2

I've used Windbg only for the most simple !analyze -v in the past. Now I've got a bit of a problem... Some process is running wild and consumes all available memory (I can see it spike in monitoring sw), but I've not been able to get eyes on when it happens and I for all my googly powers I can't find a way to list processes and memory usage. I do realize this might not be exactly the use case for windbg, but is it possible to get this information from Windbg or some other script or application?

  • You mean like Process Explorer? – TheCleaner Oct 27 '14 at 13:44
  • @TheCleaner: This is after the fact analysis on a dump file, so I can't use procexp as the server has already BSOD'ed and restarted, leaving only a cryptic minidump for me. – Gomibushi Oct 27 '14 at 14:03
  • Ah, sorry. I didn't read the tags. But Process Explorer could be setup for logging to a file and then you can read that file after a crash reboot to gather details as well. Process Monitor can do the same. – TheCleaner Oct 27 '14 at 14:06
2

You're right - this is not the primary use case for Windbg or kd.exe, but in the interest of just answering your question, you want the !vm command.

If you have kd.exe you can operate on memory dumps. If you download livekd.exe from Microsoft Sysinternals, it wraps kd.exe and allows you to operate on live memory.

vm

Just to add more value to this answer, another great tool you might want to check out is ProcDump, also from Sysinternals. Procdump can be configured to take a memory dump automatically when specific conditions are met, such as when the free system memory falls below a certain point, or when a specific process exceeds a certain threshold of memory or CPU usage, etc.

| improve this answer | |
  • Thanks! That is pretty a pretty good answer, but I don't think the minidump contains this info. I do get kd> promt on the file, but I don't get anything like that info in !vm. That might be because it end the output with "ProcessCommitUsage could not be calculated". I'll look into procdump also. – Gomibushi Oct 27 '14 at 14:44
  • If the minidump doesn't contain that data, then you will have to configure more complete crash dumps through System Properties > Advanced tab... or use livekd to analyze the system while it's live. Don't forget that you need a large page file (larger than the amount of system RAM) to accommodate full crash dumps. – Ryan Ries Oct 27 '14 at 15:06
  • Also, don't forget to configure symbols first. Windbg/kd is pretty useless without configuring your debugging symbols. – Ryan Ries Oct 27 '14 at 15:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.