Dumping the crash dumps

Question

I need to write a tool, that listens for some target process(which crashes in customer environment) and as soon as it crashes it should generate a dump by launching DebugDiag passing it the command line parameters. The code needs to be written in C#. I have already done some coding but the tool never detects the process launched. Here is the code:

static void Main(string[] args)
{
    ManagementEventWatcher startWatch = new ManagementEventWatcher(
     new WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace"));
    startWatch.EventArrived
                        += new EventArrivedEventHandler(startWatch_EventArrived);
    startWatch.Start();

    Console.WriteLine("Press ENTER to exit");
    Console.ReadLine();
    startWatch.Stop();

}


    static void startWatch_EventArrived(object sender, EventArrivedEventArgs e)
    {
        string name = e.NewEvent.Properties["ProcessName"].Value as string;
        Console.WriteLine("Process started: {0}", name);
        if (name != null && name.Contains("My Process.exe"))
        {
            string procpath = "C:\\Program Files\\DebugDiag";
            string filename = Path.Combine(procpath, "DbgHost.exe");
            var proc = System.Diagnostics.Process.Start(filename, "-dump My Process.exe");
        }
    }

Please also advise if this is the way to pass command line parameters to DebugDiag @Bruno, i implemented your suggestion using ProcDump. Now it works once, which means when i launch my target process(32 bit) ProcDump also launches, however my application is such that when i launch a workspace within, it launches another process with the same name and this time ProcDump failed to lauch, upon debugging i found that it threw an exception saying 32-bit process cannot debug 64-bit process and all my target processes are 32-bit only... Code:

static void startWatch_EventArrived(object sender, EventArrivedEventArgs e)
{
    string name = e.NewEvent.Properties["ProcessName"].Value as string;
    Console.WriteLine("Process started: {0}", name);
    if (name != null && name.Contains("MyProcess.exe"))
    {
        string procpath = "C:\\Procdump";
        string filename = Path.Combine(procpath, "procdump.exe");
        var proc = System.Diagnostics.Process.Start(filename, "-e -f -mp -n 25 -w -accepteula MyProcess.exe MyProcess_crash");
    }
}

Windows and DebugDiag have built in support for this () - why reinvent the wheel? — Polyfun, Dec 13 '16 at 12:16
I know there is a built-in support. However i cannot expect my customers to do the configuration. Instead they should be able to launch a simple .exe(i.e. my code) and do the needful. That was not the exact reason to downgrade my query. I did not intent to reinvent any wheel. — Sandeep, Dec 15 '16 at 10:59

score 3 · Answer 1 · answered Dec 13 '16 at 14:02

3

Use Procdump.exe. It is a complete tool developed by sysinternals that produces dump, minidump and so on. It is callable by command line See https://technet.microsoft.com/en-us/sysinternals/dd996900.aspx

answered Dec 13 '16 at 14:02

Bruno Parrotta

29
4

Dumping the crash dumps

1 Answers1