JSI Tip 0726. Prepare for your next Blue Screen

Being prepared for your next Blue Screen bugcheck will make problem resloution a lot easier.

1. Use Control Panel / System / Startup... and check Write an event to the system log.

      Here is a sample of an event message generated from a bugcheck

 Event ID: 1001 Source: Save Dump Description: The computer has rebooted from a bugcheck. The bugcheck was : 0xc000021a (0xe1270188, 0x00000001, 0x00000000, 0x00000000). Microsoft Windows NT (v15.1381). A dump was saved in:  C:WINNTMEMORY.DMP.

2. Obtain Dumpchk.exe from the SP3 CD-ROM or download it. Before running dumpchk.exe, open the command prompt and
      right click the title. Choose Properties / Layout and set the Screen Buffer Size Height to 999.
     To run dumpchk.exe, type: dumpchk.exe memory.dmp
     The most relevant information displayed will repeat the stop code and parameters, in addition to the ExceptionAddress

    MachineImageType   i386    NumberProcessors   1    BugCheckCode      0xc000021a    BugCheckParameter1   0xe1270188    BugCheckParameter2   0x00000001    BugCheckParameter3   0x00000000    BugCheckParameter4   0x00000000    ExceptionCode      0x80000003    ExceptionFlags      0x00000001    ExceptionAddress   0x8014fb84

3. Use Pstat from the Reskit Supplement Two to identify the ModuleName whose Load Addr is just lower than the
     ExceptionAddress. In this example, it is Ntoskrnl.exe

   ModuleName Load Addr   Code    Data   Paged           LinkDate    -------------------------------------------------------------------------    ntoskrnl.exe 80100000  270272   40064  434816 Sun May 11 00:10:39 1997 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 

4. You can now go to the Knowledge Base an search for an article that mimicks your situation.

Note: Not all bugchecks will display all this information.