Create a full memory dump from ECSTA

This article explains how you can generate a so-called full memory dump from ECSTA and make it available for analysis.

Please use these settings only if it really is a crash.

The debug logs from ECSTA are also required in the event of a crash:

Creating a debug log in the ECSTA middleware

Procedure

Microsoft Windows Error Reporting

If the telephony service/ECSTA has crashed and this is also visible in Windows Error Reporting, the following path can be used to check whether Windows itself has created a dump:

C:\ProgramData\Microsoft\Windows\WER\

It should be noted that Windows does create a file for each crash. However, if the service crashes several times for the same reason, these files are not filled.
A filled memory dump has an approximate size of 150 MB – 2 GB. If the files have only a few KB, they are empty and useless for analysis.

If crash dumps are not written, this can be enforced with the following article: 
http://msdn.microsoft.com/en-us/library/windows/desktop/bb787181(v=vs.85).aspx

Dump via ECSTA

Alternatively, it is possible to have ECSTA write a dump itself.

Vorgehensweise

1. Run regedit.exe 

2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\ESTOS\ECSTA_Name

3. Click in the menu Edit -> New -> DWORD-Value (32-Bit).

4. Enter "DUMP" as the name.

5. Enter "2" as the value (decimal).
6. After the key is set, the ECSTA must be restarted, the easiest way to do this is to restart the telephony service.
7. In the event of a future crash, a full memory dump is written to the log file directory of ECSTA.

The generated files are relatively large and therefore cannot simply be included as an attachment to a ticket. To provide the files, you can make them available on your file share system. Alternatively, provide us with the corresponding information in the ticket so that we can offer you the options to upload the files to us.