[Autogenerated] The most important configuration aspect of a blue screen,
is which type of damp I would like to get.
So here.
Are the six possible options.
That are provided, in the dialogue.
We've seen the previous demo,
the first one is None just saying I don't want any dump.
File in the that is It very simple but obviously not very useful.
Then We have the option of a small memory dump which is
roughly 256 kg bytes in size this dump,
is well as as we can see it's small in the sense,
that it, only provides information about the system.
It provides information about the call stack of the thread.
That calls the blue screen and That's about it.
So the main advantage of this dump type, is that It's very small.
It's very easy.
To move around, you can attach that to an email and be done with it.
However, in complex or non trivial blue screen cases,
it doesn't provide enough information for us.
To figure out what is going on.
So it's best to avoid that option as well.
Next one, we have the kernel memory dump,
kernel memory dump, is a Pretty good one.
It says please take all the physical memory used by the kernel any components,
that are in kernel space, the kernel itself,
and all kernel drivers, and just dump,
that to the resulting file this is generally,
a good option.
Its in fact, it was the default option.
Windows seven and earlier versions of Windows Because if
there is some kind of blue screen,
then it's definitely the fault of some component within kernel space
rather than being the fault of a user mode component because user mode
component cannot cause a blue screen directly.
If it could that would be a serious bug in Windows
which Microsoft would quickly fix.
So kernel is a good option.
However, it is not the default for reasons.
I'll explain in a moment.
The next one which is the default one we have is called automatic
automatic is available in Windows eight and later,
and what automatic means in terms of the actual data,
is the same as kernel We're talking about the kernel memory used by the system.
That is currently in physical memory because that memory has something.
To do with the blue screen.
However,
here's what happens when you actually ask for a
down file When the system crashes,
the kernel doesn't really write the dump information into
their final file and The reason is that this is kind of
risky because we have a blue screen, maybe the iOS system,
is not in a pristine condition, and its not perhaps in a very good state.
So it might be too risky.
To create a new file, and write information into that file Instead,
the kernel would like to write,
to the more most secure or the most probable file that would work.
And that file is the page file So the dump is actually written to the
page file and only When you restart the system,
the kernel notices, that there's dump information,
in the page file and only then copies, that to the final,
file and This works because once you restart the system,
the system, is in a good condition.
So the iOS system, is working normally the problem.
Is that If your page file is too small.
Then you get nothing.
The dump goes away with kernel memory dump.
You have to resize the page file up front manually.
To make sure.
That it's going to be big enough or at least you.
Hope it will be big enough.
To accommodate, a typical kernel dump with automatic this is done for you.
So with automatic the kernel when you restart a system
will set the default page file size, to a size,
that would guarantee almost 100% that You will get a good
kernel dump if that in fact needed when,
when the system crashes.
So that's why automatic is better because it knows upfront.
To resize the page file to be big enough to get a
dump with a very high probability,
and that only works by the way if the page five configuration,
says system manage size which it does by default.
The next option, which was always available.
Is called complete memory dump.
And The purpose of this memory dump type,
is to dump, the entire physical memory as the dump information,
and The problem with that option, is that the page file has to be really big.
If you have 64 gigabytes of ram,
that entire ram will be written to the page file If it's not big enough,
nothing will be written.
And you get nothing the idea here.
Is that You think that maybe using word memory might give
you a hint as to Why things went wrong?
And You want to have user word memory as well.
And not just kernel memory complete.
However, is fairly ______.
In the that regard, that It writes the entire set of physical memory.
That you have including pages which are not really used.
So it's not a Very good option.
It perhaps was a fairly straight forward.
And perhaps good enough.
In the past when ms sizes were small.
But in today's systems,
this is not really a good option if you do want to get user more memory there,
is Another option you can use called active which
started to be available in Windows 10,
an active is a smart way of doing a complete memory
dump in two regards the first one it,
only copies pages which are actually used in physical memory,
not the entire physical memory.
And Secondly, if the system is hosting guest virtual machines.
So we have a host machine.
That hosts virtual machines.
And the host crashes.
The memory used by the virtual machines probably has nothing.
To do with the _____.
So this will not be written.
To the DOM file and So the idea here, is to try,
to provide all the user and kernel memory,
but still be able to fit into a typical page file size,
that still must be manually configured.
To be big enough to accommodate such a dump,
so automatic, is the best option,
to use unless you really think you need user mode memory,
and if that is the case, then active is your Next best thing.