minidump vs. fulldump?

Question

I just recently started looking at dump files to help me analyze crashes of the w3wp process on our production environment at work...

And I would like to know, what are the differences between a minidump and a fulldump file ?

Solution 1

Differences between full memory dump files and mini memory dump files

A memory dump file can collect a variety of information. Typically, a support engineer must have all the contents of virtual memory to troubleshoot a problem. In other cases, you might want to capture less information to focus on a specific problem. The debugger is flexible. This flexibility lets you limit the information that a memory dump file captures by collecting either full memory dump files or mini memory dump files:

• Full memory dump files. These files contain the contents of virtual memory for a process. These files are the most useful when you are troubleshooting unknown issues. A support engineer can use these files to look anywhere in memory to locate any object, pull up the variable that was loaded on any call stack, and disassemble code to help diagnose the problem. The disadvantage of full memory dump files is that they are large. It also may take additional time to collect these files, and the process that is being recorded must be frozen while the dump file is created.
• Mini memory dump files. A mini dump file is more configurable than a full dump file and can range from only several megabytes (MB) up to the size of a full dump file. The size differs because of the amount of virtual memory that the debugger is writing to disk. Although you can gather mini memory dump files quickly and they are small, they also have a disadvantage. Mini dump files may contain much less information than full dump files. The information that a mini dump file gathers may be virtually useless to a support engineer if the area of memory that the support engineer has to troubleshoot was not captured. For example, if the heap memory is not written to the memory dump file, a support engineer cannot examine the contents of a message that was being processed at the time that the problem occurred. Useful information, such as the subject line and the recipient list, would be lost.

An extract from Microsoft's documentation.

Solution 2

Actually, as the following MS link states, things are bit more complex than suggested by the previous post.

https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/user-mode-dump-files#varieties

The difference between a mini-dump and a full-dump is more related to the format of the file than the amount of content/information in it. In fact, with the right configuration, a mini-dump will contain more information than a full-dump ever could and that is why properly configured mini-dumps are recommended in all cases.

Comments

[yegle]

This is the correct answer. The URL links to WinDBG document, which is the main tool to create dump on Windows system.

[WhiteDillPickle]

From the developer perspective a minidump is preferable, from a sysadmin perspective, a full dump is prefereable since the only way to create a "properly" configured minidump is with winDBG. A system should be configured with either an automatic memory dump or a full memory dump

[cmf41013]

How did you find such an authoritative and valuable document? Microsoft's documentation.