An API that attaches header information to the memory image is available for OEM computers that have "capture memory image" capability in Windows Server 2003 (838461)

MORE INFORMATION

Update information

A supported feature that modifies the product's default behavior is now available from Microsoft, but it is only intended to modify the behavior that this article describes. Apply it only to systems that specifically require it. This feature may receive additional testing. Therefore, if the system is not severely affected by the lack of this feature, we recommend that you wait for the next Windows Server 2003 service pack that contains this feature.

To obtain this feature immediately, contact Microsoft Product Support Services. For a complete list of Microsoft Product Support Services telephone numbers and information about support costs, visit the following Microsoft Web site:

Prerequisites

Prerequisites are supplied by the OEMs that provide the feature to capture a memory image from a non-responding computer.

Restart requirement

The restart requirement is supplied by the OEMs that provide the feature to capture a memory image from a non-responding computer.

Hotfix replacement information

Hotfix replacement information is supplied by the OEMs that provide the feature to capture a memory image from a non-responding computer.

File information

The English version of this update has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

   Date         Time   Version         Size       File name
   ------------------------------------------------------------
   06-Mar-2004  00:44  5.2.3790.139    2,407,424  Ntkrnlmp.exe
   06-Mar-2004  00:30  5.2.3790.139    2,064,896  Ntkrnlpa.exe
   06-Mar-2004  00:30  5.2.3790.139    2,108,416  Ntkrpamp.exe
   06-Mar-2004  00:47  5.2.3790.139    2,207,232  Ntoskrnl.exe

API information

The following information applies to this API:

• The API is restricted to full dumps only. For example, the API is restricted to complete memory images of the computer.
• The API will not account for any dynamic data, such as contact information or secondary dump callbacks.
• The API may also lack certain information if the image is captured early in the startup process of the operating system.
• The API is named "KeInitializeCrashDumpHeader." This API will be documented in the driver development kit (DDK) for Windows Server 2003 SP1 and in the Debug documentation.

Note If the computer can capture a crashed system image "off-line" without the use of Crashdump.sys, set the Startup and Recovery setting for Write debugging information to (none). To do this:

1. In Control Panel, double-click System.
2. Click the Advanced tab.
3. Under Startup and Recovery, click Settings.
4. In the Write debugging information box, click (none).

The API does not have to have the crash dump selection set in the Write debugging information box to capture the image in memory. You do not have to specify Small Memory dump (64KB) or Kernel memory dump in this box because the new API captures the full image. The API only works for full memory images. The full memory image may be required to completely understand an issue. A small memory dump or a kernel memory dump may not provide enough information to resolve the issue.

For additional information, click the following article number to view the article in the Microsoft Knowledge Base: