JSI Tip 0726. Prepare for your next Blue Screen

Downloads
dumpchk.zip

Being prepared for your next Blue Screen bugcheck will make problem resloution a lot easier.

1. Use Control Panel / System / Startup... and check Write an event to the system log.

      Here is a sample of an event message generated from a bugcheck

 
Event ID: 1001 
Source: Save Dump 
Description: 
The computer has rebooted from a bugcheck. The bugcheck was : 
0xc000021a (0xe1270188, 0x00000001, 0x00000000, 0x00000000). 
Microsoft Windows NT (v15.1381). A dump was saved in:  
C:\WINNT\MEMORY.DMP.

2. Obtain Dumpchk.exe from the SP3 CD-ROM or download it. Before running dumpchk.exe, open the command prompt and
      right click the title. Choose Properties / Layout and set the Screen Buffer Size Height to 999.
     To run dumpchk.exe, type: dumpchk.exe <Path>\memory.dmp
     The most relevant information displayed will repeat the stop code and parameters, in addition to the ExceptionAddress

 
	   MachineImageType   i386 
	   NumberProcessors   1 
	   BugCheckCode      0xc000021a 
	   BugCheckParameter1   0xe1270188 
	   BugCheckParameter2   0x00000001 
	   BugCheckParameter3   0x00000000 
	   BugCheckParameter4   0x00000000 
	   ExceptionCode      0x80000003 
	   ExceptionFlags      0x00000001 
	   ExceptionAddress   0x8014fb84

3. Use Pstat from the Reskit Supplement Two to identify the ModuleName whose Load Addr is just lower than the
      ExceptionAddress. In this example, it is Ntoskrnl.exe

 
	  ModuleName 		Load Addr   Code    Data   Paged           LinkDate 
	   ------------------------------------------------------------------------- 
	   ntoskrnl.exe 		80100000  270272   40064  434816 Sun May 11 00:10:39 1997 
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 

4. You can now go to the Knowledge Base an search for an article that mimicks your situation.

Note: Not all bugchecks will display all this information.