How to analyze BSOD Kernel Dump

[Dwarner]

Hi,
I have several months of blues that appear on screen all the time. This happened less frequently in recent times, but again the problem seriously (2 to 3 per week). I used WinDbg to analyze the dumps but the application in question is different on each dump, and I must confess that I do not understand much. Does anyone have an idea for the BSOD kernel dump analysis. Thanks in advance.

[Devasis]

The BSOD in my case is usually caused to prevent any damage to my computer by performing a sudden shutdown. The game can be caused by hardware or newly installed hardware. You will have to read the screen message for that. In my BSOD I had found that a file called ntkrnlpa.exe is the main issue. On searching internet I found that this issue is due to newly installed hardware in my computer. That was my graphic card.

[Solomon]

It is right. Mainly BSOD is caused by new hardware failure or RAM issue. You must first disconnect any newly added hardware like RAM, Printer, GPU, etc to checkout the matter. The error information in given on the screen which will help you to analyze the issue. Check out that properly. You might need a windows update to troubleshoot the issue. Just restart your pc once.

[MrChris-]

When a machine does the BSOD, I always start by doing a memtest, then I looked further. If you do not know memtest, you will find free on the net, there are ways to make a bootable CD. You can also download Ultimate Boot CD (which is this memtest), so you'll have a range of soft to make troubleshooting your machine. This will give you more help on Dump kernel analysis.

[Zecho]

To setup the the parameters for creating the dump it is necessary to activate some settings. For this property the workstation and then tab advanced button and setting the Startup and Recovery. You can select 3 types of dump, memory dump (64KB), image and kernel memory dump complete. Unless one wishes to analyze in great depth, the partial image and the kernel enough at first approach. Once set, it only remains to wait for the blue screen.

[Reegan]

Microsoft provided tools necessary to analyze the dump called Windbg (with a nice GUI) and kd (command line).This tool is freely downloadable from the Microsoft website. I recommend that you check regularly available version of WinDbg, it is updated regularly. Windbg Once installed, it is necessary to set the path to the symbols which allow such to see what functions were called in the stack to see structures, etc. with their small original name. Most of the functions and structures of the kernel starting with nt. The symbols are available online, or download package or on the product CD or by download on the fly. It is this last option that I recommend. To do this, go to the File menu and then Symbol File Path ... then type srv * c: \ symbols * msdl.microsoft.com/download/symbols, all without space.This will allow you to automatically load the symbols you need and store them locally in the directory c: \ symbols. Attention loads can be long, symbols files are usually quite large, the minimum size of binary file. The advantage of this solution is that you do not have to worry about choosing the right symbols is Windbg who does it for you.