Memory Dump configuration check

How to check if Server is configured to capture memory dump . Answer is in the code. From my personal experience whenever Servers faced Bluescreen, we check if the Memory dump file is created if not then we check few things if they are configured properly. Script below simply does it.

______________________________________________________________________

Write-Host ""

# ----------------->Get free space on C Drive where generally memory dump file is configured
$Cdrive=get-wmiobject -class win32_logicaldisk where {$_.deviceid -eq "c:"}
$CSpace=($Cdrive.FreeSpace/1MB)

#------------------->Converted it in KB's Since all other values are in KB's
Write-Host Free Space on C:\ $CSpace MB

#------------------>Lets get memory details of the computer
$TotalMemory=get-wmiobject win32_logicalmemoryconfiguration
$MEM=($totalmemory.TotalPhysicalMemory/1KB)
$PAGE=($totalmemory.Totalpagefilespace/1KB)
Write-host Physical RAM :- $MEM MB
Write-host Pagefile Size :- $Page MB

#------------------>Page file size should be atleast 12MB more than Physical RAM
$Recsize=($MEM+12)

if ($PAGE -ge $Recsize) {

#------------------>There should be enough free space on to capture memory dump.

if ($CSpace -ge $Recsize ) {
write-host "Machine should be able to generate kernel dump"
}
else {
write-host "Check disk Space on C: drive if memory dump file is configured on it"
}

#------------------>Crash control values are enumerated here
$CrashControl="hklm:\SYSTEM\CurrentControlSet\Control\CrashControl"
$CrashProp=$CrashControl Get-itemproperty
$CrashNo=$CrashProp.CrashDumpEnabled

#---------------->Switch used over here.

Switch($CrashNo) {

0 { "Memory is NOT configured" }
1 {"Complete memory dump is configured" }
2 {"Kernel memory dump is configured"}
3 {"Small memory dump (64KB)"}

}

Write-host Dump file location $CrashProp.DumpFile

$AutoNo=$CrashProp.AutoReboot
If ($AutoNo -eq "0") {write-host Auto Reboot is not enabled} else {write-host AutoReboot is enabled}

$CrashNo=$CrashProp.Overwrite
If ($CrashNo -eq "0") { write-host Overwrite Memory dump option is not enabled} else { write-host Overwrite Memory dump is enabled}

}

else {Write-Host "Page file size should be atleast 12MB more than RAM"}

Write-Host ""

______________________________________________________________________

OutPut:

Free Space on C:\ 4029056 KB
Physical RAM :- 1039744 KB
Pagefile Size :- 2500248 KB
Machine should be able to generate kernel dump
Kernel memory dump is configured
Dump file location C:\WINDOWS\MEMORY.DMP
Auto Reboot is not enabled
Overwrite Memory dump is enabled

----------------------------------------------------------

# References:
#http://support.microsoft.com/kb/244139
#http://support.microsoft.com/kb/254649

#CrashDumpEnabled REG_DWORD 0x0 = None
#CrashDumpEnabled REG_DWORD 0x1 = Complete memory dump
#CrashDumpEnabled REG_DWORD 0x2 = Kernel memory dump
#CrashDumpEnabled REG_DWORD 0x3 = Small memory dump (64KB)

Technorati tags: Powershell

IceRocket tags: Powershell