Crash dump too big, or no WinDbg on this machine?
Why a Windows memory dump is as big as RAM, how to get a smaller one, how to open a dump on another machine, and the upload limits for DumpTriage.
Short answer: You don't need WinDbg on the machine that crashed. Copy the .dmp file to another machine and open it there. If the file is too big to move, change Startup and Recovery to write a kernel or automatic memory dump (or a small memory dump) instead of a complete one, and wait for the next crash. A minidump is usually enough to name the faulting module.
Why the dump is so big
| Dump | How big | Where it is |
|---|---|---|
| Minidump (small memory dump) | Hundreds of kilobytes. | %SystemRoot%\Minidump\*.dmp |
| Kernel or automatic memory dump | A fraction of RAM; Windows sizes an automatic dump for you. | %SystemRoot%\MEMORY.DMP |
| Complete memory dump | About as large as the machine's RAM. | %SystemRoot%\MEMORY.DMP |
| Linux core or vmcore | The memory of the process, or of the kernel as filtered by kdump. | Where core_pattern or kdump puts it. |
What each type holds is in what is inside a Windows crash dump (and a Linux core). A multi-gigabyte MEMORY.DMP is usually a complete or kernel dump on a machine with a lot of RAM, not a sign that something else is wrong.
Getting a smaller dump
- Use the minidump Windows already wrote in
%SystemRoot%\Minidump\, if there is one. For most bug checks, such as 0x3B, 0xD1 or 0x133, it is enough. - Under System Properties → Advanced → Startup and Recovery, pick Kernel memory dump, Automatic memory dump or Small memory dump instead of Complete memory dump. It applies to the next crash; the dump you already have stays as big as it is.
- Compress the file (zip or 7-Zip) to move it between people. A memory dump compresses well, but the machine that opens it needs the room for the full file.
- Send a smaller dump first, and a larger one only when an engineer asks for it. Is it safe to send a customer's crash dump? says why.
No WinDbg on this machine
The debugger doesn't have to run where the crash happened, and on a production server it shouldn't. Copy the file to your own machine, then:
winget install Microsoft.WinDbg
# open the .dmp in WinDbg, then:
.symfix
.reload
!analyze -vStep by step, including what to read in the output, is in how to analyze a Windows minidump. On Linux, run gdb or crash on another machine that has the same binary or kernel debug symbols as the one that crashed: Linux core dumps with gdb and crash.
Uploading to DumpTriage
Upload the dump file itself; the file type is detected from its own bytes. The largest dump depends on the account's tier (API reference, Tiers & Quotas):
| Account | Largest dump |
|---|---|
| Email not yet verified | 256 MiB, one dump |
| solo | 2 GiB |
| isv | 8 GiB |
| enterprise | 16 GiB |
A larger file is refused with 413, and an oversized upload is cut off at the limit rather than after the whole transfer. If a complete dump is over your limit, use a kernel, automatic or small memory dump as above, or ask for a higher limit (the API reference says how). The upload is one request:
curl -X POST https://api.performanceinsights.ai/api/v1/dumps \
-H "Authorization: Bearer dts_..." \
-F "file=@crash.dmp"The API reference has the report call and the error codes. Whether an AI model ever sees the dump is answered on AI and data.
Common questions
- Why is my crash dump so big?
- A complete memory dump holds all of the machine's physical memory, so it is about as large as its RAM. A kernel or automatic memory dump is smaller, and a minidump is hundreds of kilobytes. Startup and Recovery sets which one Windows writes.
- Do I need WinDbg on the crashed machine?
- No. Copy the .dmp file to any Windows machine, install WinDbg there (winget install Microsoft.WinDbg), set the Microsoft symbol path and open the file. The machine that crashed only has to hold the file until you have copied it.
- What is the largest dump DumpTriage accepts?
- It depends on the account's tier: 2 GiB for solo, 8 GiB for isv and 16 GiB for enterprise, and 256 MiB until the email address is verified. A larger file is refused with 413 and cut off at the limit, so a too-big upload fails early.
Ready to send a dump?
Upload a minidump to DumpTriage. It runs the debugger, reads the output and sends back the faulting module, the stack and a plain-language root cause (how the analysis works). Cases the automated passes can't settle go to an engineer. Free during the pilot.
Create an account