Frequently Asked Questions
Frequently Asked Questions
Collecting crash dumps with registry settings
Posted by Rami Taipale (M-Files) on 18 March 2019 02:29 PM

Starting with Windows Server 2008 and Windows Vista with Service Pack 1 (SP1), Windows Error Reporting (WER) can be configured so that full user-mode dumps are collected and stored locally after a user-mode application crashes. Applications that do their own custom crash reporting, including .NET applications, are not supported by this feature. This feature is not enabled by default and enabling the feature requires administrator privileges. You can also create a dump file with Task Manager, but it should not be used in a crash situation.

The dump files include the entire memory space of a process, the program's executable image itself, the handle table, and other information that will be useful to the debugger. These dump files are pretty similar with the ones that ProcDump creates. ProcDump is more flexible and it's parameters can be configured, but you must know the exact process name when using that. This article's registry settings catch every crashing application excluding applications that do their own custom crash reporting.

More information about collecting User-Mode dumps can be found from here:

https://docs.microsoft.com/en-us/windows/desktop/wer/collecting-user-mode-dumps

Works in:

  • Client: Windows Vista SP1 and higher.
  • Server: Windows Server 2008 and higher.

Usage:

  1. Download LocalFullMemoryDumps.zip from here:  LocalFullMemoryDumps.zip
  2. Extract both EnableLocalFullMemoryDumps.reg and DisableLocalFullMemoryDumps.reg files from LocalFullMemoryDumps.zip file to e.g. Desktop (do NOT run .reg directly from the zip file)
  3. Enable EnableLocalFullMemoryDumps.reg by double-clicking it and confirming the registry changes
  4. Registry change enables up to 30 most recent Application Memory Dumps to be available in folder C:\CrashDumps. This happens after application crashes without further user interaction
  5. The dump file size could be quite large and you should get separate instructions on how to deliver it to the M-Files Technical Support
  6. When those crash dumps aren't needed anymore, please disable them by double-clicking DisableLocalFullMemoryDumps.reg (extracted in part 1.) and confirm the registry changes
  7. Delete the dump files from C:\CrashDumps when they are no longer needed to free up hard drive space

Example:

When you have extracted those registry files (.reg) and you enable EnableLocalFullMemoryDumps.reg by double-clicking it and confirming the registry changes, your registry should look like this

 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps

Local Dumps



Attachments 
 
(1 vote(s))
This article was helpful
This article was not helpful

Help Desk Software by Kayako case