it. another issue is the video card and the cpu, check carefully if they support exactly windows ultimate 64 bit version ( beta).Crashes without crash dumps means simply a hardware issue which is not known as a operating system failer!
February 24th, 2009 2:27am

Thank you for the suggestion, but 64-bit Vista works fine, and this problem only occurs with Windows 7. It is therefore a bug in Windows 7, and not a hardware problem.
Free Windows Admin Tool Kit Click here and download it now
February 24th, 2009 7:37am

I'll also point out that I have more than 30GB free on my OS partition, and only 2GB of RAM, so there is no problem of disc space. One possible issue, however, is that the Windows 7 installer created a 200MB hidden partition for the boot loader (this was the default when presented with an empty drive). If there is a bug in Windows 7 causing it to try to write to the boot partition instead of the OS partition, that might be relevant.
February 24th, 2009 7:56am

Hmm, where did you find this? I don't recall seeing one on mine, but if it's hidden, who knows?I'm really curious about what could cause a crash dump to look like it's being written but evaporate into space. I don't know if it's related (and if not, I'll gather detailed info and start a new thread), but when I go into the Advanced System Properties sheet to mess with the Startup and Recovery settings, clicking OK (even if I changed nothing), will cause SystemPropertiesAdvanced to hang forever, with no detectable activity (in Process Monitor) after performing some operation on pagefile.sys. I cannot kill or suspend the process by any means I know. It will also prevent me from shutting down or restarting the system.
Free Windows Admin Tool Kit Click here and download it now
February 24th, 2009 4:30pm

Oh, and something else I'm wondering while tracking this problem:I know that a live kernel debugger will display information when a bugcheck happens, but I think it only details the crash itself. Can it also be used to monitor whether a file was created at that time? Unfortunately my 7 installation is not in a VM and I can't easily attach my laptop to another physical machine for debugging, but maybe someone with a better setup could try?
February 24th, 2009 4:36pm

I noticed the hidden partition during the setup. I had deleted the existing partition (Vista x64) after backing up, and presented Windows 7 with an empty hard drive. When I selected it and clicked install, I noticed it created two partitions, so I later looked in the Disk Administrator (diskmgmt.msc), and found the hidden 200MB one. It isn't mounted (mountvol only lists the large C: partition), but if I mount it and look at the files, I can see the boot loader files are there (instead of on C:).
Free Windows Admin Tool Kit Click here and download it now
February 24th, 2009 7:48pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics