Show
This article describes how to troubleshoot freeze issues on Windows-based computers and servers. It also provides methods for collecting data that will help administrators or software developers diagnose, identify, and fix these issues.
Note The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products. Identify the problem
Troubleshoot the freeze issuesTo troubleshoot the freeze issues, check the current status of your computer, and follow one of the following methods. For the computer that's still running in a frozen stateIf the physical computer or the virtual machine is still freezing, use one or more of the following methods for troubleshooting:
For the computer that's no longer frozenIf the physical computer or virtual machine froze, but is now running in a good state, use one or more of the following methods for troubleshooting. For a physical computer
For a virtual machine
Collect data for the freeze issuesTo collect data for a server freeze, check the following table, and use one or more of the suggested methods.
Method 1: Memory dump
Important Follow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, back up the registry for restoration in case problems occur. A complete memory dump file records all the contents of system memory when the computer stops unexpectedly. A complete memory dump file may contain data from processes that were running when the memory dump file was collected. If the computer is no longer frozen and now is running in a good state, use the following steps to enable memory dump so that you can collect memory dump when the freeze issue occurs again. If the virtual machine is still running in a frozen state, use the following steps to enable and collect memory dump.
Note If you have a restart feature that's enabled on the computer, such as the Automatic System Restart (ASR) feature in Compaq computers, disable it. This setting is usually found in the BIOS. With this feature enabled, if the BIOS doesn't detect a heartbeat from the operating system, it will restart the computer. The restart can interrupt the dump process.
Method 2: Data sanity checkUse the Dump Check Utility (Dumpchk.exe) to read a memory dump file. It can also verify that the file was created correctly and isn't corrupted or invalid.
Learn how to use Dumpchk.exe to check your dump files: You can use Windows Performance Monitor to examine how programs that you run affect your computer's performance, both in real time and by collecting log data for later analysis. To create performance counter and event trace log collections on local and remote systems, run the following commands in a command prompt as administrator: Logman create counter LOGNAME_Long -u DOMAIN\USERNAME * -f bincirc -v mmddhhmm -max 500 -c "\\COMPUTERNAME\LogicalDisk(*)\*" "\\COMPUTERNAME\Memory\*" "\\COMPUTERNAME\Network Interface(*)\*" "\\COMPUTERNAME\Paging File(*)\*" "\\COMPUTERNAME\PhysicalDisk(*)\*" "\\COMPUTERNAME\Process(*)\*" "\\COMPUTERNAME\Redirector\*" "\\COMPUTERNAME\Server\*" "\\COMPUTERNAME\System\*" "\\COMPUTERNAME\Terminal Services\*" "\\COMPUTERNAME\Processor(*)\*" "\\COMPUTERNAME\Cache\*" -si 00:05:00 Logman create counter LOGNAME_Short -u DOMAIN\USERNAME * -f bincirc -v mmddhhmm -max 500 -c "\\COMPUTERNAME\LogicalDisk(*)\*" "\\COMPUTERNAME\Memory\*" "\\COMPUTERNAME\Network Interface(*)\*" "\\COMPUTERNAME\Paging File(*)\*" "\\COMPUTERNAME\PhysicalDisk(*)\*" "\\COMPUTERNAME\Process(*)\*" "\\COMPUTERNAME\Redirector\*" "\\COMPUTERNAME\Server\*" "\\COMPUTERNAME\System\*" "\\COMPUTERNAME\Terminal Services\*" "\\COMPUTERNAME\Processor(*)\*" "\\COMPUTERNAME\Cache\*" -si 00:00:10Then, you can start or stop the log by running the following commands: logman start LOGNAME_Long / LOGNAME_Short logman stop LOGNAME_Long / LOGNAME_ShortThe Performance Monitor log is located in the path: C:\PERFLOGS Other methods to collect dataUse memory dump to collect data for the physical computer that's running in a frozen state
Warning Follow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, back up the registry for restoration in case problems occur. If the physical computer is still running in a frozen state, follow these steps to enable and collect memory dump:
Use Pool Monitor to collect data for the physical computer that is no longer frozenPool Monitor shows you the number of allocations and outstanding bytes of allocation by type of pool and the tag that is passed into calls of ExAllocatePoolWithTag. For more information, see Using PoolMon to Find a Kernel-Mode Memory Leak and PoolMon Examples. Use memory dump to collect data for the virtual machine that's running in a frozen stateUse the one of the following methods for the application on which the virtual machine is running. Microsoft Hyper-VYou can also use the built-in NMI feature through a Debug-VM cmdlet to debug and get a memory dump. To debug the virtual machines on Hyper-V, run the following cmdlet in Windows PowerShell: Debug-VM -Name "VM Name" -InjectNonMaskableInterrupt -ComputerName HostnameVMwareYou can use VMware snapshots or suspend state and extract a memory dump file equivalent to a complete memory dump file. Use VMware's Checkpoint To Core Tool (vmss2core) to convert both suspend (.vmss) and snapshot (.vmsn) state files to a dump file. Then analyze the file by using the standard Windows debugging tools. Citrix XenServerThe memory dump process occurs by pressing the RIGHT CTRL + SCROLL LOCK + SCROLL LOCK keyboard combination. For more information, see Method 1 of How to Trigger a Memory Dump from a Windows Virtual Machine Running on XenServer from Citrix. Space limitations on the system drive in Windows ServerOn a Windows Server, you may not have enough free disk space to generate a complete memory dump file on the system volume. There's a second option if the system drive doesn't have sufficient space. You can use the DedicatedDumpFile registry entry. For more information, see Configure the destination path for a memory dump. For more information, see How to use the DedicatedDumpFile registry value to overcome space limitations on the system drive. |