Is WinDbg supposed to be so excruciatingly slow?

Question

I'm trying to analyze some mini crash dumps. I'm using Windows 10 Pro Build 1607 and WinDbg 10.0.14321.1024. I have my symbol file path set to

SRV*C:\SymCache*https://msdl.microsoft.com/download/symbols

Basically, whenever I load up a minidump (all < 1 MB .dmp files), it takes WinDbg forever to actually analyze them. I understand the first run can take long, but it took mine almost 12 hours before it would let me enter a command. I assumed that, since the symbols were cached, it wouldn't take long at all to re-open the same .dmp. This is not the case. It loads up, goes pretty much instantaneously to "Loading Kernel Symbols", then takes another 30 minutes before it prints the "BugCheck" line. It's been another 30 minutes, and I still can't enter commands into it.

My PC has a 512 GB SSD, 8 GB of RAM, and an i5-4590. I don't think it should be this slow.

What am I doing wrong?

Menon

I think this is an active issue: connect.microsoft.com/VisualStudio/feedback/details/3101617/… – Aoudad

Answer 1

This is the symbol server being really slow. Other have noticed as well: https://twitter.com/BruceDawson0xB/status/772586358556667904

Your symbol path contains a local cache so it should load faster next time around, but it seems that the cache is not effective, I can't tell really why (I suspect the downloaded symbols are not a perfect match and they are being downloaded again, every time).

I would recommend modifying the _NT_SYMBOL_PATH (or whatever is the way your sympath is initialized) to SRV*C:\SymCache only, ie. do not attempt to automatically download, just use the symbols you already have cached locally. The image should open fairly fast. Only enable the symbols server if you discover missing symbols.

Pert

Answer 2

These kind of complaints seem to occur more often lately and I can reproduce it on my PC. This is not your fault but some issue with the Internet or the symbol server on Microsoft side.

Monitoring the traffic with Wireshark and looking at my disk on how the symbol cache get populated, I can say:

• only one file is being downloaded at a time.
• the problem also occurs with older WinDbg versions (6.2.9200)
• the problem occurs with HTTP and HTTPS
• when symbols are found, the transfer speed is very slow, then increasing. The effective transfer rate is down at 11 kb/s to 20 kb/s (on a line which can handle 6500 kb/s)
• there's quite a high number of packets out of order, duplicate packets etc., especially during the "lookup phase" where no file is downloaded yet. Such a lookup phase can easily take 8 minutes.
• even if the file already exists on disk, the "lookup phase" is performed.
• the HTTP roundtrip time (request to response) is 8 to 9 seconds

Dorado

Answer 3

I ran into the same problem (extremely slow windbg), but loading/reloading/fixing/caching symbols did not help. By accident, I figured out that this problem persists when I try to print memory with address taken from a register, like

db rax 

The rule of thumb is to always use @ with the register name.

db @rax 

Without this symbol, the debugger considers rax to be a symbol name, and looks for it some time (depending on the amount of symbols you have loaded) and fails to find it eventually, and falls back to treating it like a register name. Printing memory from register with @ symbol works instantly, even if you have gigs of symbols loaded in memory. As you can see, this problem is also symbol-related, but in a different way.

Lac