Creating a Memory Dump of a Process in Windows Server 2003?

Question

Since windows Vista, we have the nice option to create a memory dump of a process directly from Task Manager. Sadly, Windows Server 2003 does not have this option yet :( I found ways to do a complete system-wide memory dump, but that's a bit too much.

Is there a way to dump a single process? As this is a production Server, I do not want to install any heavy-weight tools or and service that runs in the background, ideally I'd just like to dump the process, copy the dump to my own machine and debug it there.

Magocsi

Answer 1

Yes, look for userdump.exe. See this KB article.

Chiao

Answer 2

You can attach the Windows debugger (ntsd or windbg) to the proccess, then when you want to create a dump of the process you can use the .dump command:

0:000> .dump /ma myprocess-crash.dmp
Creating myprocess-crash.dmp - mini user dump
Dump successfully written
0:000>

Perhaps

Thanks. I choose the other option to avoid having to install windbg – Magocsi

Answer 3

I think this 'answer' should be a comment under jeffamaphone's answer but I do not have enough reputation to comment.

Windows Server 2003 ships with ntsd so there is no need to install anything. Get the Process ID of the process and attach ntsd to the process:

C:> ntsd -p 4356

Then use ntsd to dump the process:

.dump /f c:\MyDumpFiles\foo.dmp

Semiporcelain

Answer 4

Don't forget about procdump from sysinternals.com (redirects to MS since they bought them a few years back). Very small download.

Strand