Taking a memory dump of a w3wp process

Taking a memory dump of a w3wp process

Taking a memory dump of an IIS worker process in a live system can be problematic, as IIS will kill the process if it has been suspended for more than 60 seconds.

Only use these steps if your application is on a high availability cluster, else you’ll take your app down!

  1. copy sysinternals procdump.exe and pssuspend.exe to target machine
  2. create powershell file with:
  $iispid = Get-Process svchost | ?{$_.modules.ModuleName -eq "iisw3adm.dll"} | Select -First 1 -ExpandProperty Id
  $workerpid = Get-Process w3wp | Sort ws -Descending | Select -First 1 -ExpandProperty Id
  & ".\pssuspend.exe" $iispid 
  Write-Output "Creating memory dump for w3wp PID $workerpid"
  & ".\procdump.exe" -ma $workerpid
  & ".\pssuspend.exe" $iispid -r

(taken from stackoverflow)
3) check the w3wp process has reached the high level of RAM usage that you’re intending to analyse
4) drain and remove the target app node from the HA cluster to avoid live requests hitting this service
5) run script from an admin powershell console
6) Run an iisreset
7) add the app node back into the HA cluster
8) zip dump file and bring it to your machine
9) unzip
10) open with DebugDiag or Visual Studio

Caveats:

  • You must match process bitage everywhere. Is the IIS worker process 32 or 64 bit? procdump vs procdump64?
  • If your target application was built with .netFramework 3.5 or lower good luck getting anything useful from it, because I couldn’t figure out how (grumble)

Popular posts from this blog

sp_blitzIndex

GitLab Badges