Symptoms
A system/application crash or manually forced memory/user dump has been sent to Technical Support, however the customer does not remember from which server or workstation the dump was taken. The problem becomes visible when the Dev Analysis team compares the results with the previously sent dump file.
Cause
The customer forgot to record the computer name or Technical Support forgot to ask this information before.
Resolution
Follow these steps:
1. Open WinDbg.
2. Verify that File\Symbol File Path… dialog contains the path to Microsoft Symbol Server:
srv*c:\symdownstream*
http://msdl.microsoft.com/download/symbols
3. Open the dump.
4. If the dump is memory dump (complete or kernel) then execute the following command:
dd srvcomputername
You should have the following output after some time (error and warnings are normal for this command):
6: kd>
dd srvcomputername
beb1b7e8 00220008
e22e79e8 beb1b7f0 beb1b7f0
beb1b7f8 beb1c280 beb1b7fc beb1b7fc beb1c2b8
beb1b808 beb1b808 beb1b808 beb1c2f0 beb1b814
beb1b818 beb1b814 beb1c328 beb1b820 beb1b820
beb1b828 beb1c360 beb1b82c beb1b82c beb1c398
beb1b838 beb1b838 beb1b838 beb1c3d0 beb1b844
beb1b848 beb1b844 beb1c408 beb1b850 beb1b850
beb1b858 beb1c440 beb1b85c beb1b85c beb1c478
You want to examine the third value in the first row (marked bold in this document).
Execute the following command:
du e22e79e8
The computer name is displayed:
0: kd> du e22e79e8
e22e79e8 "ECHO"
The computer name where the memory dump has been taken is “ECHO.”
5. If the dump is the user dump then inspect its environment block:
0:000>
!peb
PEB at 7FFD6000
…
…
…
Environment: 0x10000
0:000>
s-su 0x10000 0x20000
00010000 "ALLUSERSPROFILE=C:\Documents and"
00010040 " Settings\All Users"
00010068 "ClusterLog=C:\WINNT\Cluster\clus"
000100a8 "ter.log"
000100b8 "CommonProgramFiles=C:\Program Fi"
000100f8 "les\Common Files"
0001011a "COMPUTERNAME=ST-TS614"
The computer name where the user dump has been taken is “ST-TS614”
More Information
To download
WinDbg, use the hyperlink.
For more information about WinDbg commands, refer to WinDbg Help available from “Debugging Tools for Windows.”
Source
Linear Mode
