procdump: bug when using perf.counter as perf.threshold for when a process has been running at Y% usage for X amount of time
I'm trying to use ProcDump to create a memdump when my process has been using basically 100% of a single core for over an hour.
Here's the problem though; when using the parameter -p
"\Process(processname)\% Processor Time"
value (Performance Counters), the -s
parameter (Threshold seconds) seems to be ignored and it'll just dump the second the Performance Threshold value is exceeded.
I have since realized I can just use the -c
+ -u
parameter, but as this behaves differently than described in the examples on the main page https://learn.microsoft.com/en-us/sysinternals/downloads/procdump , I felt it should be noted.
Note: on my machine, the local language is Swedish so the actual name for the perf-counter is "\process(processname)\% processortid"
in case this is an issue with the fact that Windows uses the local language in the registry instead of translating in the UI-layer
And for the actual commands + output from the tool:
Using -p
PS C:\tools\SYSinternals> .\procdump.exe cpustres64 -p "\Process(cpustres64)\% processortid" 50 -s 30
Process: CPUSTRES64.EXE (8780)
Process image: C:\tools\SYSinternals\CPUSTRES64.EXE
CPU threshold: n/a
Performance counter: \Process(cpustres64)\% processortid
Performance threshold: >= 50
Commit threshold: n/a
Threshold seconds: 30
Hung window check: Disabled
Log debug strings: Disabled
Exception monitor: Disabled
Exception filter: [Includes]
*
[Excludes]
Terminate monitor: Disabled
Cloning type: Disabled
Concurrent limit: n/a
Avoid outage: n/a
Number of dumps: 1
Dump folder: C:\tools\SYSinternals\
Dump filename/mask: PROCESSNAME_YYMMDD_HHMMSS
Queue to WER: Disabled
Kill after dump: Disabled
Press Ctrl-C to end monitoring without terminating the process.
[14:27:08] Counter: 99
[14:27:08] Dump 1 initiated: C:\tools\SYSinternals\CPUSTRES64.EXE_240315_142708.dmp
[14:27:09] Dump 1 complete: 1 MB written in 0.1 seconds
[14:27:09] Dump count reached.
Using -c 50 -u
PS C:\tools\SYSinternals> .\procdump.exe cpustres64 -s 30 -c 50 -u
ProcDump v11.0 - Sysinternals process dump utility
Copyright (C) 2009-2022 Mark Russinovich and Andrew Richards
Sysinternals - www.sysinternals.com
Process: CPUSTRES64.EXE (8780)
Process image: C:\tools\SYSinternals\CPUSTRES64.EXE
CPU threshold: >= 50% of single core
Performance counter: n/a
Commit threshold: n/a
Threshold seconds: 30
Hung window check: Disabled
Log debug strings: Disabled
Exception monitor: Disabled
Exception filter: [Includes]
*
[Excludes]
Terminate monitor: Disabled
Cloning type: Disabled
Concurrent limit: n/a
Avoid outage: n/a
Number of dumps: 1
Dump folder: C:\tools\SYSinternals\
Dump filename/mask: PROCESSNAME_YYMMDD_HHMMSS
Queue to WER: Disabled
Kill after dump: Disabled
Press Ctrl-C to end monitoring without terminating the process.
[14:44:19] CPU: 96% 1s
[14:44:20] CPU: 96% 2s
[14:44:21] CPU: 96% 3s
[14:44:22] CPU: 96% 4s
[14:44:23] CPU: 88% 5s
[14:44:24] CPU: 96% 6s
[14:44:25] CPU: 96% 7s
[14:44:26] CPU: 96% 8s
[14:44:27] CPU: 96% 9s
[14:44:28] CPU: 96% 10s
[14:44:29] CPU: 96% 11s
[14:44:30] CPU: 96% 12s
[14:44:31] CPU: 96% 13s
[14:44:32] CPU: 96% 14s
[14:44:33] CPU: 96% 15s
[14:44:34] CPU: 96% 16s
[14:44:35] CPU: 96% 17s
[14:44:36] CPU: 96% 18s
[14:44:37] CPU: 96% 19s
[14:44:38] CPU: 96% 20s
[14:44:39] CPU: 96% 21s
[14:44:40] CPU: 96% 22s
[14:44:41] CPU: 96% 23s
[14:44:42] CPU: 96% 24s
[14:44:43] CPU: 96% 25s
[14:44:44] CPU: 96% 26s
[14:44:45] CPU: 96% 27s
[14:44:46] CPU: 96% 28s
[14:44:47] CPU: 96% 29s
[14:44:49] CPU: 96% 30s (Trigger)
[14:44:49] Dump 1 initiated: C:\tools\SYSinternals\CPUSTRES64.EXE_240315_144449.dmp
[14:44:49] Dump 1 complete: 1 MB written in 0.1 seconds
[14:44:49] Dump count reached.