“THIS DUMP FILE IS PARTIALLY CORRUPT”.

  • Article

I was investigating an issue today and needed to create a kernel dump on demand in my repro machine, a copy of Windows Server 2003 SP2 hosted in Hyper-V. I successfully blue-screened it (!):

image

and left it to get on with generating the dump and rebooting. Because I wasn’t watching it I never saw it actually get to 100%.

However when I opened the dump I got a whole load of messages I didn’t like the look of:

Kernel Complete Dump File: Full address space is available
************************************************************
WARNING: Dump file has been truncated. Data may be missing.
**************************************************************************
THIS DUMP FILE IS PARTIALLY CORRUPT.
KdDebuggerDataBlock is not present or unreadable.
**************************************************************************
*********************************************************************
Unable to read PsLoadedModuleList
**************************************************************************
THIS DUMP FILE IS PARTIALLY CORRUPT.
KdDebuggerDataBlock is not present or unreadable.
**************************************************************************
Unable to read selector for PCR for processor 0
GetContextState failed, 0x80070026
GetContextState failed, 0x80070026
Unable to get current machine context, Win32 error 0n38
GetContextState failed, 0x80070026
Unable to get current machine context, Win32 error 0n38
GetContextState failed, 0x80070026

and so it went on, and on, and on, page after page of scary looking error messages.

So I tried again a few times but always the same result.

Then I got to thinking about why the dump might not be getting fully written and I thought “pagefile”.

The pagefile settings in the pre-configured virtual image I was using looked something like this:

image

And sure enough if you try to set such settings you get a warning like this:

image

 

So I set it back to “system managed size”:

 

image

and rebooted then crashed the system again and this time the dump was fine with no corruption reports.

Now I had always thought (and thought it had been my experience) that if your pagefile was too small then you simply didn’t get the dump file created when the crash occurred.  I had not realised that you might end up with a “partially corrupt” dump file.

HTH

Doug