Post problem reports here for Batch files for use in BSOD debugging

Ztruker · 07 Dec 2020

Matthew Wai said:

Your "getWindowsUpdateList.bat" is too complicated. A single line of command will do the job.

PowerShell:

Code:

(Get-item "C:\Windows\WindowsUpdate.log").creationtime | Get-Date -f "yyyyMMdd"

Command Prompt:

Code:

PowerShell (Get-item \"C:\Windows\WindowsUpdate.log\").creationtime ^| Get-Date -f "yyyyMMdd"

Perhaps, I got it from somewhere and it works.

Apply your code to the batch file and send me a copy.If it works I'll update it in the repository.

Matthew Wai · 08 Dec 2020

@zbook
Is it impossible for two .dmp files to have the same filename and timestamp? If so, I will simply put all .dmp files into the same folder.

zbook · 08 Dec 2020

They should have different time stamps.

These have different names too.

None of these are memory dumps.

Loading Dump File [C:\Users\aaaaaaaa\AppData\Local\Temp\Temp1_minidump_06_12.zip\120620-33062-01.dmp]
Loading Dump File [C:\Users\aaaaaaaa\AppData\Local\Temp\Temp1_minidump_06_12.zip\120620-31671-01.dmp]
Loading Dump File [C:\Users\aaaaaaaa\AppData\Local\Temp\Temp1_minidump_06_12.zip\120620-27171-01.dmp]
Loading Dump File [C:\Users\aaaaaaaa\AppData\Local\Temp\Temp1_WATCHDOG-20201204-1631 (2) (1).zip\WATCHDOG-20201204-1631.dmp]
Loading Dump File [C:\Users\aaaaaaaa\AppData\Local\Temp\Temp1_DESKTOP-FP5PJN6-(2020-12-07_06-27-36).zip\Crash Dumps\120720-16156-01.dmp]
Loading Dump File [C:\Users\aaaaaaaa\AppData\Local\Temp\Temp1_DESKTOP-FP5PJN6-(2020-12-07_06-27-36).zip\Crash Dumps\120720-6734-01.dmp]
Loading Dump File [C:\Users\aaaaaaaa\AppData\Local\Temp\Temp1_DESKTOP-FP5PJN6-(2020-12-07_06-27-36).zip\Crash Dumps\120220-6906-01.dmp]
Loading Dump File [C:\Users\aaaaaaaa\AppData\Local\Temp\Temp1_DESKTOP-FP5PJN6-(2020-12-07_06-27-36) (1).zip\Crash Dumps\120720-16156-01.dmp]
Loading Dump File [C:\Users\aaaaaaaa\AppData\Local\Temp\Temp1_DUMPS-20201208T022743Z-001.zip\DUMPS\120620-5375-01.dmp]

In general we troubleshoot 4 different types of dump files.
mini dump
memory dump
Setupmem.dmp

Only one of these has subcategories: Live kernel reports

Post #204 displayed 3 types.
There are many others.

A command to collect each type to the desktop would be useful.

V2 collects:
mini dump files only in the prior 30 days.
live kernel reports without dump files
no memory dumps, setupmem.dmp or live kernel dumps

DM collects:
all available mini dump files without time parameters
no live kernel reports
no live kernel dumps
no memory dumps
no setupmem.dmp

LOGS or PS1 collects
all available mini dump files without time parameters
all live kernel report dump files
no memory dumps
unknown setupmem.dmp

It will be useful to have commands that will collect each to the desktop:
a) memory dumps
b) live kernel reports and dumps
c) setupmem.dmp

One challenge is the size of the larger files.

Size should not be important when collecting to the desktop unless the drive has very limited free space.

So for kernel and memory dumps they could be collected to the desktop.
We would then have to rely on the OP to select one or more files based on size for zip/upload or share link.

zbook · 08 Dec 2020

This maybe what could be collected to the desktop:
C:\Windows\LiveKernelReports\*.dmp

Also include the file that lists all of the livekernelreports (similar to V2)

In this thread:
Multiple Random BSOD - ntoskrl/Crtical Process Died

The OP had problems running tuneup.bat.

Manual commands were run without problems.

Matthew Wai · 08 Dec 2020

zbook said:

a) collect only the live kernel dump files within the past 30 days?
b) collect all live kernel dump files to the desktop
c) collect live kernel dump files < 1.5 GB

%WinDir%\LiveKernelReports\

The attached batch script will zip the DMP files in the above folder as long as they are not older than 30 days and are smaller than 1.5 GB in size. The ZIP file will be on the desktop.

I don't have a DMP file older than 30 days or larger than 1.5 GB, so I cannot make sure that it will work as expected.

Ztruker · 08 Dec 2020

Tried running it and got this:

Post problem reports here for Batch files for use in BSOD debugging-image.png

Matthew Wai · 08 Dec 2020

The file size is 655.93359375 MB.

The comparison supports an integer but not a decimal. I have to come up with a solution.

Matthew Wai · 08 Dec 2020

@Ztruker, I have managed to remove the decimal from the file size. Only integers will be used for comparison in the version attached below:

Ztruker · 08 Dec 2020

When I ran it I got this:

There was a a prior Command Prompt window that had some info in it but that closed before I could do anything with it.
Can you leave the 1st Command Prompt Window open until the last Command Prompt Window is closed then close both?

That way data can be recorded for both.

I'll try to catch it in another run for now.

Edit: Okay, this is what it said:

That's important info so it should be seen which is not happening if the window closes when the No files zipped message is posted.

zbook · 08 Dec 2020

These were the results for both scripts:

Post problem reports here for Batch files for use in BSOD debugging-ten-forums-kernelmemorydmp-batch-scripts.png

Code:

 #######################################################################################
 #                                                                                     #
 #                         Gather_additional_dump_files.bat                            #
 #                                                                                     #
 #      The following ZIP file has been created on the desktop:                        #
 #                                                                                     #
 #             LiveKernel Reports 2020-12-08 (18-22-21).zip                            #
 #                                                                                     #
 #      Please upload the file as an attachment to your post on TenForums.             #
 #      Press any key to close this window.                                            #
 #                                                                                     #
 #######################################################################################