Server did NOT create Memory.DMP file during lock up...

Hello All,

The Problem:
I have a Win2003 Server, that locked up. When I came into the office, the
DEFAULT Windows Server screensaver was locked in one position. (This is the
3rd time in the last 2 weeks.)

Solution I am Trying:
I am trying to install the WinDBG software, that digs through MEMORY.DMP
files to help figure out what is wrong.

My Question:
Under SYSTEM PROPERTIES - 'Startup and Recovery', I have the following
settings:
CHECKED - Write an event to the system log (grayed out)
CHECKED - Send an administrative alert
CHECKED - Automatically restart
Write Debugging Information: "kernel memory dump "
Dump File: %SystemRoot%\MEMORY.DMP
CHECKED - Overwrite an existing file

1. I can't find the MEMORY.DMP (not hidden either) in my System Root
directory?
2. Do only certain types of crashes create a 'kernel memory dump'
3. If I have 'Automatically Restart' CHECKED, is the server suppose to
restart, or is this something else?
4. Is there some setting, or something, that can monitor a LOCKED UP
SERVER... and just RESTART the server?

Thanks for Any Help

 

1. If you can't find the file then it was not created.

2. A 'crash' will generate a memory dump. The size depends on what you have set and can range from a mini-dump which will always be small but may be lacking some critical information to a full dump that will be sized basically according to how much install memory the box has and can get huge.
2.a. To get a crash dump of any size, you must have at least a portion of your pagefile located on the system partition. See the attached picture for a brief description of the 3 available options and requirements for each.
2.b. Note that the dump file will be created by the same sort of event that generates a BSOD (blue screen of death) if you have the box set to not automatically restart in the event of a crash. A crash is basically when the OS has a bad thing happens from which it cannot recover. Many lockups are not seen by the OS as a crash but just as being very, very, very busy. The effect may be the same with a totally unresponsive machine but you will not get a dump file created in this case.

3. If you have the autorestart option set, the server is supposed to automatically try to reboot and will keep doing it over and over and over in the event of a new crash.

4. Maybe.
- Yes there are monitoring tools available that can spot a hung server. However, they do this by monitoring specific system parameters and events which you have to specify. CPU use reaching 100% (or 99.9%) is typical as is a thread count that exceeds what you set as a maximum limit.
- The usual action is to have the monitoring tool (usually another PC that watches activity) send an alarm message which can be a text page or email or both. This allows some judgment from a person about what action to take.
- I imagine some of the better tools could be set to boot the server if a certain threshold were reached but I can't say for sure since it is not anything I'd ever want to have happen so I never looked closely.

Have you checked your event logs to see if there are any error or warning messages that happen at about lock-up time or that you think might be related?

Why do you have a server logged on and then left alone so the screen saver is ever activated? The usual is to log on when you have maintenance work to do and then log off when finished.