Memory dump not created

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

running Windows 2000 Server SP4 +SRP
Once of my servers recently performed an unexpected reboot, however despite
the startup/recovery of the system being configured to produce a Kernel
Memory Dump it failed to do so. (Have validated settings and disk space).
Prior to the unexepected rebooted warning were in the system event log for
two of my applications; EventID 1001 System Memory is running very low and
Event ID 7000 Insufficient system resource exists to complete the requested
service.
I am taking the presumption that due to lack of available resource the
system crashed.
This leads me back to the question: if the system failed to lack of
resources (probably memory), would the system be able to produce a memory
dump?
I am trying to determine why no dump was available.
Thanks in anticipation.
 
When you view the logged events in Event Viewer (double-click them in the
right-hand pane) in the upper right corner, third button down is a copy to
clipboard, then you can paste in the body of a reply message.

Please do so for each of the different System Log events (that are a Type:
'Error' or 'Warning') so we can see all of the event detail.


--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| running Windows 2000 Server SP4 +SRP
| Once of my servers recently performed an unexpected reboot, however
despite
| the startup/recovery of the system being configured to produce a Kernel
| Memory Dump it failed to do so. (Have validated settings and disk space).
| Prior to the unexepected rebooted warning were in the system event log for
| two of my applications; EventID 1001 System Memory is running very low and
| Event ID 7000 Insufficient system resource exists to complete the
requested
| service.
| I am taking the presumption that due to lack of available resource the
| system crashed.
| This leads me back to the question: if the system failed to lack of
| resources (probably memory), would the system be able to produce a memory
| dump?
| I am trying to determine why no dump was available.
| Thanks in anticipation.
 
System Event Log Entries are as follows:

Event Type: Warning
Event Source: SAVRT
Event Category: None
Event ID: 1001
Date: 5/23/2006
Time: 9:44:06 AM
User: N/A
Computer:
Description:
System memory is running very low. Symantec AntiVirus Auto-Protect may not
be able to function properly.
Data:
0000: 00 00 00 00 01 00 54 00 ......T.
0008: 00 00 00 00 e9 03 07 80 ....é..€
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 5/23/2006
Time: 9:49:23 AM
User: N/A
Computer:
Description:
The CSTacacs service failed to start due to the following error:
Insufficient system resources exist to complete the requested service.

Event Type: Error
Event Source: EventLog
Event Category: None
Event ID: 6008
Date: 5/23/2006
Time: 12:35:31 PM
User: N/A
Computer:
Description:
The previous system shutdown at 10:09:25 on 23/05/2006 was unexpected.
Data:
0000: d6 07 05 00 02 00 17 00 Ö.......
0008: 0a 00 09 00 19 00 6a 03 ......j.
0010: d6 07 05 00 02 00 17 00 Ö.......
0018: 08 00 09 00 19 00 6a 03 ......j.

There are no warning or error events in the Application log.
The only other item this of interest is the timings - as you can see by the
events above, there was a large delay between events from the warning & error
to when the server automatically came back up. This co-incides with the
security log - there were no security events from 09:49:38AM until the system
came back up (next security event is 12:35:31 PM. (this is unusual as due to
the audit policy and the SW stack, there should be a continual flow of
security events). This is a managed system by Tivoli, had the system gone
down in this period between events we would have been alerted.

Many Thanks




Dave Patrick said:
When you view the logged events in Event Viewer (double-click them in the
right-hand pane) in the upper right corner, third button down is a copy to
clipboard, then you can paste in the body of a reply message.

Please do so for each of the different System Log events (that are a Type:
'Error' or 'Warning') so we can see all of the event detail.


--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| running Windows 2000 Server SP4 +SRP
| Once of my servers recently performed an unexpected reboot, however
despite
| the startup/recovery of the system being configured to produce a Kernel
| Memory Dump it failed to do so. (Have validated settings and disk space).
| Prior to the unexepected rebooted warning were in the system event log for
| two of my applications; EventID 1001 System Memory is running very low and
| Event ID 7000 Insufficient system resource exists to complete the
requested
| service.
| I am taking the presumption that due to lack of available resource the
| system crashed.
| This leads me back to the question: if the system failed to lack of
| resources (probably memory), would the system be able to produce a memory
| dump?
| I am trying to determine why no dump was available.
| Thanks in anticipation.
Click to expand...
 
Since no BSOD's occurred (Event ID: 1001 Source: Save Dump), then it may be
a power problem. I would look at a possible faulty (or undersized) pc power
supply, UPS, bad battery, or the circuit feeding the outlet that the pc is
plugged into.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| System Event Log Entries are as follows:
|
| Event Type: Warning
| Event Source: SAVRT
| Event Category: None
| Event ID: 1001
| Date: 5/23/2006
| Time: 9:44:06 AM
| User: N/A
| Computer:
| Description:
| System memory is running very low. Symantec AntiVirus Auto-Protect may not
| be able to function properly.
| Data:
| 0000: 00 00 00 00 01 00 54 00 ......T.
| 0008: 00 00 00 00 e9 03 07 80 ....é..€
| 0010: 00 00 00 00 00 00 00 00 ........
| 0018: 00 00 00 00 00 00 00 00 ........
| 0020: 00 00 00 00 00 00 00 00 ........
|
| Event Type: Error
| Event Source: Service Control Manager
| Event Category: None
| Event ID: 7000
| Date: 5/23/2006
| Time: 9:49:23 AM
| User: N/A
| Computer:
| Description:
| The CSTacacs service failed to start due to the following error:
| Insufficient system resources exist to complete the requested service.
|
| Event Type: Error
| Event Source: EventLog
| Event Category: None
| Event ID: 6008
| Date: 5/23/2006
| Time: 12:35:31 PM
| User: N/A
| Computer:
| Description:
| The previous system shutdown at 10:09:25 on 23/05/2006 was unexpected.
| Data:
| 0000: d6 07 05 00 02 00 17 00 Ö.......
| 0008: 0a 00 09 00 19 00 6a 03 ......j.
| 0010: d6 07 05 00 02 00 17 00 Ö.......
| 0018: 08 00 09 00 19 00 6a 03 ......j.
|
| There are no warning or error events in the Application log.
| The only other item this of interest is the timings - as you can see by
the
| events above, there was a large delay between events from the warning &
error
| to when the server automatically came back up. This co-incides with the
| security log - there were no security events from 09:49:38AM until the
system
| came back up (next security event is 12:35:31 PM. (this is unusual as due
to
| the audit policy and the SW stack, there should be a continual flow of
| security events). This is a managed system by Tivoli, had the system gone
| down in this period between events we would have been alerted.
|
| Many Thanks
 
Can't see thing being a problem with the power supply. The server is an IBM
Xseries, using IBM Director which would report any failings with the power
supply. The machine has redundant power supplies, has dual feeds, is located
in a datacentre, of which the datacentre has its own UPS.



Dave Patrick said:
Since no BSOD's occurred (Event ID: 1001 Source: Save Dump), then it may be
a power problem. I would look at a possible faulty (or undersized) pc power
supply, UPS, bad battery, or the circuit feeding the outlet that the pc is
plugged into.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| System Event Log Entries are as follows:
|
| Event Type: Warning
| Event Source: SAVRT
| Event Category: None
| Event ID: 1001
| Date: 5/23/2006
| Time: 9:44:06 AM
| User: N/A
| Computer:
| Description:
| System memory is running very low. Symantec AntiVirus Auto-Protect may not
| be able to function properly.
| Data:
| 0000: 00 00 00 00 01 00 54 00 ......T.
| 0008: 00 00 00 00 e9 03 07 80 ....é..€
| 0010: 00 00 00 00 00 00 00 00 ........
| 0018: 00 00 00 00 00 00 00 00 ........
| 0020: 00 00 00 00 00 00 00 00 ........
|
| Event Type: Error
| Event Source: Service Control Manager
| Event Category: None
| Event ID: 7000
| Date: 5/23/2006
| Time: 9:49:23 AM
| User: N/A
| Computer:
| Description:
| The CSTacacs service failed to start due to the following error:
| Insufficient system resources exist to complete the requested service.
|
| Event Type: Error
| Event Source: EventLog
| Event Category: None
| Event ID: 6008
| Date: 5/23/2006
| Time: 12:35:31 PM
| User: N/A
| Computer:
| Description:
| The previous system shutdown at 10:09:25 on 23/05/2006 was unexpected.
| Data:
| 0000: d6 07 05 00 02 00 17 00 Ö.......
| 0008: 0a 00 09 00 19 00 6a 03 ......j.
| 0010: d6 07 05 00 02 00 17 00 Ö.......
| 0018: 08 00 09 00 19 00 6a 03 ......j.
|
| There are no warning or error events in the Application log.
| The only other item this of interest is the timings - as you can see by
the
| events above, there was a large delay between events from the warning &
error
| to when the server automatically came back up. This co-incides with the
| security log - there were no security events from 09:49:38AM until the
system
| came back up (next security event is 12:35:31 PM. (this is unusual as due
to
| the audit policy and the SW stack, there should be a continual flow of
| security events). This is a managed system by Tivoli, had the system gone
| down in this period between events we would have been alerted.
|
| Many Thanks
Click to expand...
 
Back
Top