Failed to capture dump, error "cocould not attach to process XXXX, ntstatus 0xc0000048 ″

Problem description

========================

We tried to use adplus to capture dump file. But the size of dump files are all under 20 K.

We tried it several times.

Trouble Shoot

========================

I tried to use the specified parameter xec.exe-s-I-d cmd.exe "to initialize adplus. No luck.

I tried to use windbg attach to the process, I failed with information below.

Detail message is as below.

---------------------------

Cocould not attach to process 1272, ntstatus 0xc0000048

You have attempted to set the debugport or exceptionport of the process, but the process already has a port or tried to set the file's completionport, but the file has already set the port, or you have attempted to set the relevant completion port for the alpc port, but this port has been set.

Did more research, we found the root cause and solution.

We saw debugdiag, and we asked customer to open that. We see the dialog below.

There it is! 1272 is our SharePoint w3wp.exe process.

 

Root Cause

======================================

Debug diag already attached to the process.

Debug diag has rules, which can attach to target process. Even if the rule is completed, it won't let go of the process.

Another word to say is the debug port is still occurpied by debugdiag, so other debuggers such as windbg or cdb.exe cannot attach and write dump file.

 

Solution

======================================

1. Clear the rules in debugdiag.

2. Kill the following processes in task manager.

· Dbgsvc.exe

· Dbghost.exe

Problem resolved.

Dump can now be successfully written.

 

Lesson learned

======================================

Be careful with debugdiag. When its rules are finished, it won't let go of the process.

 

Reference

======================================

How to resolve "cannot debug PID <pid>, ntstatus 0xc0000048"-"an attempt to set a process's debugport or exceptionport was made ..."

Http://blogs.msdn.com/ B /spike/archive/2011/10/21/how-to-resolve-quot-cannot-debug-pid-lt-pid-gt-ntstatus-0xc0000048-quot-quot-an-attempt-to-set-a-process-s-debugport-or-exceptionport-was-made-quot.aspx? Commentposted = true # commentmessage