BSOD debugging basics guide

[elstado]

Originally Posted by qwertylesh

Thats one of the beauties of the method listed in the OP, it will retrieve only the symbol files you need to debug the crash dump, you don't need to get the whole 281 meg package.
If you use the guide you'll very likely download less then 10 meg of symbol files

Edit: Don't download the 281 meg package, just put 'C:\Windows\System32; http://www.alexander.com/SymServe' in the image search path (this url works out what file versions you have for what symbol files you need) and this in the symbol search path 'SRV*C:\custompath*http://msdl.microsoft.com/download/symbols' (this url is where it will automatically download the apropriate symbol files from when you open a crash dump)

Cool, thanks for clearing that up.

Might try it tonight and see how I go. I am really sick of these random BSODs.

[qwertylesh]

Just remember, this guide and debugging in general is more useful for BSODS related to software only, If you have a hardware caused BSOD, debugging may help by telling you what hardware is likely to be causing them but not for all kinds of components, more just some core parts plus disks.

Its great for software bsods though, it'll generally pinpoint the exact problematic file and tell you the probable cause, provided the file is still on the system.

[elstado]

Originally Posted by qwertylesh

Just remember, this guide and debugging in general is more useful for BSODS related to software only, If you have a hardware caused BSOD, debugging may help by telling you what hardware is likely to be causing them but not for all kinds of components, more just some core parts plus disks.

Its great for software bsods though, it'll generally pinpoint the exact problematic file and tell you the probable cause, provided the file is still on the system.

I'll note that, I am not really sure why it is BSODing, I think it is software related (display drivers or something) but it could also be RAM or something else... just trying to whittle down possible culprits before I start replacing parts.

[elstado]

So I had a go at debugging my system today, before I start making threads or posting info here I have one quick question, in Start-up and Recovery the box for System failure says "Overwrite any existing file", which means there is only ever one new dump file to analyse, however your guide suggests to analyse the oldest available dump.

Should I interpret this as I should turn off overwrite so in the future when I get another BSOD there will be multiple files to be analysed?

Also, can I post my debug results in here, or should I make a dedicated thread for it?

Originally Posted by qwertylesh

2) Additional File Analysis (LMV):
The LMV command allows you to quickly obtain detailed file information from within the debugger. The LMV command will give you an indication of what the file does or whom the vendor of the file is, this information gives you an avenue for, updating, repair or further investigation.
After the debug analysis is performed, In the console use the LMV command to learn more about the faulting file (module_name or image_name)

I am also confused how to make this command work, I should just be able to type "LVM" in the kd> space right? When I do it just says "syntax error in 'LVM'". How can I get Additional File Analysis to work?

[qwertylesh]

Q1: on windows default settings it will write multiple dump files, you should have more then one, you should have a crash dump per bluescreen. (given the kernel panic state can write to the disk of course, which excludes 0x0000024,7E and the likes.)
Even though the Properties dialog says MEMORY.DMP, your minidump folder should not have just one MEMORY.DMP file in it, it should have numbered DMP files, ie; 5245431.DMP and so on. IMO you don't need to worry about that being ticked.

Theres probably a capacity quota or something tied to the OS so crash dumps don't cause low disk space (speculation)

Did you look in your c:\windows\minidump folder?

One thing I have neglected to mention is when debugging multiple bluescreens after another. I know the debugging tool allows you to close the workspace and open a new one so you can then debug another crash dump, but kinda forgot how to do that
All I generally do when having to debug a bunch of dumps, is take the two codeboxes from the first post here (logged into here from the affected machine as a guest) and put them into a text document, I then rename the custompath to symbols or symbolfiles and for each crash file I'll debug then close the debugging tool, open it, enter those two lines into the tool and open the next dump file.

Q2: for image_name and module_name you generally don't have to use the LMV command. these are normally blue and underlined which you can just click for the console to perform the lmv command with default syntax and filename for you. Running the command manually is for when you have a file listed somewhere which you want to find more info about and its not already underlined.

Just today I debugged about 10 files on one machine and came to the conclusion that the ram (specifically it's spd) is not natively compatible with the motherboard. memory_corruption with transcend ddr2 800 2x1 on a G31M-ES2L.

[elstado]

Originally Posted by qwertylesh

Q1: on windows default settings it will write multiple dump files, you should have more then one, you should have a crash dump per bluescreen. (given the kernel panic state can write to the disk of course, which excludes 0x0000024,7E and the likes.)
Even though the Properties dialog says MEMORY.DMP, your minidump folder should not have just one MEMORY.DMP file in it, it should have numbered DMP files, ie; 5245431.DMP and so on. IMO you don't need to worry about that being ticked.

Theres probably a capacity quota or something tied to the OS so crash dumps don't cause low disk space (speculation)

Did you look in your c:\windows\minidump folder?

Yeah I looked in c:\windows\minidump and there's only one dmp file, which is called Mini092309-01.dmp.

In c:\windows there is also a file called MEMORY.DMP, which is about 106MB in size.

Should I be concerned that it hasn't left the other dmp files? I have had about 12 BSoDs since owning this system (about 18 months), so what your saying is that on the default settings, which to my knowledge it was on, there should be 12 mini dump files?

Q2: for image_name and module_name you generally don't have to use the LMV command. these are normally blue and underlined which you can just click for the console to perform the lmv command with default syntax and filename for you. Running the command manually is for when you have a file listed somewhere which you want to find more info about and its not already underlined.

Ok, well I can't remember if it was underlined, but I will recheck. Is there a way to save the settings? I did the steps in the guide and debugged, and when I exited the program it asked me to save the workspace, I said yes, but now I want to look at the info again there is no saved workspace and it looks like I will have to repeat all the steps again (not a huge task I know, but annoying to have to repeat steps).

EDIT:

I just switched back to the debug app and now it has the info, looks like it just needed a few minutes to initialise or something.

Just tried debugging the latest mini dump again, only the "MODULE_NAME: nt" was underlined and click able, which seems to have opened new info under the command "lmvm nt".

Just today I debugged about 10 files on one machine and came to the conclusion that the ram (specifically it's spd) is not natively compatible with the motherboard. memory_corruption with transcend ddr2 800 2x1 on a G31M-ES2L.

I fear that is a similar issue to what I am experiencing, hopefully not, but if so I'll just have to get some decent RAM and maybe upgrade to W7 x64 while I am at it.

[qwertylesh]

Your current os is vista huh? :\

what has the crash dump setting set to, full, kernel or small?

[elstado]

Originally Posted by qwertylesh

Your current os is vista huh? :\

what has the crash dump setting set to, full, kernel or small?

Yes, using Vista Ultimate x86 SP2.

The options available are:

• (none)
• Small memory dump (64kb)
• Kernel memory dump

It is currently on "Kernel".

[qwertylesh]

Its odd that you only have one file, as far as i was aware you didn't need to uncheck that checkbox to get multiple crash dumps, I haven't needed to debug many vista os's but the ones i have, have had multiple files and were on their defaults.
You haven't by any chance been running the windows disk cleanup regularly or ccleaner or a similar program? those utilities will delete the files.

[elstado]

Originally Posted by qwertylesh

Its odd that you only have one file, as far as i was aware you didn't need to uncheck that checkbox to get multiple crash dumps, I haven't needed to debug many vista os's but the ones i have, have had multiple files and were on their defaults.
You haven't by any chance been running the windows disk cleanup regularly or ccleaner or a similar program? those utilities will delete the files.

Das eh Bingo!

Yes I run CCleaner once a month.

I fact I ran it last week after the second BSoD in an attempt of "cleaning" up the computer to try and fix the issue. Haha.

Just checked the settings then, it was set to clear memory dumps. I have unchecked it now.

[qwertylesh]

ah hah!
I use ccleaner too, its damn good.
You can get winapp.ini for it through the piriform forums, it'll then clear out your antivirus and antimalware quarentines and logs
extremely handy utility, but not helpful if you want to hold on to crash dumps

[elstado]

Originally Posted by qwertylesh

ah hah!
I use ccleaner too, its damn good.
You can get winapp.ini for it through the piriform forums, it'll then clear out your antivirus and antimalware quarentines and logs

As I am the sole user of this system and extremely paranoid, I actually have not ever had a virus or malware issue on this system. But I'll get it anyway, might come in handy one day.

extremely handy utility, but not helpful if you want to hold on to crash dumps

Yeah, haha, I noticed.

[qwertylesh]

much the same actually, only I use my rig but I cclean it religiously, never had malware or a virus on my rig.
I have a work machine dedicated to cleaning off viruses, its very handy for that machine to have a util that keeps it tidy, saves me heaps of time.

[LostBenji]

Qwerts, I am gonna slappppppp you with a CC trout soon.


LOL

[v8tfcorty]

okies been having issues with a bad pool header BSOD suspect graphics card driver see thread here

anywho, i have tried the guide as listed on page one and this is the result....



what does it all mean .....lol