Datto Windows Agent: How to retrieve memory dump files

Follow

Topic

This article discusses how to retrieve memory dump files for diagnostic use in cases where protected machines crash after a Datto Windows Agent installation.

Environment

  • Datto Windows Agent
  • Microsoft Windows

Description

There are three types of memory dumps you can choose to run. 

  • Complete memory dump
    A complete memory dump contains the full contents of physical memory at the time of the crash. Complete dumps contain the most information and are the ideal option for troubleshooting crashes.
  • Automatic/Kernel memory dump
    Automatic dumps do not contain user-mode process information but still provide useful information in a system crash. Automatic dumps are smaller than a complete dump.
  • Small memory dump (minidump)
    Minidumps are 64 KB in size for x86 systems; 128 KB on x64 systems. Minidumps contain stop code, parameters, loaded device driver list, current process and thread information, and kernel stack information for the thread that caused the system crash. Minidumps can provide some helpful information as to the cause of crashes, but may not be as useful as the more extensive options.

Directions

To create a memory dump from Windows 2003 or Windows XP operating systems, the page file must be on the boot volume of the system

1. Click Start, right-click My Computer, and select Properties. For Windows 8 or Windows 10 machines, from the directory panel on the left, select the File Explorer. Right-click the This PC icon, then click Properties.

2. In System Properties, click Advanced.

Figure 1: System Properties (click to enlarge)

3. Under the Startup and Recovery section, click Settings.

Figure 2: Settings (click to enlarge)

4. The dump file options are in the Write debugging information section.

Figure 3: Memory dump type (click to enlarge)

5. The memory dump file is typically located in %SystemRoot%\MEMORY.DMP. The system root is typically C:\Windows\System32. If you've configured the system for a minidump, the default location folder is %SystemRoot%\Minidump.

Dump files can be several gigabytes in size. If the files are too large to attach to a ticket, contact Datto Technical Support for further assistance

Opening Memory Dump Files

Standard text editors will not open .dmp files properly. Download and install the Windows Driver Kit for Windows 10 to open and view dump files.

After installing the Windows Driver Kit (WDK) for Windows 10: 

  • Open the Start menu
  • Type windbg.exe and press Enter.
  • Click File and select Open Crash Dump.
  • Browse to the .dmp file you wish to analyze
  • Click Open.

The file will load with viewable contents. 


Was this article helpful?

1 out of 1 found this helpful

You must sign in before voting on this article.

Want to talk about it? Have a feature request?

Head on over to our Datto Community Forum or the Datto Community Online.

For more Business Management resources, see the Datto RMM Online Help and the Autotask PSA Online Help .

Still have questions? Get live help.

Datto Homepage