Win2008 R2 WER ( error reporting ) LocalDumps blocked by what?

Question

I Just want to recover crash dumps of my own 32bit applications.

I tried the following:

I followed the steps at MSDN "Collecting User-Mode Dumps": http://msdn.microsoft.com/en-us/library/windows/desktop/bb787181%28v=vs.85%29.aspx
Somewhere on the internet I saw a mention about WER registry keys for 32 bit apps do NOT have to be added under HKLM\Software\WOW6432Node\Microsoft\Windows\Windows Error Reporting\LocalDumps\
Also that the ..\Windows NT\AeDebug\Auto (REG_SZ) value must be "0"

Additionally, I have WER error entries in the 'system event viewer' under "Windows Logs\Applications&Services\Microsoft\Windows\WER-Diagnostics\Operational" Showing messages "Possible heap corruption detected (code 3221225477)"

I don't know if this message relates to my test-app creating a NPE, or if this is WER itself having a problem?

I just can't get it to work :( Can anyone give me some clues ?

Update : For another fresh 2008R2 x64 machine, i just did the

HKLM\Software\... Reporting\LocalDumps\DumpFolder = "c:\crashdumps"
HKLM\Software\... Reporting\LocalDumps\DumpType = 2   (REG_DWORD)
HKLM\Software\... Reporting\LocalDumps\DumpCount = 20 decimal (REG_DWORD)

And running the nulpointer-terster worked as expected.

So im thinking there must be a settings in these other machines which prohibit LocalDumps from being used, although the LocalDumps registry-keys are there..

MS won't fix your programs. What they will do is collect crash reports from your customers that you can sign up to receive. — Gabe, Jun 12 '12 at 12:23
The first comment on the MSDN article you linked mentions that you should not set the values in the WOW6432Node. I'd try that. — jcopenha, Jun 13 '12 at 12:14
Now you mention it, i read that?! Later when i got desperate i must have forgot the Not bit. — Houtman, Jun 14 '12 at 09:29

score 3 · Answer 1 · answered Jun 13 '12 at 12:25

3

Create key: HKLM\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps
Create REG_DWORD value: HKLM\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps as 2 (=full dump).
Create REG_EXPAND_SZ value: HKLM\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps as C:\Dumps or where you like. Ensure that this folder actually exists.

answered Jun 13 '12 at 12:25

Dono

1,254
13
30

I've done this. I even put it on %LOCALAPPDATA%\Dumps because i didn't know if writing to c:\ is allowed for the running user. But is this actually all you did to het it to work for you ? – Houtman Jun 13 '12 at 13:30
Yes, I have done this on dozens of development and QA machines. Without failure, when a process crashes, there is a nice memory dump waiting there for me. I do not know if the system will resolve %LOCALAPPDATA% for you here. Try a good solid path first. Then create a test program that simply throws an uncaught exception to test it. Also, make sure that the entire path exists. Create the folder if necessary. – Dono Jun 13 '12 at 13:46
1

Thanks. I read on Msdn that the default goes to that %LOCALAPP.. Path. I also tried the solid paths on different drives. I made a 32bit app which creates a Nulpointer Exception. But its not caught. – Houtman Jun 13 '12 at 14:29
Are your programs 32 or 64 bit? – Houtman Jun 13 '12 at 15:07
Both 32-bit and 64-bit, native apps. Note though for .NET applications that this seems to be limited to those targeting version 4 and up. – Dono Jun 13 '12 at 20:01
This works for .NET 4 as well. The sentence on MSDN is a bit misleading – Thomas Weller Jan 18 '18 at 20:12

score 1 · Answer 2 · answered Jan 18 '18 at 20:14

I think you have already checked most of the common problems. There are 3 more:

Permissions of the folder to write to

Looking at the permissions of the folder C:\ProgramData\Microsoft\Windows\WER it has

Read & execute
List folder contents
Read

Creating a subfolder LocalDumps will inherit the permissions.

So you should either modify the permissions of that folder or use a different folder with write permissions.

Permissions of the Registry key

Windows might not be able to read the Registry settings if the permissions do not allow it. E.g. the following (really silly) permissions will prevent a LocalDump as well:

LocalDumps is disabled

Make sure that there is no DWORD Disabled with a value of 1 in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps

Win2008 R2 WER ( error reporting ) LocalDumps blocked by what?

2 Answers2

Permissions of the folder to write to

Permissions of the Registry key

LocalDumps is disabled