Menu
I just recently started looking at dump files to help me analyze crashes of the w3wp process on our production environment at work...
And I would like to know, what are the differences between a minidump and a fulldump file ?
758
The difference between these dump files is one of size. Minidumps are usually more compact, and can be easily sent to an analyst. Note Much information can be obtained by analyzing a dump file. However, no dump file can provide as much information as actually debugging the crash directly with a debugger.
Minidumps are files containing the most important memory regions of a crashed process. When the process crashes, the minidump is written to the user's disk and can later be uploaded to Sentry. A minidump typically includes: The runtime stack of each thread that was active during the time of the crash.
The minidump files are created whenever your system has a blue screen of death or any other application crashes in the background. In case you do not want to troubleshoot that ,you can delete them as its safe but you should not delete everything in disk cleanup.
A Windows minidump is a small file that is generated every time the Windows operating system unexpectedly encounters an error, such as during "blue screen of death" (BSoD) crashes.
Differences between full memory dump files and mini memory dump files
A memory dump file can collect a variety of information. Typically, a support engineer must have all the contents of virtual memory to troubleshoot a problem. In other cases, you might want to capture less information to focus on a specific problem. The debugger is flexible. This flexibility lets you limit the information that a memory dump file captures by collecting either full memory dump files or mini memory dump files:
- Full memory dump files. These files contain the contents of virtual memory for a process. These files are the most useful when you are troubleshooting unknown issues. A support engineer can use these files to look anywhere in memory to locate any object, pull up the variable that was loaded on any call stack, and disassemble code to help diagnose the problem. The disadvantage of full memory dump files is that they are large. It also may take additional time to collect these files, and the process that is being recorded must be frozen while the dump file is created.
- Mini memory dump files. A mini dump file is more configurable than a full dump file and can range from only several megabytes (MB) up to the size of a full dump file. The size differs because of the amount of virtual memory that the debugger is writing to disk. Although you can gather mini memory dump files quickly and they are small, they also have a disadvantage. Mini dump files may contain much less information than full dump files. The information that a mini dump file gathers may be virtually useless to a support engineer if the area of memory that the support engineer has to troubleshoot was not captured. For example, if the heap memory is not written to the memory dump file, a support engineer cannot examine the contents of a message that was being processed at the time that the problem occurred. Useful information, such as the subject line and the recipient list, would be lost.
An extract from Microsoft's documentation.
76
Actually, as the following MS link states, things are bit more complex than suggested by the previous post.
https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/user-mode-dump-files#varieties
The difference between a mini-dump and a full-dump is more related to the format of the file than the amount of content/information in it. In fact, with the right configuration, a mini-dump will contain more information than a full-dump ever could and that is why properly configured mini-dumps are recommended in all cases.
29
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
