Using ProcDump for Troubleshooting

Using ProcDump for Troubleshooting

book

Article ID: CTX124508

calendar_today

Updated On:

Description

Background

ProcDump is a Windows Sysinternals command line utility used for troubleshooting various application processes that are experiencing CPU spikes. It includes frozen window monitoring and unhandled exception monitoring. It can also be used as a general process dump utility. A recent revision of ProcDump can be started using the –w switch and it can wait for the target process to begin.

Download the ProcDump utility from this link.

ProcDump Switches

The following table explains the various switches that can be used with ProcDump utiliy:

Switch

Description

-64

Captures a 32-bit dump of a 32-bit process when run on 64-bit Windows by default. The override option creates a 64-bit dump.

-b

Treats debug breakpoints as exceptions (otherwise ignores them).

-c

Specifies CPU threshold at which to create a dump of the process.

-d

Invokes the minidump callback routine named MiniDumpCallbackRoutine of the specified DLL.

-e

Writes a dump when the process encounters an unhandled exception.

-h

Writes a dump if process has a frozen window (window messages is not responded to for at least five seconds).

-m

Memory commit threshold in megabytes at which to create a dump of the process.

-ma

Writes a dump file with all process memory. The default dump formats include thread and handle information.

-mp

Writes a dump file with thread and handle information, and all read/write process memory.
To minimize dump size, searches for memory areas larger than 512 megabytes, and excludes the largest area found. A memory area is the collection of same sized memory allocation areas. The removal of this (cache) memory reduces Exchange and SQL Server dumps by over 90 percentage.

-n

Specifies number of dumps to write before exiting.

-o

Overwrites an existing dump file.

-p

Triggers on the specified performance counter when the threshold is exceeded.
Note: To specify a process counter when there are multiple instances of the process running, use the process ID with the following syntax: \Process(<name>_<pid>)\counter.

-r

Clones the process for the dump to minimize the time the process is suspended (Windows 7 and higher only).

-s

Defines consecutive seconds the CPU threshold must be hit before the dump is written (default is 10).

-t

Writes a dump when the process is terminated.

-u

Treats CPU usage relative to a single core.

-w

Waits for the specified process to launch if it is not running.

-x

Opens the specified image with optional arguments.

Note: To create a dump of a running process, omit the CPU threshold switch. If the name of a dump file is not added, by default <processname>.dmp is used. For example, C:\procdump.exe wordpad.exe (this creates a process dump for WordPad in the C root directory).

Command Line Interface

CLI

Additional Resources 

CTX118614 – How to Use Windows Error Reporting (WER) to capture Application Crash Dumps (User Dumps) on Windows Server 2008, Windows Vista, and Windows 7

Microsoft TechNet -  Download Windows Sysinternals ProcDump

Issue/Introduction

ProcDump is a Windows Sysinternals command line utility used for troubleshooting various application processes that are experiencing CPU spikes.