How to Create Live Kernel Memory Dump File Using Task Manager

Windows 11 has added real-time kernel memory dump function to help administrators easily troubleshoot system errors and crashes! This article will use MiniTool tutorial to demonstrate how to create a real-time kernel memory dump file using Task Manager.

This feature is suitable for Windows 11 (Moment 3 update and later), and can create dump files during the operating system without offline systems, making it convenient to capture memory information in abnormal situations. The dump file contains kernel memory snapshots (optionally including user-mode memory and hypervisor memory), small dump files (including auxiliary data), and other information for analyzing system status, non-fatal errors, driver issues, and Blue Screen of Death (BSOD).

Default save path:

C:\Users\Username\AppData\Local\Microsoft\Windows\TaskManager\LiveKernelDumps

Create a real-time kernel memory dump file using Task Manager

The steps are as follows:

1. Enter "Task Manager" in the search box and open it.

2. Switch to the "Details" tab, enter "system" in the search bar and press Enter to find the system process.

3. Right-click on the "System" process and select "Create a real-time kernel memory dump file". You can choose "Full Live Kernel Memory Dump" or "Kernel Stack Memory Dump".

   • Full Live Kernel Memory Dump: Create a dump file that contains active kernel memory as well as user-mode memory and hypervisor memory (optional).
   • Kernel Stack Memory Dump: Creates a smaller file that contains the kernel processor state and all kernel thread stacks.

4. The system will prompt that the file is created successfully and the file location will be displayed. Click OK to close the window, or click Open File Location to view the file path in File Explorer.

See also: How to fix live kernel event 193 error on Windows 10?

Modify memory dump settings

Windows 11 allows you to customize the creation of real-time kernel memory dump files. Click the "Settings" button in Task Manager to enter the "Real-Time Kernel Memory Dump Options (Advanced)" section, and you can:

• Abort when memory is insufficient: Check this option to stop the dumping process when memory is insufficient.
• Capture Hypervisor page: Check this option to capture the memory area used by Hyper-V and the virtual machine. Select the Include Non-essential Pages option to capture non-essential hypervisor memory pages.
• Capture User Page: If the problem you diagnose requires user mode memory, please check this option.

Conclusion

This article details how to create a real-time kernel memory dump file using Task Manager. Hope it helps you!

The above is the detailed content of How to Create Live Kernel Memory Dump File Using Task Manager. For more information, please follow other related articles on the PHP Chinese website!