Environment
- Carbon Black Cloud Sensor
- Microsoft Windows: All Supported Versions
Objective
How to to enable a system to generate a complete memory dump upon BSOD, or when forcing the machine to crash manually.
Resolution
Copy the following text into notepad and save the file with a «.reg» extension.
Windows Registry Editor Version 5.00
;* Configures the system to save a complete memory dump upon bug check.
;* Note: You will also need to ensure that the page file on C: is larger than the amount of installed RAM.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl]
"AutoReboot"=dword:00000001
"CrashDumpEnabled"=dword:00000001
"Overwrite"=dword:00000001
"LogEvent"=dword:00000001
"EnableLogFile"=dword:00000001
"DumpLogLevel"=dword:00000001
"AlwaysKeepMemoryDump"=dword:00000001
;* Configures the system to manually crash by holding down the right Ctrl key and pressing the Scroll Lock key twice
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdhid\Parameters]
"CrashOnCtrlScroll"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters]
"CrashOnCtrlScroll"=dword:00000001
- Backup the Windows registry
- Import above .reg file by clicking on it twice and accepting when prompted for confirmation
- Navigate to the paths above in the registry to confirm the values were successfully imported
- Ensure the pagefile is larger than the amount of installed RAM, normally by at least 300 MB (System Properties → System → Change Settings → Advanced → Performance → Advanced → Virtual Memory/Change)
- Reboot the machine
- Full memory dump will be generated should the machine present a blue screen of death (BSOD)
- To force the BSOD upon system hang, while in the hung state, hold the «Control» Key, while holding it, press the «Scroll lock» button twice, a full memory dump should be generated in the %SystemRoot%\memory.dmp directory (typically c:\windows\memory.dmp)
- Collect the .dmp file, compress it as .zip and kindly upload into the case
- From the same machine, after rebooting, run an elevated command prompt (right click cmd.exe and run as admin) and run, after ensuring c:\temp exists before running the command:
"c:\program files\confer\repcli.exe" capture c:\temp
- Rename the resulting file (psc_sensor.zip) by prepending the hostname to it, from C:\TEMP\ and please also upload into the case
Related Content
