ProcDump is a Windows Sysinternals command line utility used for troubleshooting various application processes that are experiencing CPU spikes. It includes frozen window monitoring and unhandled exception monitoring. It can also be used as a general process dump utility. A recent revision of ProcDump can be started using the –w switch and it can wait for the target process to begin.
Download the ProcDump utility from this link.
The following table explains the various switches that can be used with ProcDump utiliy:
Switch |
Description |
---|---|
-64 |
Captures a 32-bit dump of a 32-bit process when run on 64-bit Windows by default. The override option creates a 64-bit dump. |
-b |
Treats debug breakpoints as exceptions (otherwise ignores them). |
-c |
Specifies CPU threshold at which to create a dump of the process. |
-d |
Invokes the minidump callback routine named MiniDumpCallbackRoutine of the specified DLL. |
-e |
Writes a dump when the process encounters an unhandled exception. |
-h |
Writes a dump if process has a frozen window (window messages is not responded to for at least five seconds). |
-m |
Memory commit threshold in megabytes at which to create a dump of the process. |
-ma |
Writes a dump file with all process memory. The default dump formats include thread and handle information. |
-mp |
Writes a dump file with thread and handle information, and all read/write process memory. |
-n |
Specifies number of dumps to write before exiting. |
-o |
Overwrites an existing dump file. |
-p |
Triggers on the specified performance counter when the threshold is exceeded. |
-r |
Clones the process for the dump to minimize the time the process is suspended (Windows 7 and higher only). |
-s |
Defines consecutive seconds the CPU threshold must be hit before the dump is written (default is 10). |
-t |
Writes a dump when the process is terminated. |
-u |
Treats CPU usage relative to a single core. |
-w |
Waits for the specified process to launch if it is not running. |
-x |
Opens the specified image with optional arguments. |
Note: To create a dump of a running process, omit the CPU threshold switch. If the name of a dump file is not added, by default <processname>.dmp is used. For example, C:\procdump.exe wordpad.exe (this creates a process dump for WordPad in the C root directory).
Microsoft TechNet - Download Windows Sysinternals ProcDump