Windows 8 and Windows Server 2012: Automatic Memory Dump

There is a new memory dump option introduced in Windows 8 and Windows Server 2012 called “Automatic memory dump.” This is the default option selected when you install Windows.

clip_image001

The “Automatic memory dump” type was created to support the “System Managed” page file configuration.

clip_image002

The “System Managed” page file has been updated to reduce the page file size on disk, primarily for small SSDs but will also benefit servers with large amounts or ram.

The “Automatic memory dump” is not really a new memory dump type. In previous versions of Windows, we already have Mini, Kernel, and Complete memory dump options. The Automatic memory dump option produces a Kernel memory dump, the difference is when you select Automatic it allows the SMSS process to reduce the page file smaller than the size of RAM.

We use the registry to store the memory dump configuration, which can be located in

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl

The value CrashDumpEnabled contains one of the following values to identify the memory dump setting

When configured for Automatic memory dump, and the page file is set to System Managed, the page file should have a minimum size large enough to ensure that a kernel dump can be captured most of the time. Because the minimum size is only large enough most of the time, there is an additional feature to increase the minimum size of the page file. If your system experiences a bug check, we will create the registry key

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\LastCrashTime

For the next 4 weeks after this crash, the system managed page file will now have a minimum size that at least that of the amount of ram in the system.

As an example, the screenshots for this were taken from a system that has 16GB of ram installed. For the normally running system my page file is about 5.5GB

clip_image003

After the system experienced a bug check the page file size was increased to about 16.5GB

clip_image004

Now that the page file is larger than the amount of ram installed in the system, we will be able to capture the kernel memory dump in the situations where the smaller size was not large enough.

One question that may come up is “What happens if I change the memory dump type to Kernel instead of Automatic?” The system managed page file will have a minimum size that at least the size of ram.

On a final note, once the system is stable for 4 weeks we will go back to using the smaller reduced page file size. If you have fixed the issue causing the bug check and you want the page file size to return to its reduced size more quickly, you can delete or rename the LastCrashTime value listed above.

Robert Simpkins
Senior Support Escalation Engineer
Microsoft Enterprise Platforms Support