19


I just started playing around with procdump and and I want to have a full dump of an application when an unhanded second chance exception occurs.
According to the documentation I run it likes this:

procdump.exe -ma -e -x C:\CrashDumps C:\Code\CrashApp\CrashApp\bin\Debug\CrashApp.exe

CrashApp.exe is a simple console application that throws an exception when started.
This is the output I get:

ProcDump v7.0 - Writes process dump files
Copyright (C) 2009-2014 Mark Russinovich
Sysinternals - www.sysinternals.com
With contributions from Andrew Richards

Process:               CrashApp.exe (6516)
CPU threshold:         n/a
Performance counter:   n/a
Commit threshold:      n/a
Threshold seconds:     10
Hung window check:     Disabled
Log debug strings:     Disabled
Exception monitor:     Unhandled
Exception filter:      *
Terminate monitor:     Disabled
Cloning type:          Disabled
Concurrent limit:      n/a
Avoid outage:          n/a
Number of dumps:       1
Dump folder:           C:\CrashDumps\
Dump filename/mask:    PROCESSNAME_YYMMDD_HHMMSS


Press Ctrl-C to end monitoring without terminating the process.

CLR Version: v4.0.30319

[23:54:51] Exception: E0434F4D.System.Exception ("Hello World")

Unhandled Exception: System.Exception: Hello World
   at CrashApp.Program.Crash(String message) in c:\Code\CrashApp\CrashApp\Program.cs:line 18
   at CrashApp.Program.Main(String[] args) in c:\Code\CrashApp\CrashApp\Program.cs:line 13
[23:54:52] The process has exited.
[23:54:52] Dump count not reached.

As you can see he reports an unhanded exception but doesn't create a dump.
What am I doing wrong here?

Roman Pokrovskij
  • 9,449
  • 21
  • 87
  • 142
NKnusperer
  • 974
  • 1
  • 11
  • 31
  • It isn't unhandled as far as procdump is concerned, you got a nice managed stack trace. Consider [DebugDiag instead](http://msdn.microsoft.com/en-us/library/ff420662.aspx), now up to version 2.1 btw. – Hans Passant Aug 05 '14 at 22:23
  • @HansPassant Are you sure that's correct? I get a perfectly fine dump in case of a second chance managed exception using procdump. – Brian Rasmussen Aug 06 '14 at 02:16
  • @Brian - pretty sure, that stack trace doesn't fall from the sky. Not sure what produces it, specific to console mode programs afaik. – Hans Passant Aug 06 '14 at 07:25
  • 1
    @Hans Passant I don't get the point of your statement that I have a stack trace. This is not enough and that's the reason why I want to have a dump to see that state of the application at the point of the crash. procdump clearly says that an unhanded exception happened and the `-e` switch says: `Write a dump when the process encounters an unhandled exception`. DebugDiag looks very bloated, I don't want to create crazy config scripts first, all I want is a dump of my .Net application when crashing that I can throw into Visual Studio to see what happened. – NKnusperer Aug 06 '14 at 08:33
  • Procdump only jumps into action when it observes an unhandled exception. It isn't unhandled in your program. The CLR stepped in, caught the unhandled managed exception, produced a diagnostic (exception message and stack trace) and terminated the app. Complaining about Procdump or DebugDiag doesn't get you anywhere on this site, you'll have to take it up with Microsoft Support. Pinvoking MiniDumpWriteDump() so you don't need any helper tool at all has been done many times as well, Google can show you. – Hans Passant Aug 06 '14 at 08:48
  • 1
    As far as I can see, `-e -g` doesn't catch StackOverflowException: [19:58:58] Exception: C00000FD.STACK_OVERFLOW [19:58:58] The process has exited. [19:58:58] Dump count not reached. – Kirill Osenkov Jul 01 '21 at 02:59

2 Answers2

21

Since .net tag is present, I suspect that you are monitoring managed process. If so, then add -g command line option and procdump will work as you expect.

alpinsky
  • 524
  • 3
  • 7
  • 3
    Bingo! This was the correct answer for my problem (similar to above). Just need to tell Procdump to to run as a native debugger in a managed process. – craigrf Nov 06 '15 at 20:56
  • Thanks. This helped me too. Found this post from: http://forum.sysinternals.com/not-able-to-create-crash-dump-file-using-procdump_topic29849.html – Cloud Feb 26 '16 at 16:14
  • 1
    from my testing, `-e -g` doesn't seem to be catching a stack overflow, for example: [19:58:58] Exception: C00000FD.STACK_OVERFLOW [19:58:58] The process has exited. [19:58:58] Dump count not reached. – Kirill Osenkov Jul 01 '21 at 03:06
8

Try using the parameters e 1 -f -g.

-e 1 will tell procdump to capture a dump file on first-chance (i.e. handled) exceptions as well as unhandled ones and the -f parameter will allow you to filter on the exception type that you care about.

E.g.

procdump -ma -e 1 -f C00000FD.STACK_OVERFLOW -g -w CrashApp.exe

uglybugger
  • 905
  • 9
  • 7