WinDbg to create dump file upon crash?

Question

We're having an exception with our application. Using Dr.Watson we didn't capture any dmp as well log files. I'm told, WinDbg is an alternative to create dump files upon exceptionn/crash of a program. After a googling, I come across a piles of confusion. First of all, I'd like to confirm, whether it is possible, to creat dump files with help of WinDbg. Second, is there any recommended simple command lines to attach WinDbg to an application to get the dump files upon its crash? Thanks alot!

Activity

FYI: the most likely cause of an insufficient dump file from Dr. Watson is not including the heap as part of the dump. You should look into enabling that for troublesome errors – Originate

@Originate I don't understand your suggestion. Normally ther Options inside Dr.Watson include: "Dump Symbol Table", "Dump All Thread Contexts"... – Activity

I've never actually used the admin side of Dr Watson, I've just consumed the results :). – Originate

Answer 1

In this situation we usually recommend to our users to download procdump (which can just be extracted from the zip file, no installation required) and then we give them a batch file that contains something like this:

mkdir c:\dumps
procdump -e -c 10 -w myprocess.exe c:\dumps

When the process generates an unhandled exception it will create a dump file in the c:\dumps directory that you can load into Visual Studio or Windbg (the !analyze -v command is your friend)

Ensepulcher

Answer 2

You can use WinDbg .dump command,

.dump /mfh /u C:\crash.dmp 

For crash scenarios, two other tools are more suitable,

• Debug Diag http://support.microsoft.com/kb/2580960
• ADPlus.exe http://blogs.msdn.com/b/cobold/archive/2010/03/01/collection-crash-dumps.aspx

Stelliform

Answer 3

Choosing the Best Tool confirms that WinDbg will help you create dump files but also provides some alternatives that may be easier to use.

Chadd

Answer 4

If you can intercept the crash in an exception handler then you can write the dump using code: http://msdn.microsoft.com/en-us/library/windows/desktop/ms680360%28v=vs.85%29.aspx

Otherwise you need to instruct Dr. Watson to intercept and create the dump for you with particular flags that specify the level of detail the dumps will hold: http://blogs.technet.com/b/askperf/archive/2007/06/15/capturing-application-crash-dumps.aspx and http://social.technet.microsoft.com/wiki/contents/articles/8103.application-crash-dump-analysis-windows-7.aspx and msdn

To do this from the command line you need to do something like:

cdb -pn myApp.exe -c ".symfix;.reload;.dump /ma c:\memdump\crash.dmp;qd"

This presumes that cdb.exe path is searchable, you may need to prefix with full path like:

C:\Program Files (x86)\Debugging Tools for Windows (x86)\cdb -pn myApp.exe -c ".symfix;.reload;.dump /ma c:\memdump\crash.dmp;qd"

So the commands here

cdb -pn   -->attaches cdb to your process name myApp.exe
-c        -->execute command
.symfix   -->fix microsoft symbols
.reload   -->reload
.dump /ma c:\memdump\crash.dmp --> write minidump to location (the flags /ma is effectively everything you want)
qd        -->quit and detach

You may not need some of these commands, you can remove them if not needed.

Greeting

Thank you so much. Is it the command line to capture the dump files upon crash? – Activity

This is the command that will attach and perform a memory dump but you still need to setup the handler in the registry if you check the links – Greeting