From mboxrd@z Thu Jan 1 00:00:00 1970 From: Konrad Rzeszutek Wilk Subject: Re: capturing windows crash dumps Date: Wed, 19 Aug 2009 09:35:11 -0400 Message-ID: <20090819133510.GA26154@phenom.dumpdata.com> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Content-Disposition: inline In-Reply-To: List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: James Harper Cc: xen-devel@lists.xensource.com, Keir Fraser List-Id: xen-devel@lists.xenproject.org > > > The memory in question could be anything from 64kb (minidump) to the > > > size of DomU memory (full dump) or somewhere inbetween (kernel > dump). > > > I'm normally just interested in the kernel dump which is normally a > much > > > more respectable size, but still not the size of memory you can > easily > > > find when the system has gone belly up. > > > > Hmm, okay. Could you dump it out over the emulated serial line? > > > > The more I look into it the less fond I get of this idea... I already > use the serial line for other things. Not being familiar with Windows dumps, but only with Linux kdump (which is basically a mini-Linux distro running in 64MB - that includes the initrd.img and + RAM space) which can dump the entire memory on to whatever you want (NFS, disk, USB, etc). How does Windows natively/normally do its dump? Is it just dumping the entire memory space on the local disk? Or do you have to set special flags to do so from the driver?