转储文件分析

本文介绍了转储文件分析的处理方法，对大家解决问题具有一定的参考价值，需要的朋友们下面随着小编来一起学习吧！ 问题描述

最近，我开始在少数服务器上面临问题，其中CPU开始消耗比平常趋势更多的资源。我试图找出这个的根本原因并从任务管理器中获取w3wp进程的转储（右键单击进程并进行转储）。 现在dmp文件大小为14GB，我试图通过WinDBG进行分析，但该工具无法正常工作并收到消息： $

我也拿了一些小型泵，但其中一些很小，但很少不是这样，它与32位或64位之间的混淆无关。（收集的转储是64位）。 我想知道造成这个问题的原因。是文件大小还是我没有正确地进行转储。 我检查了

并按开始。捕获1-2分钟的高CPU使用率，然后单击保存。

和

展开w3wp进程的堆栈以查看它正在执行的操作。从名称中你应该知道会发生什么。

Recently I start facing issue on few servers where CPU start consuming more resources than usual trend. I am trying to find out the root cause for this and took the dump of w3wp process from Task Manager(right click on process and took the dump). Now the dmp file size is 14GB and I am trying to analyze it through WinDBG but the tool is not working and getting message:

I also took few minidumps but some of them opening fine while few are not so it's not related to confusion between 32bit or 64bit.(The collected dump is 64bit). I am trying to know what causing this issue. Is it file size or I am not taking the dump properly. I checked link but it's not helpful.

解决方案

Windbg is not the right tool for this job. Dumps are only snapshots so you have no idea what happened before. Use ETW and here the CPU Sampling, which sums all calls and shows you in detail the CPU usage.

Install the Windows Performance Toolkit which is part of the Windows 10 SDK (V1607 works on Win8/8.1(Server2012/R2) and Win10 or the V1511 SDK if you use Windows 7/Server2008R2)), run WPRUi.exe and select CPU Usage

and press on Start. Capture 1-2 minutes of the high CPU usage and next click on Save. Open the generated ETL with WPA.exe (Perf analyzer), drag and drop the CPU Usage (Sampled) graph to the analysys pane

and load the Debug Symbols. Now select your process in the graph, zoom in and expand the stack, here you see the weight of the CPU usage of all calls

In this sample most CPU usage from Internet Explorer comes from HTML stuff.

For .NET applications WPA shows you related groupings like GC or JIT:

Expand the stack of the w3wp process to see what it is doing. From the names you should have a clue what happens.