0

I have been trying to get a w3wp crash dump to see the crash callstack. I got two dumps but both of them have a single thread in them - seems almost like AppDomain has been recycled already and there is nothing useful left in the process when the dump was saved.

Command used: "procdump -mm -e -n 1 -l pt <PID>"

Also tried -ma for full dump but result is the same:

0:000> ~
.  0  Id: fa4.1dc8 Suspend: -1 Teb: 000000b1`77a78000 Unfrozen

I am not sure if I am missing something in the command, or IIS does not provide usable managed dumps when capturing them with procdump - any inputs are highly appreciated!

Additional detail: I was seeing STACK_OVERFLOW exception being logged by the procdump, which - apparently needs different method to capture useful dump. See my own answer below for details.

It only took few hours - hopefully this will save some time for others like me.

Bobby
  • 251
  • 1
  • 8
  • The Microsoft KB article has been removed, but you can find an archive version, https://mskb.pkisolutions.com/kb/919789 – Lex Li Apr 02 '21 at 15:40

1 Answers1

1

Found a way to do this:

procdump -mm -e 1 -l -f C00000FD.STACK_OVERFLOW -g <PID>

It works! Thanks to the unknown fellow member whose hint lead me to this. I was reading too many pages and missed saving the page link to post acknowledgement here.

Bobby
  • 251
  • 1
  • 8