Windows XP 64 - Blue Screen of Death - no event logging?

Discussion in 'Windows 64bit' started by Vandervecken, Feb 16, 2010.

  1. Vandervecken

    Vandervecken Guest

    Hi all,
    So I have set Event logging with small memory dump in XP 64 bit, in the
    System Properties/Startup & Recovery, in order to diagnose a BSOD in
    win32k.sys, page_fault_in_nonpaged_area.
    Unfortunately, when my PC blue screens, no event is written, and no minidump
    appears in the minidump folder.
    I have tried this both with letting the PC reboot automatically, and without.
    How do I ensure a minidump appears, and a system log entry is written?

    Cheers
    Vandervecken

    PS I accidentally cross-posted this in the Media Center Edition page. Sorry!
     
    Vandervecken, Feb 16, 2010
    #1
    1. Advertising

  2. Vandervecken

    Jeff Layman Guest

    "Vandervecken" <> wrote in message
    news:...
    > Hi all,
    > So I have set Event logging with small memory dump in XP 64 bit, in the
    > System Properties/Startup & Recovery, in order to diagnose a BSOD in
    > win32k.sys, page_fault_in_nonpaged_area.
    > Unfortunately, when my PC blue screens, no event is written, and no
    > minidump
    > appears in the minidump folder.
    > I have tried this both with letting the PC reboot automatically, and
    > without.
    > How do I ensure a minidump appears, and a system log entry is written?
    >
    > Cheers
    > Vandervecken
    >
    > PS I accidentally cross-posted this in the Media Center Edition page.
    > Sorry!


    Would any of the Sysinternals utilities be of help?

    --

    Jeff
     
    Jeff Layman, Feb 16, 2010
    #2
    1. Advertising

  3. Vandervecken

    RCan Guest

    check system settings if your system is configured to be able to write a
    full memory dump.
    Normally these type of bluescreens will be generated (90%) by an
    uncompatibel driver or AV.

    How to configure system failure and recovery options in Windows
    http://support.microsoft.com/kb/307973

    Regards
    Ramazan

    "Jeff Layman" <> wrote in message
    news:#...
    >
    > "Vandervecken" <> wrote in message
    > news:...
    >> Hi all,
    >> So I have set Event logging with small memory dump in XP 64 bit, in the
    >> System Properties/Startup & Recovery, in order to diagnose a BSOD in
    >> win32k.sys, page_fault_in_nonpaged_area.
    >> Unfortunately, when my PC blue screens, no event is written, and no
    >> minidump
    >> appears in the minidump folder.
    >> I have tried this both with letting the PC reboot automatically, and
    >> without.
    >> How do I ensure a minidump appears, and a system log entry is written?
    >>
    >> Cheers
    >> Vandervecken
    >>
    >> PS I accidentally cross-posted this in the Media Center Edition page.
    >> Sorry!

    >
    > Would any of the Sysinternals utilities be of help?
    >
    > --
    >
    > Jeff
     
    RCan, Feb 16, 2010
    #3
  4. Vandervecken

    Vandervecken Guest

    I thought I had found the source and removed a small Firewire card that had
    some errors, but it isn't the cause. They are back.

    In answer to your question, I am asking the system to do a small memory
    dump. It's either that or a full Kernel dump, and I believe that dumps the
    entire 4GB of memory to disk.
    Regardless, I stillc an't fix the fact that these crashes do not log
    anything to the event log, despite being told to.

    Also, what are the sysinternals utilities?

    Regards,
    Vandervecken
     
    Vandervecken, Feb 20, 2010
    #4
  5. Vandervecken

    RCan Guest

    Hi Vandervecken,

    if this is a important system then you should definitly open a call at MS
    PSS (support) cause this can also be a faulty 3rd party kernel driver (like
    AV).

    It is too complex to explain in a newsgroup how to read that dumps but if
    you anyway want to have a look on your dump file, check the following posts
    if they help you:
    http://thebackroomtech.com/2008/01/...debugging-tools-to-analyze-a-crash-dump-bsod/
    http://technet.microsoft.com/en-us/library/cc740105(WS.10).aspx

    Sysinternals - procmon, proxexp can also help you to identify hungry
    processes but also here you need a good understanding of your systems
    ressources (kernel, user, non- paged pools, handles, threads....).

    Regards
    Ramazan

    "Vandervecken" <> wrote in message
    news:...
    > I thought I had found the source and removed a small Firewire card that
    > had
    > some errors, but it isn't the cause. They are back.
    >
    > In answer to your question, I am asking the system to do a small memory
    > dump. It's either that or a full Kernel dump, and I believe that dumps
    > the
    > entire 4GB of memory to disk.
    > Regardless, I stillc an't fix the fact that these crashes do not log
    > anything to the event log, despite being told to.
    >
    > Also, what are the sysinternals utilities?
    >
    > Regards,
    > Vandervecken
     
    RCan, Feb 20, 2010
    #5
  6. Vandervecken

    Vandervecken Guest

    The problem is that the dumps don't actually happen! That's what I've been
    trying to get help for. The crash happens, but nothing is logged to the
    event viewer, and no dumps occur, despite me setting the dump settings so
    that they should!

    "RCan" wrote:
    > It is too complex to explain in a newsgroup how to read that dumps but if
    > you anyway want to have a look on your dump file, check the following posts
    > if they help you:
    > http://thebackroomtech.com/2008/01/...debugging-tools-to-analyze-a-crash-dump-bsod/
    > http://technet.microsoft.com/en-us/library/cc740105(WS.10).aspx
     
    Vandervecken, Feb 21, 2010
    #6
  7. Vandervecken

    RCan Guest

    ok - missunderstood you here :)

    Can you please check your system settings :
    On Win7 client go to "Control Panel\All Control Panel Items\System" ->
    "Advanced System Settings". Then "Advanced" -> "Startup and Recovery" ->
    "Settings" -> "System Failure" -> change to "Complete Memory Dump". Remember
    the dump location.
    + Also you need to enable your page file in simular size as your physical
    RAM in your system. Ideally you leave the automatic setting and let windows
    manage this for you.
    To enable pagefile again -> "Control Panel\All Control Panel
    Items\System" -> "Advanced System Settings" -> "Advanced" ->
    "Performance" -> "Advanced" -> "Virtual Memory" -> "Change" -> check
    "Automatically ....."

    This relies on Windows 7.

    PS : there is also a registry key where you can do a "controlled" bluescreen
    with a key combination + somethink like "notmyfault.sys" can be used from
    sysinternals for producing an dump file.

    Hope that helps

    Regards
    Ramazan

    "Vandervecken" <> wrote in message
    news:...
    >
    > The problem is that the dumps don't actually happen! That's what I've
    > been
    > trying to get help for. The crash happens, but nothing is logged to the
    > event viewer, and no dumps occur, despite me setting the dump settings so
    > that they should!
    >
    > "RCan" wrote:
    >> It is too complex to explain in a newsgroup how to read that dumps but if
    >> you anyway want to have a look on your dump file, check the following
    >> posts
    >> if they help you:
    >> http://thebackroomtech.com/2008/01/...debugging-tools-to-analyze-a-crash-dump-bsod/
    >> http://technet.microsoft.com/en-us/library/cc740105(WS.10).aspx

    >
    >
     
    RCan, Feb 21, 2010
    #7
  8. Vandervecken

    Vandervecken Guest

    I am running XP 64 bit.

    "RCan" wrote:

    > ok - missunderstood you here :)
    >
    > Can you please check your system settings :
    > On Win7 client go to "Control Panel\All Control Panel Items\System" ->
    > "Advanced System Settings". Then "Advanced" -> "Startup and Recovery" ->
    > "Settings" -> "System Failure" -> change to "Complete Memory Dump". Remember
    > the dump location.
    > + Also you need to enable your page file in simular size as your physical
    > RAM in your system. Ideally you leave the automatic setting and let windows
    > manage this for you.
    > To enable pagefile again -> "Control Panel\All Control Panel
    > Items\System" -> "Advanced System Settings" -> "Advanced" ->
    > "Performance" -> "Advanced" -> "Virtual Memory" -> "Change" -> check
    > "Automatically ....."
    >
    > This relies on Windows 7.
    >
    > PS : there is also a registry key where you can do a "controlled" bluescreen
    > with a key combination + somethink like "notmyfault.sys" can be used from
    > sysinternals for producing an dump file.
    >
    > Hope that helps
    >
    > Regards
    > Ramazan
    >
    > "Vandervecken" <> wrote in message
    > news:...
    > >
    > > The problem is that the dumps don't actually happen! That's what I've
    > > been
    > > trying to get help for. The crash happens, but nothing is logged to the
    > > event viewer, and no dumps occur, despite me setting the dump settings so
    > > that they should!
    > >
    > > "RCan" wrote:
    > >> It is too complex to explain in a newsgroup how to read that dumps but if
    > >> you anyway want to have a look on your dump file, check the following
    > >> posts
    > >> if they help you:
    > >> http://thebackroomtech.com/2008/01/...debugging-tools-to-analyze-a-crash-dump-bsod/
    > >> http://technet.microsoft.com/en-us/library/cc740105(WS.10).aspx

    > >
    > >

    > .
    >
     
    Vandervecken, Feb 22, 2010
    #8
  9. Vandervecken

    Vandervecken Guest

    I just had another.
    I am running memtest now, but have run it before and found no errors.
    Here is the info from the BSOD:

    The error is in win32k.sys, PAGE_FAULT_IN_NONPAGED_AREA
    STOP 0x00000050 (0xFFFFFA8000928000, 0x0000000000000000, 0xFFFFF97FFF180344,
    0x0000000000000000)

    win32k.sys - Address FFFFF97FFF180344, base at FFFFF97FFF000000, Datestamp
    4a8403c8

    Any ideas?

    Once again, this is an XP64 system, and I am unable to get minidumps working
    to diagnose the problem. This is usually a faulty driver, but I have no idea
    which driver, or what is causing it.

    "Vandervecken" wrote:

    > I am running XP 64 bit.
    >
    > "RCan" wrote:
    >
    > > ok - missunderstood you here :)
    > >
    > > Can you please check your system settings :
    > > On Win7 client go to "Control Panel\All Control Panel Items\System" ->
    > > "Advanced System Settings". Then "Advanced" -> "Startup and Recovery" ->
    > > "Settings" -> "System Failure" -> change to "Complete Memory Dump". Remember
    > > the dump location.
    > > + Also you need to enable your page file in simular size as your physical
    > > RAM in your system. Ideally you leave the automatic setting and let windows
    > > manage this for you.
    > > To enable pagefile again -> "Control Panel\All Control Panel
    > > Items\System" -> "Advanced System Settings" -> "Advanced" ->
    > > "Performance" -> "Advanced" -> "Virtual Memory" -> "Change" -> check
    > > "Automatically ....."
    > >
    > > This relies on Windows 7.
    > >
    > > PS : there is also a registry key where you can do a "controlled" bluescreen
    > > with a key combination + somethink like "notmyfault.sys" can be used from
    > > sysinternals for producing an dump file.
    > >
    > > Hope that helps
    > >
    > > Regards
    > > Ramazan
    > >
    > > "Vandervecken" <> wrote in message
    > > news:...
    > > >
    > > > The problem is that the dumps don't actually happen! That's what I've
    > > > been
    > > > trying to get help for. The crash happens, but nothing is logged to the
    > > > event viewer, and no dumps occur, despite me setting the dump settings so
    > > > that they should!
    > > >
    > > > "RCan" wrote:
    > > >> It is too complex to explain in a newsgroup how to read that dumps but if
    > > >> you anyway want to have a look on your dump file, check the following
    > > >> posts
    > > >> if they help you:
    > > >> http://thebackroomtech.com/2008/01/...debugging-tools-to-analyze-a-crash-dump-bsod/
    > > >> http://technet.microsoft.com/en-us/library/cc740105(WS.10).aspx
    > > >
    > > >

    > > .
    > >
     
    Vandervecken, Feb 23, 2010
    #9
  10. Vandervecken

    RCan Guest

    Sorry but the root cause cannot be identified with the provided details here
    :-(

    Here is also an article for configuring full memory dump on a XP client :
    http://support.microsoft.com/kb/316450

    Regards
    Ramazan

    "Vandervecken" <> wrote in message
    news:...
    > I just had another.
    > I am running memtest now, but have run it before and found no errors.
    > Here is the info from the BSOD:
    >
    > The error is in win32k.sys, PAGE_FAULT_IN_NONPAGED_AREA
    > STOP 0x00000050 (0xFFFFFA8000928000, 0x0000000000000000,
    > 0xFFFFF97FFF180344,
    > 0x0000000000000000)
    >
    > win32k.sys - Address FFFFF97FFF180344, base at FFFFF97FFF000000, Datestamp
    > 4a8403c8
    >
    > Any ideas?
    >
    > Once again, this is an XP64 system, and I am unable to get minidumps
    > working
    > to diagnose the problem. This is usually a faulty driver, but I have no
    > idea
    > which driver, or what is causing it.
    >
    > "Vandervecken" wrote:
    >
    >> I am running XP 64 bit.
    >>
    >> "RCan" wrote:
    >>
    >> > ok - missunderstood you here :)
    >> >
    >> > Can you please check your system settings :
    >> > On Win7 client go to "Control Panel\All Control Panel Items\System" ->
    >> > "Advanced System Settings". Then "Advanced" -> "Startup and
    >> > Recovery" ->
    >> > "Settings" -> "System Failure" -> change to "Complete Memory Dump".
    >> > Remember
    >> > the dump location.
    >> > + Also you need to enable your page file in simular size as your
    >> > physical
    >> > RAM in your system. Ideally you leave the automatic setting and let
    >> > windows
    >> > manage this for you.
    >> > To enable pagefile again -> "Control Panel\All Control Panel
    >> > Items\System" -> "Advanced System Settings" -> "Advanced" ->
    >> > "Performance" -> "Advanced" -> "Virtual Memory" -> "Change" -> check
    >> > "Automatically ....."
    >> >
    >> > This relies on Windows 7.
    >> >
    >> > PS : there is also a registry key where you can do a "controlled"
    >> > bluescreen
    >> > with a key combination + somethink like "notmyfault.sys" can be used
    >> > from
    >> > sysinternals for producing an dump file.
    >> >
    >> > Hope that helps
    >> >
    >> > Regards
    >> > Ramazan
    >> >
    >> > "Vandervecken" <> wrote in
    >> > message
    >> > news:...
    >> > >
    >> > > The problem is that the dumps don't actually happen! That's what
    >> > > I've
    >> > > been
    >> > > trying to get help for. The crash happens, but nothing is logged to
    >> > > the
    >> > > event viewer, and no dumps occur, despite me setting the dump
    >> > > settings so
    >> > > that they should!
    >> > >
    >> > > "RCan" wrote:
    >> > >> It is too complex to explain in a newsgroup how to read that dumps
    >> > >> but if
    >> > >> you anyway want to have a look on your dump file, check the
    >> > >> following
    >> > >> posts
    >> > >> if they help you:
    >> > >> http://thebackroomtech.com/2008/01/...debugging-tools-to-analyze-a-crash-dump-bsod/
    >> > >> http://technet.microsoft.com/en-us/library/cc740105(WS.10).aspx
    >> > >
    >> > >
    >> > .
    >> >
     
    RCan, Feb 24, 2010
    #10
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Angus McBagpipe

    Re: A Blue Screen of Death Question.

    Angus McBagpipe, Jun 21, 2003, in forum: Computer Support
    Replies:
    0
    Views:
    1,752
    Angus McBagpipe
    Jun 21, 2003
  2. Bob

    Blue screen of death..........

    Bob, Jul 3, 2003, in forum: Computer Support
    Replies:
    1
    Views:
    719
    ┬░Mike┬░
    Jul 4, 2003
  3. rabraham7

    Blue screen of death

    rabraham7, Sep 18, 2003, in forum: Computer Support
    Replies:
    6
    Views:
    776
    slumpy
    Sep 22, 2003
  4. Blue Screen of Death: Windows XP Pro

    , Jun 3, 2004, in forum: Computer Support
    Replies:
    11
    Views:
    3,711
    Jimmy Dean
    Jun 6, 2004
  5. dfinc
    Replies:
    3
    Views:
    1,101
Loading...

Share This Page