procdump not dumping on unhandled exception

Question

I just started playing around with procdump and and I want to have a full dump of an application when an unhanded second chance exception occurs.
According to the documentation I run it likes this:

procdump.exe -ma -e -x C:\CrashDumps C:\Code\CrashApp\CrashApp\bin\Debug\CrashApp.exe

CrashApp.exe is a simple console application that throws an exception when started.
This is the output I get:

ProcDump v7.0 - Writes process dump files
Copyright (C) 2009-2014 Mark Russinovich
Sysinternals - www.sysinternals.com
With contributions from Andrew Richards

Process:               CrashApp.exe (6516)
CPU threshold:         n/a
Performance counter:   n/a
Commit threshold:      n/a
Threshold seconds:     10
Hung window check:     Disabled
Log debug strings:     Disabled
Exception monitor:     Unhandled
Exception filter:      *
Terminate monitor:     Disabled
Cloning type:          Disabled
Concurrent limit:      n/a
Avoid outage:          n/a
Number of dumps:       1
Dump folder:           C:\CrashDumps\
Dump filename/mask:    PROCESSNAME_YYMMDD_HHMMSS


Press Ctrl-C to end monitoring without terminating the process.

CLR Version: v4.0.30319

[23:54:51] Exception: E0434F4D.System.Exception ("Hello World")

Unhandled Exception: System.Exception: Hello World
   at CrashApp.Program.Crash(String message) in c:\Code\CrashApp\CrashApp\Program.cs:line 18
   at CrashApp.Program.Main(String[] args) in c:\Code\CrashApp\CrashApp\Program.cs:line 13
[23:54:52] The process has exited.
[23:54:52] Dump count not reached.

As you can see he reports an unhanded exception but doesn't create a dump.
What am I doing wrong here?

Theophilus

It isn't unhandled as far as procdump is concerned, you got a nice managed stack trace. Consider DebugDiag instead, now up to version 2.1 btw. – Glycerol

@HansPassant Are you sure that's correct? I get a perfectly fine dump in case of a second chance managed exception using procdump. – Hopson

@Brian - pretty sure, that stack trace doesn't fall from the sky. Not sure what produces it, specific to console mode programs afaik. – Glycerol

@Hans Passant I don't get the point of your statement that I have a stack trace. This is not enough and that's the reason why I want to have a dump to see that state of the application at the point of the crash. procdump clearly says that an unhanded exception happened and the -e switch says: Write a dump when the process encounters an unhandled exception. DebugDiag looks very bloated, I don't want to create crazy config scripts first, all I want is a dump of my .Net application when crashing that I can throw into Visual Studio to see what happened. – Theophilus

Procdump only jumps into action when it observes an unhandled exception. It isn't unhandled in your program. The CLR stepped in, caught the unhandled managed exception, produced a diagnostic (exception message and stack trace) and terminated the app. Complaining about Procdump or DebugDiag doesn't get you anywhere on this site, you'll have to take it up with Microsoft Support. Pinvoking MiniDumpWriteDump() so you don't need any helper tool at all has been done many times as well, Google can show you. – Glycerol

As far as I can see, -e -g doesn't catch StackOverflowException: [19:58:58] Exception: C00000FD.STACK_OVERFLOW [19:58:58] The process has exited. [19:58:58] Dump count not reached. – Cedric

Answer 1

Since .net tag is present, I suspect that you are monitoring managed process. If so, then add -g command line option and procdump will work as you expect.

Syllogistic

Bingo! This was the correct answer for my problem (similar to above). Just need to tell Procdump to to run as a native debugger in a managed process. – Crore

Thanks. This helped me too. Found this post from: forum.sysinternals.com/… – Derwin

from my testing, -e -g doesn't seem to be catching a stack overflow, for example: [19:58:58] Exception: C00000FD.STACK_OVERFLOW [19:58:58] The process has exited. [19:58:58] Dump count not reached. – Cedric

Answer 2

Try using the parameters e 1 -f -g.

-e 1 will tell procdump to capture a dump file on first-chance (i.e. handled) exceptions as well as unhandled ones and the -f parameter will allow you to filter on the exception type that you care about.

E.g.

procdump -ma -e 1 -f C00000FD.STACK_OVERFLOW -g -w CrashApp.exe

Concavoconcave

But what if I only want the unhandled exceptions? -e -g doesn't seem to be catching StackOverflowException without 1. – Cedric