procdump: bug when using perf.counter as perf.threshold for when a process has been running at Y% usage for X amount of time

Patrik Mattsson 0 Reputation points
2024-03-15T13:36:39.0766667+00:00

I'm trying to use ProcDump to create a memdump when my process has been using basically 100% of a single core for over an hour.

Here's the problem though; when using the parameter -p "\Process(processname)\% Processor Time" value (Performance Counters), the -s parameter (Threshold seconds) seems to be ignored and it'll just dump the second the Performance Threshold value is exceeded.

I have since realized I can just use the -c + -u parameter, but as this behaves differently than described in the examples on the main page https://learn.microsoft.com/en-us/sysinternals/downloads/procdump , I felt it should be noted.

Note: on my machine, the local language is Swedish so the actual name for the perf-counter is "\process(processname)\% processortid" in case this is an issue with the fact that Windows uses the local language in the registry instead of translating in the UI-layer

And for the actual commands + output from the tool:

Using -p

PS C:\tools\SYSinternals> .\procdump.exe cpustres64 -p "\Process(cpustres64)\% processortid" 50 -s 30

Process:               CPUSTRES64.EXE (8780)
Process image:         C:\tools\SYSinternals\CPUSTRES64.EXE
CPU threshold:         n/a
Performance counter:   \Process(cpustres64)\% processortid
Performance threshold: >= 50
Commit threshold:      n/a
Threshold seconds:     30
Hung window check:     Disabled
Log debug strings:     Disabled
Exception monitor:     Disabled
Exception filter:      [Includes]
                       *
                       [Excludes]
Terminate monitor:     Disabled
Cloning type:          Disabled
Concurrent limit:      n/a
Avoid outage:          n/a
Number of dumps:       1
Dump folder:           C:\tools\SYSinternals\
Dump filename/mask:    PROCESSNAME_YYMMDD_HHMMSS
Queue to WER:          Disabled
Kill after dump:       Disabled


Press Ctrl-C to end monitoring without terminating the process.

[14:27:08] Counter:       99
[14:27:08] Dump 1 initiated: C:\tools\SYSinternals\CPUSTRES64.EXE_240315_142708.dmp
[14:27:09] Dump 1 complete: 1 MB written in 0.1 seconds
[14:27:09] Dump count reached.

Using -c 50 -u

PS C:\tools\SYSinternals> .\procdump.exe cpustres64 -s 30 -c 50 -u

ProcDump v11.0 - Sysinternals process dump utility
Copyright (C) 2009-2022 Mark Russinovich and Andrew Richards
Sysinternals - www.sysinternals.com

Process:               CPUSTRES64.EXE (8780)
Process image:         C:\tools\SYSinternals\CPUSTRES64.EXE
CPU threshold:         >= 50% of single core
Performance counter:   n/a
Commit threshold:      n/a
Threshold seconds:     30
Hung window check:     Disabled
Log debug strings:     Disabled
Exception monitor:     Disabled
Exception filter:      [Includes]
                       *
                       [Excludes]
Terminate monitor:     Disabled
Cloning type:          Disabled
Concurrent limit:      n/a
Avoid outage:          n/a
Number of dumps:       1
Dump folder:           C:\tools\SYSinternals\
Dump filename/mask:    PROCESSNAME_YYMMDD_HHMMSS
Queue to WER:          Disabled
Kill after dump:       Disabled


Press Ctrl-C to end monitoring without terminating the process.

[14:44:19] CPU: 96% 1s
[14:44:20] CPU: 96% 2s
[14:44:21] CPU: 96% 3s
[14:44:22] CPU: 96% 4s
[14:44:23] CPU: 88% 5s
[14:44:24] CPU: 96% 6s
[14:44:25] CPU: 96% 7s
[14:44:26] CPU: 96% 8s
[14:44:27] CPU: 96% 9s
[14:44:28] CPU: 96% 10s
[14:44:29] CPU: 96% 11s
[14:44:30] CPU: 96% 12s
[14:44:31] CPU: 96% 13s
[14:44:32] CPU: 96% 14s
[14:44:33] CPU: 96% 15s
[14:44:34] CPU: 96% 16s
[14:44:35] CPU: 96% 17s
[14:44:36] CPU: 96% 18s
[14:44:37] CPU: 96% 19s
[14:44:38] CPU: 96% 20s
[14:44:39] CPU: 96% 21s
[14:44:40] CPU: 96% 22s
[14:44:41] CPU: 96% 23s
[14:44:42] CPU: 96% 24s
[14:44:43] CPU: 96% 25s
[14:44:44] CPU: 96% 26s
[14:44:45] CPU: 96% 27s
[14:44:46] CPU: 96% 28s
[14:44:47] CPU: 96% 29s
[14:44:49] CPU: 96% 30s (Trigger)
[14:44:49] Dump 1 initiated: C:\tools\SYSinternals\CPUSTRES64.EXE_240315_144449.dmp
[14:44:49] Dump 1 complete: 1 MB written in 0.1 seconds
[14:44:49] Dump count reached.
Sysinternals
Sysinternals
Advanced system utilities to manage, troubleshoot, and diagnose Windows and Linux systems and applications.
1,169 questions
0 comments No comments
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.