This article explains how to generate a full memory dump by forcing the system to crash in one of following scenarios:
- System hangs or unresponsive
- System slowness
- High kernel memory use
Use the settings in
KB56023 to configure the system to generate a memory dump file if a crash dump file is needed. Then, use one of the following procedures to force the crash dump.
Forcing a crash dump from the keyboard:
- Enable the keyboard initiated crash in the registry:
- With PS/2 keyboards:
- Browse to registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\i8042prt\Parameters.
- Create a REG_DWORD value named CrashOnCtrlScroll.
- Set its data as 0x01.
- With USB keyboards:
- Browse to registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\kbdhid\Parameters.
- Create a REG_DWORD value named CrashOnCtrlScroll.
- Set its data as 0x01.
- Restart the system for these settings to take effect.
- After completing the above procedure, you can initiate the keyboard crash by using the following hotkey sequence. Hold down the rightmost CTRL key, and press the SCROLL LOCK key twice. The system then calls KeBugCheck and issues bug check 0xE2 (MANUALLY_INITIATED_CRASH). The dump file gets written to the specified location.
Forcing a crash dump through NotMyFault.exe:
If the system can be accessed while the problem is occurring, use the Microsoft Sysinternals
NotMyFault tool to generate the crash dump. Follow these steps:
- Download the NotMyFault tool from http://download.sysinternals.com/files/NotMyFault.zip.
- Click Start, Run, type cmd, and click OK.
- At the command line, type NotMyFault.exe /crash, and then press Enter. The system crashes with Bug Check D1. A dump file is then written to the specified location.
Generating a memory dump with LiveKD without crashing or restarting the system:
If the user can log on or access the system while the problem is occurring, you can use the Microsoft Sysinternals
LiveKD tool to generate the memory dump without crashing or restarting the system. For instructions, see
KB50467.
