Comments on: Crash Dump Analysis Patterns (Part 13c) https://www.dumpanalysis.org/blog/index.php/2007/11/02/crash-dump-analysis-patterns-part-13c/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Sat, 16 May 2026 13:25:49 +0000 http://wordpress.org/?v=2.3.3 By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2007/11/02/crash-dump-analysis-patterns-part-13c/#comment-621113 Dmitry Vostokov Fri, 30 Nov 2012 14:18:02 +0000 https://www.dumpanalysis.org/blog/index.php/2007/11/02/crash-dump-analysis-patterns-part-13c/#comment-621113 !poolused 5 produces the same level of detail for paged pool as !poolused 3 for nonpaged pool !poolused 5 produces the same level of detail for paged pool as !poolused 3 for nonpaged pool

]]> By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2007/11/02/crash-dump-analysis-patterns-part-13c/#comment-373244 Dmitry Vostokov Wed, 16 Nov 2011 17:18:50 +0000 https://www.dumpanalysis.org/blog/index.php/2007/11/02/crash-dump-analysis-patterns-part-13c/#comment-373244 False positive excessive nonpaged pool memory usage messages: http://support.microsoft.com/kb/2509968 False positive excessive nonpaged pool memory usage messages: http://support.microsoft.com/kb/2509968

]]> By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2007/11/02/crash-dump-analysis-patterns-part-13c/#comment-287241 Dmitry Vostokov Mon, 30 May 2011 11:19:40 +0000 https://www.dumpanalysis.org/blog/index.php/2007/11/02/crash-dump-analysis-patterns-part-13c/#comment-287241 To see session pool usage you need to switch to a session process first: <p align="left"><code>1: kd> !sprocess 3 [...] PROCESS 88b0dd88 SessionId: 3 Cid: 1b90 Peb: 7ffde000 ParentCid: 1b84 DirBase: 4072d000 ObjectTable: d8651450 HandleCount: 414. Image: ApplicationA.exe [...]</code> <p align="left"><code>1: kd> .process /r /p 88b0dd88 Implicit process is now 88b0dd88 Loading User Symbols</code> <p align="left"><code>1: kd> !poolused 8 Sorting by Session Tag [...]</code> To see session pool usage you need to switch to a session process first:

1: kd> !sprocess 3
[...]
PROCESS 88b0dd88 SessionId: 3 Cid: 1b90 Peb: 7ffde000 ParentCid: 1b84
DirBase: 4072d000 ObjectTable: d8651450 HandleCount: 414.
Image: ApplicationA.exe
[...]

1: kd> .process /r /p 88b0dd88
Implicit process is now 88b0dd88
Loading User Symbols

1: kd> !poolused 8
Sorting by Session Tag
[...]

]]> By: Crash Dump Analysis » Blog Archive » Insufficient kernel pool memory, spiking thread and data contents locality: pattern cooperation https://www.dumpanalysis.org/blog/index.php/2007/11/02/crash-dump-analysis-patterns-part-13c/#comment-184991 Crash Dump Analysis » Blog Archive » Insufficient kernel pool memory, spiking thread and data contents locality: pattern cooperation Sat, 18 Sep 2010 23:30:04 +0000 https://www.dumpanalysis.org/blog/index.php/2007/11/02/crash-dump-analysis-patterns-part-13c/#comment-184991 [...] Debugging Experts Magazine Online A complete memory dump was generated from a totally unresponsive frozen system. Looking at its virtual memory stats we see the shortage of nonpaged pool (insufficient kernel pool memory pattern): [...] […] Debugging Experts Magazine Online A complete memory dump was generated from a totally unresponsive frozen system. Looking at its virtual memory stats we see the shortage of nonpaged pool (insufficient kernel pool memory pattern): […]

]]> By: Crash Dump Analysis » Blog Archive » Reflecting on 2008 (Part 1) https://www.dumpanalysis.org/blog/index.php/2007/11/02/crash-dump-analysis-patterns-part-13c/#comment-159020 Crash Dump Analysis » Blog Archive » Reflecting on 2008 (Part 1) Thu, 17 Jun 2010 14:11:34 +0000 https://www.dumpanalysis.org/blog/index.php/2007/11/02/crash-dump-analysis-patterns-part-13c/#comment-159020 [...] system_thread_exception_not_handled system_thread_exception_not_handled (7e) windbg command pool allocations have failed receivelotsacalls trap frame vista dr watson bios disassembly ninjutsu uncovered citrix tools at [...] […] system_thread_exception_not_handled system_thread_exception_not_handled (7e) windbg command pool allocations have failed receivelotsacalls trap frame vista dr watson bios disassembly ninjutsu uncovered citrix tools at […]

]]> By: Crash Dump Analysis » Blog Archive » Icons for Memory Dump Analysis Patterns (Part 24) https://www.dumpanalysis.org/blog/index.php/2007/11/02/crash-dump-analysis-patterns-part-13c/#comment-144306 Crash Dump Analysis » Blog Archive » Icons for Memory Dump Analysis Patterns (Part 24) Wed, 14 Apr 2010 13:39:26 +0000 https://www.dumpanalysis.org/blog/index.php/2007/11/02/crash-dump-analysis-patterns-part-13c/#comment-144306 [...] Today we introduce an icon for Insufficient Memory (kernel pool) pattern: [...] […] Today we introduce an icon for Insufficient Memory (kernel pool) pattern: […]

]]> By: Crash Dump Analysis » Blog Archive » Invalid pointer, incorrect stack trace, multiple exceptions, insufficient memory and memory leak: pattern cooperation https://www.dumpanalysis.org/blog/index.php/2007/11/02/crash-dump-analysis-patterns-part-13c/#comment-78611 Crash Dump Analysis » Blog Archive » Invalid pointer, incorrect stack trace, multiple exceptions, insufficient memory and memory leak: pattern cooperation Wed, 10 Jun 2009 13:59:42 +0000 https://www.dumpanalysis.org/blog/index.php/2007/11/02/crash-dump-analysis-patterns-part-13c/#comment-78611 [...] suspect that users cannot connect because of the lack of kernel pool resources and see the shortage of paged pool along with session pool shortage for one [...] […] suspect that users cannot connect because of the lack of kernel pool resources and see the shortage of paged pool along with session pool shortage for one […]

]]> By: Crash Dump Analysis » Blog Archive » Insufficient memory, handle leak, process factory, high contention and busy system: pattern cooperation https://www.dumpanalysis.org/blog/index.php/2007/11/02/crash-dump-analysis-patterns-part-13c/#comment-65266 Crash Dump Analysis » Blog Archive » Insufficient memory, handle leak, process factory, high contention and busy system: pattern cooperation Mon, 16 Feb 2009 12:20:44 +0000 https://www.dumpanalysis.org/blog/index.php/2007/11/02/crash-dump-analysis-patterns-part-13c/#comment-65266 [...] dump was generated for analysis. Usual !vm 4 command shows pool allocation errors and particularly insufficient session pool memory for user session [...] […] dump was generated for analysis. Usual !vm 4 command shows pool allocation errors and particularly insufficient session pool memory for user session […]

]]> By: Crash Dump Analysis » Blog Archive » Insufficient memory, handle leak, wait chain, deadlock, inconsistent dump and overaged system: pattern cooperation https://www.dumpanalysis.org/blog/index.php/2007/11/02/crash-dump-analysis-patterns-part-13c/#comment-60341 Crash Dump Analysis » Blog Archive » Insufficient memory, handle leak, wait chain, deadlock, inconsistent dump and overaged system: pattern cooperation Wed, 24 Dec 2008 16:00:15 +0000 https://www.dumpanalysis.org/blog/index.php/2007/11/02/crash-dump-analysis-patterns-part-13c/#comment-60341 [...] 2009 (0x7D9) - The Year of DebuggingIn one complete memory dump taken from the system refusing user connections but not hung completely we can see the signs of past pool allocation failures (see Insufficient Memory): [...] […] 2009 (0×7D9) - The Year of DebuggingIn one complete memory dump taken from the system refusing user connections but not hung completely we can see the signs of past pool allocation failures (see Insufficient Memory): […]

]]> By: !analyze -v : Crash Dump Analysis Patterns (Part 13c) https://www.dumpanalysis.org/blog/index.php/2007/11/02/crash-dump-analysis-patterns-part-13c/#comment-43201 !analyze -v : Crash Dump Analysis Patterns (Part 13c) Thu, 18 Sep 2008 08:37:29 +0000 https://www.dumpanalysis.org/blog/index.php/2007/11/02/crash-dump-analysis-patterns-part-13c/#comment-43201 [...] Crash Dump Analysis Patterns (Part 13c) [...] […] Crash Dump Analysis Patterns (Part 13c) […]

]]>