Collect a process dump with the ProcDump utility

When working with SolarWinds Support to troubleshoot an issue, you may be asked to collect a process dump, also called a "memory" or "crash" dump. This article describes how to use a Microsoft command-line utility called ProcDump to monitor an application for CPU spikes, hung windows, exceptions, and more. 

After running ProcDump, you can use SolarWinds Serv-U FTP and MFT file transfer software to upload diagnostics, as directed by Support staff. The Support team will analyze the data to determine why an application, process, or service crashed; they may also share it with other SolarWinds teams, including Engineering, investigating your issue. 

This article describes how to use ProcDump on Windows systems, available for download here. A Linux version is also available.

For an alternative method, see Capture a memory dump with Debug Tools.

1. Download and install ProcDump.
2. In Windows Task Manager, identify the affected process ID (PID) or process name you are collecting data for. PIDs appear on the Details tab.
3. Open a command prompt and navigate to the folder where you installed ProcDump. 
4. Use one of the following formats to enter a command. Various options are described below.

   procdump -MA -E PID

   or

   procdump -MA -E PROCESSNAME

        

    

   
   Note: If you run the command without -E, the utility will collect the current process dump without waiting for the process or service to crash. This command will create a process dump for the named process when it crashes. Results will be stored in the folder where you installed the ProcDump utility.

Example Usage

procdump -ma -e 2789      (which is the PID of Syslog Service)
procdump -ma -e SolarWinds.InformationService.ServiceV3.exe
procdump -ma -m 8100 SolarWinds.BusinessLayerHost.exe

Auto Capture

procdump -ma -i

Turn off Procdump

procdump -u (stop collecting dumps)

Delete the value from Debugger under

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug

Memory leak

You can follow these steps to gather diagnostics about a memory leak by running ProcDump on a server that hosts an Orion Platform polling engine. Using the below command, you will capture a memory dump from SolarWinds.InformationService.ServiceV3.exe (SWIS v3) process at the 6 GB mark and another at 10 GB for comparison purposes (recommended by our Engineering Team).

1. Log into the polling engine as an administrator.
2. Install ProcDump.
3. Open two command prompts, running both as an administrator.
   1. On the first command prompt, run the following command:

      procdump.exe -ma -m 6000 SolarWinds.InformationService.ServiceV3.exe

   2. On the second command prompt, run the following command:

      procdump.exe -ma -m 10000 SolarWinds.InformationService.ServiceV3.exe

For an alternative method, see Capture a memory dump with Debug Tools.