1

I am looking a dump file collected from production environment for high cpu usage. I ran !threadpool and !runaway command as follows

0:000> !ThreadPool
CPU utilization: 100%
Worker Thread: Total: 6 Running: 2 Idle: 4 MaxLimit: 32767 MinLimit: 4
Work Request in Queue: 0
--------------------------------------
Number of Timers: 8
--------------------------------------
Completion Port Thread:Total: 8 Free: 3 MaxFree: 8 CurrentLimit: 8 MaxLimit: 1000 MinLimit: 4

0:000> !runaway
ERROR: !runaway: extension exception 0x80004002.
    "Unable to get thread times - dumps may not have time information"

I want to know what threads are consuming most cpu time but I cannot run !runaway command. Are there any other commands in sos, sosex or any other extension that could be helpful in this case?

paul deter
  • 857
  • 2
  • 7
  • 20
  • 1
    how did you capture the dump? I would use ETW/WPA for analyzing for CPU usage: https://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-42-WPT-CPU-Analysis but use WPRUI.exe (under Resource select **CPU usage** and click on **start** after 1 minute, click on **save**) – magicandre1981 Apr 13 '16 at 15:27

1 Answers1

2

You need a tool that adds the necessary information to the dump.

In WinDbg, the .dump command has the /mt MiniOption, which

Adds additional thread information to the minidump. This includes thread times, which can be displayed by using the !runaway extension or the .ttime (Display Thread Times) command when debugging the minidump.

(Emphasis: links in WinDbg)

The t option is included in the a option as well, so .dump /ma is fine as well.

To find out whether or not your dump has that information, use the undocumented command .dumpdebug like this:

.shell -ci ".dumpdebug" findstr "MiniDump"

If there is a line 

1000 MiniDumpWithThreadInfo

the information is contained and you have a different issue. If it's not there, the time info is not available.

Most other tools I know do not provide such detailed settings, so it's more or less luck, whether this info is included or not.

Thomas Weller
  • 55,411
  • 20
  • 125
  • 222
  • Hi @Thomas, I have tried what you have suggested and I am able to get `1000 MiniDumpWithThreadInfo` in the output. Can you suggest some basic commands to troubleshoot the possible causes for the failure of `!runaway` command. – Ajendra Prasad Aug 31 '17 at 07:07
  • @AjendraPrasad: could you get in contact with me via email and provide the affected crash dump for as, so I can analyze the issue? I never had such a case, so I don't exactly know what to do next. I'll need some time myself first. – Thomas Weller Aug 31 '17 at 09:38
  • 1
    thanks for your cooperation but the dump is provided with the agreement of confidentiality. However, I tried another Microsoft tool to analyze the dump "Download Debug Diagnostic Tool v1.2". It provides me top 5 time consuming threads. Thanks again – Ajendra Prasad Sep 14 '17 at 10:24