procDump usage

A major release of ProcDump has been posted on the Sysinternals.com site (http://technet.microsoft.com/en-us/sysinternals/dd996900.aspx). It is also available on the internal share (//redmond/files/SYSINTERNALS/LBI/Latest).

The ProcDump v3.02 release (dated 31st Jan. 2011) contains these major changes (all are important to Exchange dump capture):

• "procdump -mp" now includes full address space information (i.e. !address -summary now works)
• "procdump -mp" now makes a more complete dump when run against a managed process
• "procdump -p" supports more performance counter types (in particular, all performance counter types used by Exchange are now supported)
• "procdump -e" now includes an exception context record (i.e. .ecxr now works)
• "procdump -e" now ignores breakpoints. To dump on a breakpoint, also include the new "-b" switch

 

Example Usages for Information Store based dump collection

 

Take a single ‘MiniPlus’ dump:

 

md c:/dumps

procdump.exe -mp -accepteula store.exe c:/dumps

 

 

Take a single ‘MiniPlus’ dump when the process has a 2^nd chance exception (it crashes):

 

md c:/dumps

procdump.exe -mp –e -accepteula store.exe c:/dumps

 

 

Take three ‘MiniPlus’ dumps 15 seconds apart (this replaces: ADPlus -hang -pn store.exe -r 3 120 ):

 

md c:/dumps

procdump.exe -mp –n 3 –s 15 -accepteula store.exe c:/dumps

 

 

Take up to three ‘MiniPlus’ dumps when the CPU is over 250% of the server’s capacity (-u) for 15 seconds (refer to this Mark Russinovich post for a ‘Case of…’ explaining ‘-u’):

 

md c:/dumps

procdump.exe -mp –n 3 –s 15 –u –c 250 -accepteula store.exe c:/dumps

 

 

Take up to three ‘MiniPlus’ dumps when ‘RPC Averaged Latency’ is over 250msec for 15 seconds (this replaces Performance Alerts scripts):

 

md c:/dumps

procdump.exe -mp –n 3 –s 15 –p "/MSExchangeIS/RPC Averaged Latency" 250 -accepteula store.exe c:/dumps

 

 

Incorrect Usage

Please be aware that these switches should not be used when capturing dumps of most processes:

 

·         The -t switch doesn't capture a crash; it captures the final termination of the process.

o   This is after the crash, at the point that the process is about to end.

o   This type of dump is usually useless.

 

·         The -64 switch is not required on an x64 OS.

o   This switch is for WOW64 analysis. (No harm done if used.)