Collecting User-Mode Dumps

短命女 2022-05-28 01:52 106阅读 0赞

Starting with Windows Server 2008 and Windows Vista with Service Pack 1 (SP1), Windows Error Reporting (WER) can be configured so that full user-mode dumps are collected and stored locally after a user-mode application crashes. Applications that do their own custom crash reporting, including .NET applications, are not supported by this feature.

This feature is not enabled by default. Enabling the feature requires administrator privileges. To enable and configure the feature, use the following registry values under the **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalDumps** key.

<table style="margin-bottom:20px;margin-top:20px;border:1px solid rgb(187,187,187);"> 
 <tbody> 
  <tr> 
   <th style="padding-top:10px;padding-bottom:10px;background-color:inherit;color:rgb(99,99,99);border-color:rgb(187,187,187);">Value</th> 
   <th style="padding-top:10px;padding-bottom:10px;background-color:inherit;color:rgb(99,99,99);border-color:rgb(187,187,187);">Description</th> 
   <th style="padding-top:10px;padding-bottom:10px;background-color:inherit;color:rgb(99,99,99);border-color:rgb(187,187,187);">Type</th> 
   <th style="padding-top:10px;padding-bottom:10px;background-color:inherit;color:rgb(99,99,99);border-color:rgb(187,187,187);">Default value</th> 
  </tr> 
  <tr> 
   <td style="padding-top:10px;padding-bottom:10px;color:rgb(42,42,42);vertical-align:top;min-width:80px;border-color:rgb(187,187,187);"><strong>DumpFolder</strong></td> 
   <td style="padding-top:10px;padding-bottom:10px;color:rgb(42,42,42);vertical-align:top;min-width:80px;border-color:rgb(187,187,187);">The path where the dump files are to be stored. If you do not use the default path, then make sure that the folder contains ACLs that allow the crashing process to write data to the folder.<p style="color:rgb(69,69,69);line-height:1.429em;">For service crashes, the dump is written to service specific profile folders depending on the service account used. For example, the profile folder for System services is %WINDIR%\System32\Config\SystemProfile. For Network and Local Services, the folder is %WINDIR%\ServiceProfiles.</p></td> 
   <td style="padding-top:10px;padding-bottom:10px;color:rgb(42,42,42);vertical-align:top;min-width:80px;border-color:rgb(187,187,187);">REG_EXPAND_SZ</td> 
   <td style="padding-top:10px;padding-bottom:10px;color:rgb(42,42,42);vertical-align:top;min-width:80px;border-color:rgb(187,187,187);">%LOCALAPPDATA%\CrashDumps</td> 
  </tr> 
  <tr> 
   <td style="padding-top:10px;padding-bottom:10px;color:rgb(42,42,42);vertical-align:top;min-width:80px;border-color:rgb(187,187,187);"><strong>DumpCount</strong></td> 
   <td style="padding-top:10px;padding-bottom:10px;color:rgb(42,42,42);vertical-align:top;min-width:80px;border-color:rgb(187,187,187);">The maximum number of dump files in the folder. When the maximum value is exceeded, the oldest dump file in the folder will be replaced with the new dump file.</td> 
   <td style="padding-top:10px;padding-bottom:10px;color:rgb(42,42,42);vertical-align:top;min-width:80px;border-color:rgb(187,187,187);">REG_DWORD</td> 
   <td style="padding-top:10px;padding-bottom:10px;color:rgb(42,42,42);vertical-align:top;min-width:80px;border-color:rgb(187,187,187);">10</td> 
  </tr> 
  <tr> 
   <td style="padding-top:10px;padding-bottom:10px;color:rgb(42,42,42);vertical-align:top;min-width:80px;border-color:rgb(187,187,187);"><strong>DumpType</strong></td> 
   <td style="padding-top:10px;padding-bottom:10px;color:rgb(42,42,42);vertical-align:top;min-width:80px;border-color:rgb(187,187,187);">Specify one of the following dump types: 
    <ul style="margin-top:5px;margin-bottom:20px;padding-left:1px;list-style-position:inside;"> 
     <li>0: Custom dump</li> 
     <li>1: Mini dump</li> 
     <li>2: Full dump</li> 
    </ul></td> 
   <td style="padding-top:10px;padding-bottom:10px;color:rgb(42,42,42);vertical-align:top;min-width:80px;border-color:rgb(187,187,187);">REG_DWORD</td> 
   <td style="padding-top:10px;padding-bottom:10px;color:rgb(42,42,42);vertical-align:top;min-width:80px;border-color:rgb(187,187,187);">1</td> 
  </tr> 
  <tr> 
   <td style="padding-top:10px;padding-bottom:10px;color:rgb(42,42,42);vertical-align:top;min-width:80px;border-color:rgb(187,187,187);"><strong>CustomDumpFlags</strong></td> 
   <td style="padding-top:10px;padding-bottom:10px;color:rgb(42,42,42);vertical-align:top;min-width:80px;border-color:rgb(187,187,187);"><p style="color:rgb(69,69,69);padding-bottom:15px;line-height:1.429em;">The custom dump options to be used. This value is used only when&nbsp;<strong>DumpType</strong>&nbsp;is set to 0.</p><p style="color:rgb(69,69,69);line-height:1.429em;">The options are a bitwise combination of the&nbsp;<a href="https://msdn.microsoft.com/en-us/library/windows/desktop/ms680519.aspx" style="font-family:'Segoe UI Semibold', 'Segoe UI', 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif;font-size:1em;line-height:1.429em;color:rgb(0,24,143);" rel="nofollow"><strong>MINIDUMP_TYPE</strong></a>&nbsp;enumeration values.</p></td> 
   <td style="padding-top:10px;padding-bottom:10px;color:rgb(42,42,42);vertical-align:top;min-width:80px;border-color:rgb(187,187,187);">REG_DWORD</td> 
   <td style="padding-top:10px;padding-bottom:10px;color:rgb(42,42,42);vertical-align:top;min-width:80px;border-color:rgb(187,187,187);"><code>MiniDumpWithDataSegs | MiniDumpWithUnloadedModules | MiniDumpWithProcessThreadData.</code></td> 
  </tr> 
 </tbody> 
</table>

These registry values represent the global settings. You can also provide per-application settings that override the global settings. To create a per-application setting, create a new key for your application under **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\LocalDumps** (for example, **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\LocalDumps\\MyApplication.exe**). Add your dump settings under the **MyApplication.exe** key. If your application crashes, WER will first read the global settings, and then will override any of the settings with your application-specific settings.

After an application crashes and prior to its termination, the system will check the registry settings to determine whether a local dump is to be collected. After the dump collection has completed, the application will be allowed to terminate normally. If the application supports recovery, the local dump is collected before the recovery callback is called.

These dumps are configured and controlled independently of the rest of the WER infrastructure. You can make use of the local dump collection even if WER is disabled or if the user cancels WER reporting. The local dump can be different than the dump sent to Microsoft.