Creating Process Dumps with ProcDump


Introduction

ProcDump (procdump.exe), a Windows Sysinternals tool. It allows you to create dumps of the processes in any scenario that may arise while troubleshooting issues

When Procdump captures the dump file, it does not kill the running process.


Solution

To create a dump with ProcDump, do the following:

  1. Download ProcDump from Windows Sysinternals site;
  2. Create a folder where dumps will be stored (e.g. C:\Dumps\);
  3. Unzip the archive and put the procdump.exe in to the created directory;
  4. Open Windows command-line: Hit Start -> Run and type in cmd;
  5. In CMD, switch to the newly created folder using the cd command:

cd <path_to_folder>

For example: cd C:\Dumps

 

Depending on the nature of the issue (immediate process crash, hanging process, lock-up etc.) choose what options are to be used with ProcDump. See the most common examples below:


A. Situations when processes are crashing (e.g. right upon starting, or they crash randomly) can be universally handled by the following command:

procdump -e -w -ma <process_name>

E.g. if you have service_process.exe crashing, the command will look like:

procdump -e -w -ma service_process.exe

=> this will execute ProcDump to monitor for the process to start (if it's not running yet) and create a full process memory dump as soon as it encounters unhandled exception and crashes.


B. If you need to create a dump file of the running process in its current state (e.g. if there is a suspicion the process hangs or it is necessary to understand why the service uses a lot of resources, etc.), then the command is even simpler:

procdump -ma <process_name>

or using PID (useful if multiple processes with the same name are running):

procdump -ma <process_PID> (where process_PID is the process identifier)


E.g. in case mms.exe seems to be hanging, the following command can be used:

procdump -ma mms.exe

or

procdump -ma 3255 (if 3255 is the process identifier)


The full list of the parameters can be found in on the ProcDump download page or by issuing command procdump /? ;

 

Once the necessary dumps are created, you can locate them in the same folder where ProcDump resides (e.g. C:\Dumps\).

 

Also check the Process Explorer tool which can be useful for dumps creation:

http://technet.microsoft.com/en-en/sysinternals/bb896653.aspx

This tool detects which dump (32/64 Bit) should be created automatically.