Windows sysinternals

234 Part II Usage Guide
and results in a 1.5-GB dump file that takes two minutes to compress and about 15 minutes
to upload.
Although originally designed for Exchange, the algorithm is generic and works as well on
Microsoft SQL Server or any other native application that allocates large memory regions.
This is because the algorithm uses heuristics to determine what data is to be included.
A Miniplus dump starts by creating a minidump and adds (“plus”) memory deemed
important. The first step is to consider only pages marked as read/write. This excludes the
majority of the image pages but still retains the image pages associated with global variables.
The next step is to find the largest read/write memory area larger than 512 MB. If found, the
memory area is provisionally excluded. A memory area is the collection of same-sized memory
allocations. For example, if there are twenty 64-MB regions (1280 MB total), and five
128-MB regions (640 MB total), the 64-MB regions will be excluded because they use more
memory than the 128-MB regions even though the size of the allocations is not the largest.
These excluded regions have a second chance to be included. They are divided into 4-MB
chunks, and if referenced by any thread stack, the referenced 4-MB chunk is included.
Even if the process isn’t overly large, Miniplus dumps are still considerably smaller than full
dumps because they do not contain the process’ executable image. For example, a full dump
of Notepad is approximately 50 MB, but a Notepad Miniplus dump is only about 2 MB. And
a full dump of Microsoft Word is typically around 280 MB, but a Miniplus dump of the same
process is only about 36 MB. When the process isn’t overly large, you can get an approximate
size of the dump by viewing the Total/Private value in VMMap.
Note When debugging Miniplus dumps, the debugger needs to substitute in the omitted
image pages from a symbol store (.sympath) or executable store (.exepath). If you are capturing
Miniplus dumps of your application, you need to maintain both a symbol and executable store
that contains each build of your application.
An additional benefit of the Miniplus implementation is its ability to recover from memory
read failures. A memory read failure is the reason why various dump utilities sometimes fail
to capture a full dump. If you run across this issue when capturing a full dump, try using
Miniplus instead to activate this recovery logic.
The Miniplus dump option can be combined with other ProcDump options as the following
examples demonstrate. To capture a single Miniplus dump of store.exe, use the following
command line:
procdump -mp store.exe
Use the following command to capture a single Miniplus dump when store.exe crashes:
procdump -mp -e store.exe
www.it-ebooks.info