Collecting Simple Crash Dumps of IIS 7.0’s W3WP.exe’s with WER
Getting dumps of crashing w3wp.exe process is really easy in Win2008/IIS7.
Just create a registry key and let it crash! Windows Error Reporting should take care of the rest.
The following text may be saved into notepad and renamed to w3wpcrashdumps-to-C.reg:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\w3wp.exe]
"DumpFolder"=hex(2):63,00,3a,00,5c,00,64,00,75,00,6d,00,70,00,73,00,00,00
"DumpCount"=dword:00000002
"DumpType"=dword:00000002
This will make a total of 2 full user dumps (not mini-dumps) and write the dumps to C:\dumps.
In the registry it will look like this:
To send the dumps to the D:\ drive, the following text may be saved into notepad and renamed to w3wpcrashdumps-to-D.reg:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\w3wp.exe]
"DumpFolder"=hex(2):64,00,3a,00,5c,00,64,00,75,00,6d,00,70,00,73,00,00,00
"DumpCount"=dword:00000002
"DumpType"=dword:00000002
In the registry it will look like this:
As long as this key is there, expect dumps to be written every time any w3wp.exe crashes. So when you’ve collected enough dumps, don’t forget to either delete the w3wp.exe key or at least adjust it.
References:
· http://msdn.microsoft.com/en-us/library/bb787181.aspx
You can also get crash dumps with DebugDiag 1.2. High recommendations for this tool!
Explanation: DebugDiag 1.1 didn’t work on Windows 2008. So I often used WER instead. But now that DebugDiag 1.2 has been released, I’d probably go with it. It has more flexibility.
To be academic about it, you can also use adplus.vbs –hang –p {pid number} command with the Debugging Tools for Windows (either 32bit or 64bit versions).
---------------Adplus nuance-------------
The –iis switch doesn’t work for IIS7 like it did in IIS4, 5, and 6.
D:\Program Files\Debugging Tools for Windows (x64)>cscript.exe adplus.vbs –crash -iis -quiet
*** ERROR ***
You appear to have IIS Version 7.0 installed. This has not been tested with the '-iis' switch. Please run ADPlus again, without the '-iis' switch.
You might want to focus on the pid number…
D:\Program Files\Debugging Tools for Windows (x64)>adplus.vbs -crash hang -p 4848 -quiet