Article ID: 112471, created on Oct 7, 2011, last review on Jun 17, 2016

  • Applies to:
  • Virtuozzo containers for Windows

Summary

In some cases, a full memory dump is required to determine the root cause of server slowdowns and performance problems.

This article describes how to obtain a full memory dump on a running server.

For the servers with a lot of memory installed, collecting a full dump is a time-consuming process, so limiting the amount of RAM on the host may be considered, although a server restart is required in this case.

Resolution path depends on possibility to access http://msdl.microsoft.com from the affected server.

The node has access to the Internet

  1. Download and install the latest 32-bit or 64-bit Windows Debugging toolkit, depending on your server architecture.

  2. Download LiveKD tool from Sysinternals.com.

  3. Open the command prompt as Administrator and change the directory to the folder to which you downloaded LiveKD.exe.

  4. Launch LiveKD and press 'y' to download the symbols (access to http://msdl.microsoft.com is required):

    C:\>livekd.exe
    
    LiveKd v5.31 - Execute kd/windbg on a live system
    Sysinternals - www.sysinternals.com
    Copyright (C) 2000-2013 Mark Russinovich and Ken Johnson
    
    Symbols are not configured. Would you like LiveKd to set the _NT_SYMBOL_PATH
    directory to reference the Microsoft symbol server so that symbols can be
    obtained automatically? (y/n) y
    
    Enter the folder to which symbols download (default is c:\symbols):
    Launching C:\program files\Debugging Tools for Windows (x64)\kd.exe:
    
    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    Loading Dump File [C:\Windows\livekd.dmp]
    Kernel Complete Dump File: Full address space is available
    
    Comment: 'LiveKD live system view'
    Symbol search path is: srv*C:\symbols
    *http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
    Product: Server, suite: TerminalServer DataCenter SingleUserTS
    Built by: 7601.19018.amd64fre.win7sp1_gdr.150928-1507
    Machine Name:
    Kernel base = 0xfffff800`01615000 PsLoadedModuleList = 0xfffff800`0185c730
    Debug session time: Wed Feb  3 04:04:30.297 2016 (UTC + 3:00)
    System Uptime: 0 days 0:06:59.608
    Loading Kernel Symbols
    ...............................................................
    ..........
    Loading User Symbols
    ............
    Loading unloaded module list
    ......
    0: kd>
    
  5. Trigger the dump generation when it is needed:

    0: kd> .dump /f C:\memory.dmp
    Please consider including the "/b" option to compress the dump file in a CAB.
    Disk space required could be cut by around 75%.
    Creating C:\memory.dmp - Full kernel dump
    Percent written 0
    Percent written 1
    .................
    Percent written 99
    Dump successfully written
    0: kd>
    
  6. Before uploading the dump to the file exchange share, compress it using any archiving software.

The node does not have access to the Internet

  1. Download and install the latest 32-bit or 64-bit Windows Debugging toolkit, depending on your server architecture, on two machines — the one where a memory dump is to be collected (server without Internet access), and a PC with the access to http://msdl.microsoft.com (client with the Internet access).

  2. Copy ntoskrnl.exe, kernel32.dll and ntdll.dll from C:\Windows\system32 on the server to the client, for example, to C:\debug.

  3. Go to the client and download the symbols manually:

    C:\Program Files\Debugging Tools for Windows (x64)>symchk.exe /if C:\debug\* /s srv*C:\debug*http://msdl.microsoft.com/download/symbols
    
    SYMCHK: FAILED files = 0
    SYMCHK: PASSED + IGNORED files = 3
    
  4. Copy downloaded .pdb files from C:\debug to the server without Internet access, for example, to C:\symbols.

  5. Download LiveKD tool from Sysinternals.com on the server.

  6. Open the command prompt as Administrator and change the directory to the folder to which you downloaded LiveKD.exe.

  7. Launch LiveKD, press 'y', and type the path to manually downloaded symbols (C:\symbols):

    C:\>livekd.exe
    
    LiveKd v5.31 - Execute kd/windbg on a live system
    Sysinternals - www.sysinternals.com
    Copyright (C) 2000-2013 Mark Russinovich and Ken Johnson
    
    Symbols are not configured. Would you like LiveKd to set the _NT_SYMBOL_PATH
    directory to reference the Microsoft symbol server so that symbols can be
    obtained automatically? (y/n) y
    
    Enter the folder to which symbols download (default is c:\symbols): C:\symbols
    Launching C:\program files\Debugging Tools for Windows (x64)\kd.exe:
    
    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    Loading Dump File [C:\Windows\livekd.dmp]
    Kernel Complete Dump File: Full address space is available
    
    Comment: 'LiveKD live system view'
    Symbol search path is: srv*C:\symbols
    *http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
    Product: Server, suite: TerminalServer DataCenter SingleUserTS
    Built by: 7601.19018.amd64fre.win7sp1_gdr.150928-1507
    Machine Name:
    Kernel base = 0xfffff800`01615000 PsLoadedModuleList = 0xfffff800`0185c730
    Debug session time: Wed Feb  3 04:04:30.297 2016 (UTC + 3:00)
    System Uptime: 0 days 0:06:59.608
    Loading Kernel Symbols
    ...............................................................
    Loading User Symbols
    ............
    Loading unloaded module list
    ......
    0: kd>
    
  8. Trigger the dump generation when it is needed:

    0: kd> .dump /f C:\memory.dmp
    Please consider including the "/b" option to compress the dump file in a CAB.
    Disk space required could be cut by around 75%.
    Creating C:\memory.dmp - Full kernel dump
    Percent written 0
    Percent written 1
    .................
    Percent written 99
    Dump successfully written
    0: kd>
    
  9. Before uploading the dump to the file exchange share, compress it using any archiving software.

Search Words

livekd

BSoD

full memory dump

can not access server via RDP

Container in stopping state

Attachments

d02f9caf3e11b191a38179103495106f 2897d76d56d2010f4e3a28f864d69223 965b49118115a610e93635d21c5694a8

Email subscription for changes to this article
Save as PDF