4

I've always considered myself to be reasonably experienced with capturing dumps, but this one has really confused me. I have a .net process which is crashing periodically ... I don't know what it's crashing on, whether it's crashing in native or managed code, or even whether it's the process itself that's hitting the exception or a 3rd party DLL. All I know is that it's crashing. I'm trying to get a dump of the crash using procdump, but I'm really struggling. I setup procdump as follows:

procdump processname.exe -ma -e

The problem is, within a few minutes of doing this, procdump will generate a dump and exit ... even though the process never actually crashed. If I add -g, I still get the same result ... after a few minutes, procdump will generate a dump and exit. If I start it up again, the same thing will happen. I opened up some of the dumps that it generated, and they don't have any native exception context. So, I dumped out all the managed callstacks for any managed threads, and (in all the dumps I've checked so far) I've found something similar to this callstack:

System.Threading.WaitHandle.WaitAny
System.Runtime.IOThreadTimer+TimerManager.OnWaitCallback
System.Runtime.IOThreadScheduler+ScheduledOverlapped.IOCallback
System.Runtime.Fx+IOCompletionThunk.UnhandledExceptionFrame
System.Threading._IOCompletionCallback.PerformIOCompletionCallback

I presume this Unhandled exception is what's causing procdump to generate the dump file. I done a bit of a search and found the UnhandledExceptionEventHandler object. So I guess the process must have something in there to capture unhandled exceptions. Or is this just standard SEH stuff ?

Either way, I don't really care about these unhandled exceptions, I only care about the one that is causing the crash. Is there any way I can tell procdump to only create a dump on a fatal exception ? I don't think -t will work as this won't catch the exception and will just dump when the process terminates normally. Is my only option to move to something else like DebugDiag ?

Thanks in advance for any advice

another_one
  • 356
  • 4
  • 13
  • 1
    Procdump is not very good at detecting that exceptions are *really* unhandled. The CLR steps in and translates the SEH exception to a managed exception. To be swallowed by a try/catch next, that happens. Do consider using DebugDiag instead, it knows better. – Hans Passant Aug 23 '16 at 12:03
  • Thanks Hans, I had suspected that might be the case alright, I had just never come across this in the past (I've gotten dumps of managed .net processes in the past without having this issue). I presume using WER Local Dumps would also result in the same problem right ? – another_one Aug 23 '16 at 12:53
  • It shouldn't, WER only ever kicks in when the show is really over. – Hans Passant Aug 23 '16 at 12:58

1 Answers1

0

You actually tell ProcDump to dump on unhandled exceptions yourself.

-e Write a dump when the process encounters an unhandled exception. Include the 1 to create dump on first chance exceptions.

Quote taken from here.

Just leave it out and you won't get dumps on unhandled exceptions:

procdump processname.exe -ma
Timo Salomäki
  • 7,099
  • 3
  • 25
  • 40
  • I do want to dump on an unhandled exception ... the problem is that the unhandled exceptions it's dumping somehow are not fatal (ie don't result in a crash), and so are not the ones I'm interested in. – another_one Aug 23 '16 at 09:16