Win2008 R2 WER ( error reporting ) LocalDumps blocked by what?
crash-dumps, windbg, windows-error-reporting, windows-server-2008, windows-server-2008-r2
Solution
- Create key: HKLM\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps
- Create REG_DWORD value: HKLM\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps as 2 (=full dump).
- Create REG_EXPAND_SZ value: HKLM\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps as C:\Dumps or where you like. Ensure that this folder actually exists.
Problem
I Just want to recover crash dumps of my own 32bit applications. I tried the following: I followed the steps at MSDN "Collecting User-Mode Dumps": http://msdn.microsoft.com/en-us/library/windows/desktop/bb787181%28v=vs.85%29.aspx Somewhere on the internet I saw a mention about WER registry keys for 32 bit apps do NOT have to be added under `HKLM\Software\WOW6432Node\Microsoft\Windows\Windows Error Reporting\LocalDumps\` Also that the `..\Windows NT\AeDebug\Auto (REG_SZ)` value must be "0" Additionally, I have WER error entries in the 'system event viewer' under `"Windows Logs\Applications&Services\Microsoft\Windows\WER-Diagnostics\Operational"` Showing messages "Possible heap corruption detected (code 3221225477)" I don't know if this message relates to my test-app creating a NPE, or if this is WER itself having a problem? I just can't get it to work :( Can anyone give me some clues ? Update : For another fresh 2008R2 x64 machine, i just did the ``` HKLM\Software\... Reporting\LocalDumps\DumpFolder = "c:\crashdumps" HKLM\Software\... Reporting\LocalDumps\DumpType = 2 (REG_DWORD) HKLM\Software\... Reporting\LocalDumps\DumpCount = 20 decimal (REG_DWORD) ``` And running the nulpointer-terster worked as expected. So im thinking there must be a settings in these other machines which prohibit LocalDumps from being used, although the LocalDumps registry-keys are there..