How to collect a memory dump in Windows

How to collect a memory dump in Windows


Sometimes for the troubleshooting of a particular support case we might ask you to collect a memory dump of a Windows process for analysis. This is usually for ServiceStudio.exe or w3wp (IIS Worker process), but can also be used for OutSystems Services, for instance.

How to obtain the dump:

  1. Get Microsoft's procdump tool from here.
  2. In a command line, run the command procdump -ma <Process> (on your first run of this tool, you might need to use the -accepteula switch as well)

<Process> can be either the executable name (for example, ServiceStudio.exe) or the PID of the process. You'll need to check Task Manager for the PID ( check this article, if the column is not showing ).

For a w3wp process you'll need to identify the PID of the w3wp running the eSpace that needs to be analysed. You can identify the application pool which the w3wp is serving by the username in task manager ( the OutsystemsApplications application pool will be running under a user named OutsystemsApplications ).

For the analysis of the process we'll usually need the 
mscordacwks files you can find at:
  1. C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll

  2. C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscordacwks.dll

If you are using Platform 9 and above, please provide the following libraries instead:
  1. C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscordacwks.dll

  2. C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscordacwks.dll

If you're not sure whether the process is running in 32 or 64 bit, just give us both and we'll select the correct one.

If the problem being analysed is an OutOfMemory error, we also need the following information for a more accurate analysis:

  1. submit the crash via submit feedback dialog (if you already have an open support case, mention it in the description, so it can be properly classified and associated)
  2. Let us know how many eSpaces were opened at the time
  3. Send us the oml files for the eSpaces that were opened
  4. Let us know what action you were performing at the time of the crash ( merge, 1CP, etc )

Best regards,
Ricardo Silva
Hi Ricardo and thank you for the information. I just have a doubt on this.

Image a scenario where I have a IIS worker process that occasionally crashes and so far I was not able to identify the crash conditions and therefore could not collect the dump files.

Is there a way of waiting for a WP crash and in that case collect the memory dump.

I've looked into the procdump usage and I realized there a switch that should do that:
  • -e                Write a dump when the process encounters an unhandled exception. Include the 1 to create dump on first chance exceptions.
What's you experience on similar needs? Does procdump fulfill this requirement?


Carlos Sousa
using procdump is relatively new for us. Usually for those use-cases we suggested the procedures outlined in this thread (basically, use debug diag to selectively catch the exception).

From the description, procdump with that particular switch should be able to fulfill this requirement.
thanks Ricardo