How to Create a Dump File for applications

Using the WinDbg tool, the body can be obtained when an application terminates abnormally or is unresponsive, to be used for anatomical studies.

Creating Dump File
It is convenient to crawl the dump file in Vista environment, in Task Manager (CTRL-SHIFT-ESC), select the process to generate the dump file, click "creat Dump" in context menu.

Typically, you use the ADPlus.vbs of the WinDbg directory (C:/Program files/debugging Tools for Windows (x86)) to crawl the dump file.
Adplus-hang-p 2960//Generate dump when process 2960 loses response
ADPLUS-CRASH-PN w3wp.exe//Generate dump when w3wp.exe is terminated or recycled
ADPLUS-CRASH-PN W3wp.exe-nodumponfirst//Ibid, do not generate dump for first chance exceptions

ADPlus is a VB script file that runs CDB (the WinDbg under command line) and is responsible for monitoring the exceptions that will occur in the system.

ADPlus parameter settings

-huang	At any time when the process is running, you can use the-hang parameter to get a dump file without having to consider whether the thread is really in deadlock and used to diagnose high memory usage and high CPU usage. In the hang mode, the dump file is crawled in a non-intrusive manner and does not interrupt the thread, so it is not necessary to have the same identity as the boot process, which is useful when the client is debugging the server with the Hang mode fetching dump file.
-crash	Fetch dump file When the process terminates abnormally. There are 3 scenarios where the process terminates abnormally: 1.unhandled of exception The 2.asp.net process terminated because of IIS reset or recycle. 3. Heap corruption, stack overflow, insufficient memory and other errors, the process must exit
-pn	Specifies the name of the process to parse. Use multiple "-PN process name" switches to specify multiple processes.
-O	Dump file's storage path, default to the path where ADPlus is located
-fullonfirst	Create full dumps on first chance exceptions
-minionsecond
-nodumponfirst	If exception is handled by Try-catch block, using this parameter will not generate a dump file
-nodumponsecond
-quiet	No dialog boxes'll be displayed

What is first chance Exception and Second chance Exception?
When the program throws an exception (. NET or native exception), at this point the exception is 1st chance exception, if the exception is not handled by Try-catch block, This exception will become 2nd chance exception (unhandled exception) The current process is then terminated.

what is mini dump and full dump?
User-mode Mini dump, which saved part of the process crash. Some SOS commands do not work on mini dump. The contents and size of the Mini dump are related to the program being dump. Mini The information contained in dump is not necessarily less than full dump.
Full User-mode dumps contains debug information such as the entire memory space of the process, the program's Image,handle table, and so on.

The output of ADPlus
A directory is generated under the path where the ADPlus.vbs is located, as in the form <crash or huang>_mode__date_07-22-2008__time_10-35-1212, and the directory contains

• cdbscripts-the folder that contains the configuration file that is used to inform windbg/cdb what commands to run.
• adplus_report . txt  -record information about ADPlus attach to process
• pid-< process id>__< Process name > . exe__date_07-18-2008__time_14-55-0505 . log  -The run time log of ADPlus, in hang mode, which includes all threads in the stack, The information for the module that has been loaded and the output that is equivalent to executing the!runaway command. If the memory dump file creation fails, you can find the reason at the bottom of the file.
• pid-< process id>__< process name;. EXE__FULL_1C38_2008-07-18_14-59-08-005_1618.DMP-is dump file
• process_list . txt   -the output of Tlist.exe, which shows how many processes in the system are running concurrently when a memory dump file is generated.

If the program terminates due to unhandled exception, it will get multiple dumps, such as
Pid-4588__aspnet_wp. Exe__1st_chance_accessviolation__mini_15b8_2008-07-22_10-35-28-827_11ec.dmp
Pid-4588__aspnet_wp. Exe__1st_chance_process_shut_down__full_15b8_2008-07-22_10-35-36-609_11ec.dmp
Pid-4588__aspnet_wp. Exe__2nd_chance_net_clr__full_15b8_2008-07-22_10-35-29-420_11ec.dmp
Pid-4588__aspnet_wp. Exe__date_07-22-2008__time_10-35-1212.log
Process_list.txt

These dump files indicate:
First an illegal access occurred, perhaps a nullreferenceexception,adplus captured to this exception, generating a mini dump (1st_chance_accessviolation__mini)
This exception is not processed and then generates the CLR exception corresponding dump (2nd_chance_net_clr__full)
Then the process terminates, generating dump file:1st_chance_process_shut_down__full
What really solves the problem is the 2nd chance CLR Exception corresponding dump file
If you only get a dump, you can prove that crash is not caused by unhandled exception.

advanced usage of ADPlus
You can assign a configuration file to ADPlus, generate a dump file when a particular exception occurs, and place the dump file in a specific directory
Adplus-c MYCONFIG.CFG-PN w3wp.exe

Myconfig.cfg

<ADPlus> <Settings> <RunMode>Crash</RunMode> </Settings> <PreCommands> <Cmd>!load clr10/sos</cmd> </PreCommands> <Exceptions> <Option>nodumponfirstchance</Option> <Option>nodumponsecondchance</Option> <Config> <!--this was for the CLR exception-- <Code> CLR </Code> <Actions1> Log </Actions1> <CustomActions1>!clr10/sos.cceSystem.Runtime.InteropServices.COMException1; J ($t 1 = 1) '. dump/ma/uc:/dumps/exceptiondump.dmp; GN '; ' GN ' </CustomActions1> <ReturnAction1> GN </ReturnAction1> <Actions2> Void </Actions2> <ReturnAction2> GN </ReturnAction2> </Config> </Exceptions> </ADPlus>

http://blog.csdn.net/harbinzju/article/details/5844752

How to Create a Dump File for applications