How to Trigger a Memory Dump from a Windows Virtual Machine Running on XenServer

This article describes how to trigger and capture a memory dump from a Windows Virtual Machine (VM)?? running?? on XenServer.

Troubleshooting unresponsive Windows VMs running on XenServer can be difficult. In some cases, it is necessary to obtain a complete memory dump from the system and analyze it to find the?? root cause of an issue.?? You can?? use special shortcuts to trigger memory dumps by pressing Ctrl key and Scroll Lock?? key twice (Ctrl+ScrLk+ScrLk).
Note: This shortcut works on XenServer and is the preferred method by Microsoft for generating Windows memory dumps.
Refer to the Microsoft KB article, How to generate a kernel or a complete memory dump file in Windows Server 2008 for more information.

In addition, XenServer VMs present the keyboard device to Windows using a virtual PS/2 port. Therefore, the configuration changes required to enable the manual crash dump must be specifically implemented for PS/2 devices, which Windows reads in the registry as?? i8042 port. Refer to the article, Forcing a System Crash from the Keyboard, which includes instructions for configuring Windows to crash manually using a PS/2 type keyboard.
Note: The DumpConfigurator.hta file or tool provides a single location to make all the settings necessary for obtaining a complete memory dump including the keyboard shortcut configuration. You can download the utility from?? Windows Platform Tools.
The console keyboard shortcut bindings in XenCenter might interfere with the ability to send the Ctrl+ScrLk+ScrLk key?? sequence to the VM. To confirm, go to Tools > Options > Console in XenCenter. If “Share clipboard contents with remote console” is selected, and “Release keyboard and mouse” is bound to “Right Ctrl”, than the key sequence to trigger the crash dump does not work.

Incorrect

Change this setting to “Left Alt” and click OK?? as displayed in the following screen shot.

Correct

If the user-triggered crash dump cannot be initiated from Windows, it is possible to trigger Blue Screen Of Death (BSOD) in the Windows VM from the XenServer host. Windows refers the invalid address as Return Instruction Pointer (RIP) 0xf001. If the kernel processes such invalid address, it crashes the operating system, generating a blue screen STOP error. Refer to the procedures in Instructions section?? to configure Windows and to generate a crash dump from the XenServer host.

Generate Memory Dump in Windows from the XenServer Host

To trigger and capture a memory dump from a Windows VM running on XenServer, complete the following procedure:

1. Configure the dump type in a computer with Windows operating system.

2. Log on as a user with administrator privileges from the Windows VM and complete the following procedure:

1. Click Start, right-click Computer, and then?? click Properties.

2. Click Advanced system settings on the System page, and then click the Advanced tab.

3. Click Settings in the Startup and Recovery area, and then ensure that you select Complete memory dump in the Write Debugging information section.

Notes:

• By default, the complete memory dump option is disabled. You can enable the option if your computer has less than 2 GB of physical RAM.

• To enable the complete memory dump option, manually set the CrashDumpEnabled registry entry to 0x1 in the following registry sub-key and restart Windows:
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl
  Caution! Refer to the Disclaimer at the end of this article, before editing the registry.

Trigger the Crash on XenServer

To trigger the crash on XenServer, complete the following procedure:
Note: This procedure is not recommended if the memory dump obtained is not as clean as the one obtained by using the keyboard shortcut.??

1. Open a text console (in XenCenter or by using SSH) to XenServer where the VM is running.

2. ?? Run the following command to obtain the domain ID?? from the VM from which you would like to collect a memory dump.
   
   # xl?? list | grep -i "VM_NAME"?? ?? ?? ?? ??
   
   ?? ?? ?? ?? ?? ?? ??
   ?? or
   ?? list_domains | grep -i VM_UUID
   
   In the above case , the domain ID is 2 for the Virtual Machine - Citrix WLB Virtual Appliance
   
   (To find the UUID of the VM , Click on the VM > Click on General Tab > Right click On UUID > copy the UUID to clipboard > Now you can paste the same while executing the command - list_domains | grep -i UUID )
   

3. Use the domain ID?? obtained from the Step 2?? and?? run the following command
   For XenServer 6.0 , 6.0.2 and 6.1
   # /usr/lib/xen/bin/crash_guest [domain ID]
   
   eg :?? #?? /usr/lib/xen/bin/crash_guest 2
   
   For XenServer 6.2 and 6.5, use:
   # xen-hvmcrash [domain ID]
   
   eg : # xen-hvmcrash 2

4. The Windows VM displays the common blue error screen and starts to dump memory to its file system.

5. After restarting the Windows VM, verify if a memory file dump is created in the configured location.

CTX120540 - How to Generate a Crashdump from an Unresponsive XenServer

CTX101595 - Troubleshooting Stop Errors, Server Hangs, and Server Restarts

Caution! Using Registry Editor incorrectly can cause serious problems that might require you to reinstall your operating system. Citrix cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. Be sure to back up the registry before you edit it.