3

I've used Windbg only for the most simple !analyze -v in the past. Now I've got a bit of a problem... Some process is running wild and consumes all available memory (I can see it spike in monitoring sw), but I've not been able to get eyes on when it happens and I for all my googly powers I can't find a way to list processes and memory usage. I do realize this might not be exactly the use case for windbg, but is it possible to get this information from Windbg or some other script or application?

3
  • You mean like Process Explorer?
    – TheCleaner
    Oct 27, 2014 at 13:44
  • @TheCleaner: This is after the fact analysis on a dump file, so I can't use procexp as the server has already BSOD'ed and restarted, leaving only a cryptic minidump for me.
    – Gomibushi
    Oct 27, 2014 at 14:03
  • Ah, sorry. I didn't read the tags. But Process Explorer could be setup for logging to a file and then you can read that file after a crash reboot to gather details as well. Process Monitor can do the same.
    – TheCleaner
    Oct 27, 2014 at 14:06

1 Answer 1

2

You're right - this is not the primary use case for Windbg or kd.exe, but in the interest of just answering your question, you want the !vm command.

If you have kd.exe you can operate on memory dumps. If you download livekd.exe from Microsoft Sysinternals, it wraps kd.exe and allows you to operate on live memory.

vm

Just to add more value to this answer, another great tool you might want to check out is ProcDump, also from Sysinternals. Procdump can be configured to take a memory dump automatically when specific conditions are met, such as when the free system memory falls below a certain point, or when a specific process exceeds a certain threshold of memory or CPU usage, etc.

3
  • Thanks! That is pretty a pretty good answer, but I don't think the minidump contains this info. I do get kd> promt on the file, but I don't get anything like that info in !vm. That might be because it end the output with "ProcessCommitUsage could not be calculated". I'll look into procdump also.
    – Gomibushi
    Oct 27, 2014 at 14:44
  • If the minidump doesn't contain that data, then you will have to configure more complete crash dumps through System Properties > Advanced tab... or use livekd to analyze the system while it's live. Don't forget that you need a large page file (larger than the amount of system RAM) to accommodate full crash dumps.
    – Ryan Ries
    Oct 27, 2014 at 15:06
  • Also, don't forget to configure symbols first. Windbg/kd is pretty useless without configuring your debugging symbols.
    – Ryan Ries
    Oct 27, 2014 at 15:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .