Carmelo Pulvirenti's Blog

System.BadImageFormatException: Bad IL Range – what it is going on!

2013-06-13T06:47:00Z

Dear friends, today I want to share with you an important error that you should always take care about: System.BadImageFormatException. Please, please please take care of this exception, especially on scenarios where you think that it is not part of the problem . As usual, a very short background that can give you an idea of how important this exception is:

An ASP.NET application of my customer sometimes raises an exception of the following type System.NullReferenceException during its start-up. To be very very short, after hours and hours of debug, we found out that customer’s applications does not work properly (raising System.NullReferenceException) since during initial steps a System.BadImageFormatException occurs.

To figure out this was very complex: IIS by default handles the exception avoiding that w3wp.exe process crashes. Furthermore the System.NullReferenceException does not have any apparent relation with previous exception.

The question was: Why do we get a System.BadImageFormatException: Bad IL Range? According to our documentation, this exception comes out for the following scenarios:

“The exception that is thrown when the file image of a dynamic link library (DLL) or an executable program is invalid.”

And Bad IL Range means that a section of IL code inside a specific dll is not valid.

How is it possible? Is there a bug on C# compiler or VB.NET one? Of course no! To avoid a file/dll corruption, I asked customer to generate the DLLs one more time but issue was always there. Typically this step is enough to solve this kind of trouble.

Problem was always there since customer’s compilation process includes a 3^rd step. Typically we have two steps: .NET Language >> MS Intermediate Language >> native code. My customer does something more: .NET Language >> MS Intermediate Language >> Obfuscator >> native code.

Basically the managed dll (generated by C# compiler) was edited/recompiled by obfuscator application.

I do not want to mention here what obfuscator my customer was using. It is not relevant. The point was that this obfuscator generates an invalid IL so at runtime we got that exception System.BadImageFormatException.

Unfortunately application does not crash due to reason mentioned above so later on its execution time we got unpredictable behavior that generates a different exception System.NullReferenceException.

If you have this kind of issue, try to isolate the trouble reducing the external factors: in this case the obfuscator software.

Enjoy your .NET coding.

Carmelo

IIS - site offline but handshake phase done properly

2013-05-25T16:55:58Z

Today I want to share with you an interesting scenario introduced by one of my customers. Let me give you a picture about where we are:

We have a Web Server with two ip addresses configured on top of it.
Two web sites are hosted on mentioned Web Server. Let’s call them site1 and site2. Both sites are available over HTTPs to final users and each site uses is own ip address. To be clear:

Site1 – ip1:443
Site2 – ip2:443

In case that you configure one of your web sites offline (basically you stop it), IIS participates to SSL handshake phase http://support.microsoft.com/kb/257591/en-gb even if associated site is off line.

As results, IIS sends out the SSL certificate to final user and after that an HTTP 404. How is it possible? Let’s try to answer about this question:

http://support.microsoft.com/kb/175952/en-gb

“The Winsock application that is listening on the designated port was written so that it binds to any local IP address by using INADDR_ANY. This means that the application will listen to all local interfaces and you can connect to the port of any of them. This is why netstat -an shows IP address 0.0.0.0 listening on the port.”

What previous KB reports is clear: each time that an application defines a socket for a specific ip/port, Winsock takes care to listen for incoming requests to the specified port without restricting this operation on a specified ip. This is the default behavior.

Coming back to our scenario! Even if one site is stopped, the second one is working on port 443. What does it mean? Winsock listens on port 443. We can check this by running following command:

netstat -ano |findstr :443

TCP 0.0.0.0:443 0.0.0.0:0 LISTENING 4

As soon as an incoming connection comes-in for off line site, it finds-out a process who is listening on this port on server side: Winsock. This one completes the handshake phase sending out the configured SSL certificate to client. After handshake phase is completed, the request is moved to IIS so it answers with 404.

Is it possible to avoid this? Yes of course, by instructing WinSock to listen only the specified ip instead of all available IPs on the machine: http://support.microsoft.com/kb/954874/en-gb. In our case:

netsh http add iplisten ip1

netsh http add iplisten ip2

properly restart the services.

Of course after stopping web site, we have to instruct Winsock to not listen incoming connections on the web site ip:

netsh http del iplisten xxx.xxx.x.x

Enjoy your IIS administration!

Carmelo

404 File not found due to FileUtil.CheckSuspiciousPhysicalPath

2013-05-09T20:04:11Z

As everyone of you knows, 404 means file not found! A complete reference is available here: http://support.microsoft.com/kb/943891/en-gb. Well, there is a scenario where IIS provides back an HTTP 404 even if your file is there! Unbelievable.. Let us have a look to it. First of all, proceed configuring web server to provide back this code, after that let’s see where the issue is! Define a web site on IIS and configure its path on a system driver, for example E:. After that, define a web application inside it. Store web application files inside the same drive folder. For example E:\TestMicrosoft. This is my configuration:

As you can see, I added a txt resource and an ASP.NET page. If you navigate to web: http://localhost/TestCarmelop/example.aspx IIS answers with an HTTP 404. This behavior does not occurs for a resource not handled by ASP.NET ISAPI http://localhost/TestCarmelop/test.txt. Why? A good way to understand it is by enabling the Failed Request Tracing Rules: http://www.iis.net/learn/troubleshoot/using-failed-request-tracing/troubleshooting-failed-requests-using-tracing-in-iis

Reading the trace, we can find out the following information:

It seems that during the request, processing and exception occurred. Let us have a look to .NET source code ( you can use reflector on ILSPY for example). In my case, application is running on top of .Net Framework 2.0, so I will refer these assemblies. Please have a look at code mentioned below.

As you can see from above call stack, ASP.NET ISAPI invokes method: System.Web.CachedPathData.GetConfigPathData. This is done to get the upper level hierarchy settings. From this method, we jump to FileUtil.CheckSuspiciousPhysicalPath and there our path is considered suspect by ASP.NET runtime. So an exception is thrown: throw new HttpException(404, string.Empty); It is exactly our HTTP status code! The question is: Why our path is considered suspected? If we collect a memory dump, we can see that the value of path analyzed is E:\. This path is considered suspect in consideration of fact that you can access to every location of the entire drive. The solution, is to move the web site definition in a driver folder, something like E:\Mysite.

Enjoy your debug

Carmelo

// System.Web.CachedPathData

private static CachedPathData GetConfigPathData(string configPath)

    string key = CachedPathData.CreateKey(configPath);

    CacheInternal cacheInternal = HttpRuntime.CacheInternal;

    CachedPathData cachedPathData = (CachedPathData)cacheInternal.Get(key);

    if (cachedPathData != null)

        cachedPathData.WaitForInit();

        return cachedPathData;

    CachedPathData parentData = null;

    CacheDependency cacheDependency = null;

    VirtualPath virtualPath = null;

    string text = null;

    bool flag = false;

    string[] filenames = null;

    string[] cachekeys = null;

    string text2 = null;

    bool flag2 = false;

    if (WebConfigurationHost.IsMachineConfigPath(configPath))

        flag = true;

        flag2 = true;

    else

        string parent = ConfigPathUtility.GetParent(configPath);

        parentData = CachedPathData.GetConfigPathData(parent);

        string text3 = CachedPathData.CreateKey(parent);

        cachekeys = new string[]

            text3

};

        if (!WebConfigurationHost.IsVirtualPathConfigPath(configPath))

            flag = true;

            flag2 = true;

        else

            WebConfigurationHost.GetSiteIDAndVPathFromConfigPath(configPath, out text2, out virtualPath);

try

                text = virtualPath.MapPathInternal(true);

            catch (HttpException ex)

                if (ex.GetHttpCode() == 500)

                    throw new HttpException(404, string.Empty);

                throw;

            FileUtil.CheckSuspiciousPhysicalPath(text);

            bool flag3 = false;

            if (string.IsNullOrEmpty(text))

                flag = false;

            else

                FileUtil.PhysicalPathStatus(text, false, false, out flag, out flag3);

            if (flag && !flag3)

....

// System.Web.Util.FileUtil

internal static void CheckSuspiciousPhysicalPath(string physicalPath)

    if (FileUtil.IsSuspiciousPhysicalPath(physicalPath))

        throw new HttpException(404, string.Empty);

How to monitor Application Request Routing via PowerShell

2013-04-29T20:15:45Z

Dear readers,

Welcome back. Today I want to discuss with you how to monitor Application Request Routing via PowerShell script. In case that you are wondering what ARR is, probably you have to give a look at following link: http://www.iis.net/downloads/microsoft/application-request-routing

Of course ARR has some tools and performance counters available to monitor its status, like:

Anyway, there are scenarios where it is required a script to monitor how ARR server and application servers work. In a scenario like this, you could use PowerShell. The following example shows an example of script.

#####################################################################################

# THIS IS SAMPLE CODE AND IS ENTIRELY UNSUPPORTED. THIS CODE AND INFORMATION        #

# IS PROVIDED "AS-IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED,    #

# INCLUDING BUT NOT LIMITED TO AN IMPLIED WARRANTY OF MERCHANTABILITY AND/OR        #

# FITNESS FOR A PARTICULAR PURPOSE.                                                 #

#####################################################################################

# First add a reference to the MWA dll

$dll=[System.Reflection.Assembly]::LoadWithPartialName("Microsoft.Web.Administration")

#Get the manager and config object

$mgr = new-object Microsoft.Web.Administration.ServerManager

$conf = $mgr.GetApplicationHostConfiguration()

#Get the webFarms section

$section = $conf.GetSection("webFarms")

$webFarms = $section.GetCollection()

foreach ($webFarm in $webFarms)

    $Name= $webFarm.GetAttributeValue("name");

    #Get the servers in the farm

    $servers = $webFarm.GetCollection()

    Write-Host  "Farm Name: " $Name

    foreach($server in $servers)

         $ip= $server.GetAttributeValue("address")

         #Get the ARR section

         $arr = $server.GetChildElement("applicationRequestRouting")

         $counters = $arr.GetChildElement("counters")

         $isHealthy=$counters.GetAttributeValue("isHealthy")

         $state= $counters.GetAttributeValue("state")

         switch ($state)

                0 {$state= "Available"}

                1 {$state= "Drain"}

                2 {$state= "Unavailable"}

                default {$state= "Non determinato"}

        if( $isHealthy)

            $isHealthy="Healthy"

        else

            $isHealthy="Not Healthy"

         Write-Host -NoNewLine $ip  " " $state " " $isHealthy

         #NEW LINE

         Write-Host

    #NEW LINE

    Write-Host

Output shows all web farms installed on your server plus the status of each application server.

Enjoy your script

HTH
Carmelo

How many web applications per application pool

2013-03-22T17:28:00Z

Many times during my work activities, I figure out wrong configurations on web servers. Today, I want to discuss here this topic: web applications cannot be managed and configured like traditional windows applications.

When we think to desktop applications like notepad, we know that each time we run it, O.S. defines a new process (notepad.exe in our example).

Is it true for web application? No, a web application needs a host process to be executed, it means a process that carries on the web application and allows its execution. Starting from IIS6 this process is called w3wp.exe.
Please pay attention, a web application runs on top of an application pool that you define in IIS. An application pool, can be associated to one or more worker process.

A typical mistake is the following: web server administrator defines an application pool and execute many web applications on top of it. I worked with customer who has 20 -30-web applications on top of a single application pool!
This is bad very bad especially for 32 bit process. Let me try to explain why. Every web application needs:

1. Assemblies loaded in memory

2. Memory to calculate the application goal.

In case that you define a single application pool for all web applications, what happens is that all web apps have to load their assemblies and share the same memory. Do you think that this memory is infinite? No, it is not.

In a 32-bit process, by default every application can allocate 2GB of memory and a 32-bit process on a 64 bit machine 4GB. Those values are the maximum ones available by default, but do not except to use all that memory.

Typically, an Out Of Memory exception occurs before that value. It happens due to internal memory fragmentation!

In case that your application are managed one: ASP.NET to be clear, what happened is that Garbage Collector takes care to clean up the memory. If all web applications share the same memory, this one is under pressure.
It means that GC runs a lot of time per second in order to provide clean memory to your app. What is the side effect? In server mode, garbage collector requires to stop all threads activities to clean up the memory (this was improved on .NET Fx 4.5, where the collation does not require to stop all threads). What is the side effect?

Slow performance of your web application
High impact on CPU time due to GC’s activity.

Furthermore, if one of your web application crashes, all application running on the same pool will be impacted. Nothing more? There are other things to consider:

Threadpool, the number of thread that single process can define is not infinite. So all web application have to share that number/threads. Same thing for connection pool and so on.

Please do not consider this post in the following way: define necessarily one application pool per web application. This is not the goal, IIS gives you the flexibility to host multiple applications on the same application pool. However, when you decide how many applications have to run on top of the same application pool, take care of above considerations.

HTH,
Carmelo

My first Windows 8 App on Store

2013-03-10T16:54:00Z

Dear friends,

Today I’m going to publish my first windows 8 app on my country store: Italy. Unfortunately it means that only someone of you could play with it, sorry for that. Anyway, application is nothing of special, just a television guide.

In order to follow our privacy guideline: http://blogs.msdn.com/b/jennifer/archive/2012/11/15/common-windows-store-certification-errors-4-1-your-app-must-comply-with-privacy-requirements.aspx, I’m going to mention here the privacy term of my App.

Guida Televisiva Application does not store\share or use any final user’s information
Guida Televisiva Application needs to access over the web just to get the list of television programs

Let me share here the same information in Italian:

L’applicazione guida televisiva non memorizza\condivide oppure utilizza dati del suo utilizzatore.
L’applicazione guida televisiva ha la necessità di accedere ad internet solamente per recuperare la lista dei programmi televisivi.

Application is available here: http://apps.microsoft.com/windows/it-IT/app/guida-televisiva/a7cb88e7-5fa0-4457-a926-a6a1d24a0065 for free

Thx,

Carmelo

StackOverflow Exception – wrong implementation or leak of resources

2013-03-03T20:22:15Z

During this week, I had the opportunity to analyze a very interesting trouble and I want to share it with all of you. I do not want to go too much in deep about what occurred on the real scenario otherwise you could consider this post very long and boring. My idea is to share here some concepts:

A StackOverflow exception occurs when your code uses all resources available for stack. So, the first consideration to keep in mind is this one: What is the size of my call stack?
There is a public KB that answers to this question http://support.microsoft.com/kb/932909/en-gb concerning w3wp.exe (process who hosts our web page)

256 KB for 32 bit process
512 KB for 64 bit process

The common mistake concerning StackOverflow exception is to write down a recursive function that never ends its work. In this scenario, it is expected to have this exception. Of course, I do not want to discuss here about an infinite recursive function… that is a bug and nothing more. Let’s consider to write down a function like this one:

    public  int DoWork1( long x)

    {

        if (x == 0)

            return 0;

        return DoWork1(x - 1);

    }

According to input value, this function could grow-up in term of resources use in the stack. Let’s consider to have an application like this one:

    protected void Button1_Click(object sender, EventArgs e)

    {

        long input=10000;

        Work w = new Work(input);

        ThreadStart threadDelegate = new ThreadStart(w.DoWork);

        Thread newThread = new Thread(threadDelegate);

        newThread.Start();

    }

    class Work

    {

        private long i;

        public Work(long i)

        {

            this.i = i;

        }

        public void DoWork()

        {

             int ouput=DoWork1(i);

        }

        public  int DoWork1( long x)

        {

            if (x == 0)

                return 0;

            return DoWork1(x - 1);

        }

    }

Since the input value is very high, this application will raise a StackOverflow Exception even if reading the code everything seem to be fine. We have a StackOverflow Exception because our code uses all available resources.

Is there any possibility to fix it? Yes, of course otherwise I was not writing this post on my blog :-)..There are two possibilities to fix this issue:

Increase the stack size for all threads of your application: http://blogs.msdn.com/b/tom/archive/2008/03/31/stack-sizes-in-iis-affects-asp-net.aspx
Customize stack size for my thread “newThread”.
NET Thread API has a constructor that allows you to specify the maximum stack size to use http://msdn.microsoft.com/en-us/library/5cykbwz4.aspx
Changing the definition of my newThread in the following way:

 Thread newThread = new Thread(threadDelegate, 1048576);

The trouble is fixed.

Please note that what I mentioned here is only a simplification of what could happen on a real web application. Consider stack limit especially when you write down your classes and attributes. This because on a real scenario, it could happens that 3^rd party code or .NET framework core dlls need to parse your code in a recursive way. If your classes include many members, a StackOverflow Exception could come out even if you do not expect it.

Hope this help.

Carmelo

IIS7’s performance slower than IIS6

2012-12-27T16:45:53Z

As Support Engineer, I have the possibility to work with many customers around the world with different configurations. A couple of mounts ago, I was surprised to work with one of them who sustained that after the migration to IIS7 from IIS6, the IIS7’s performance was worse than IIS6. The servers’ goal was the same: both of them access on the same remote share in order to provide images to final users. It means no custom code was in execution: final users have the possibility to get their images simply opening urls like this one http://serverName/myImage.jpg on their brewers.

How was it possible? Was really IIS7 performing worse than IIS6? Of course no! The remote server (where the images were stored on) was the same for both web servers: IIS6 and II7. The network was working properly, let’s say with the same bandwidth, so where the issue was!?!

After collecting a memory dump, everything was clear (as in most of cases ). Well the threads were like this one:

0:087> k
# ChildEBP RetAddr  
00 0671ed44 75c63bc8 ntdll!ZwDelayExecution+0x15
01 0671edac 75c64498 KERNELBASE!SleepEx+0x65
02 0671edbc 73c48765 KERNELBASE!Sleep+0xf
03 0671edf0 73c443c4 iisutil!CReaderWriterLock3::_LockSpin+0xfb
04 0671ee10 73beeb73 iisutil!CReaderWriterLock3::ReadLock+0x3c
05 0671ee18 73bf1b1b nativerd!CONFIG_CACHE::ReadLock+0x11
06 0671ee28 73bdaad0 nativerd!CONFIG_CACHE::GetConfigFileList(class PATH * pConfigPath = 0x0671ef14, unsigned long dwParseMode = 0x2a, class CONFIG_FILE_LIST * pConfigFileList = 0x0671ee4c, class PARSE_ERROR_INFO * pParseErrorInfo = 0x0671f0b8)+0xe
07 0671f26c 73bb896d nativerd!CONFIG_SYSTEM::GetUniqueConfigPath(wchar_t * bstrConfigPath = 0x0671f598 "MACHINE/WEBROOT/APPHOST/SFTBS.SL.PT/auto/media/000561/Viaturas/000714130/166x125/Renault-Laguna-2357165.jpg", wchar_t ** pbstrUniquePath = 0x0671f290)+0xba
08 0671f294 730a3ca5 nativerd!CONFIG_SYSTEM::GetUniqueConfigPath(wchar_t * pszConfigPath = 0x0671f598 "MACHINE/WEBROOT/APPHOST/SFTBS.SL.PT/auto/media/000561/Viaturas/000714130/166x125/2357165.jpg", wchar_t * pszUniqueConfigPath = 0x0671f798 "", unsigned long * pcchUniqueConfigPath = 0x0671f2c0, class INativeSectionException ** ppException = 0x0671f9c4)+0x2809 0671f99c 730a547d iiscore!W3_CONTEXT::SetupMetadata+0x22b
0a 0671f9d0 730a5ab3 iiscore!W3_CONTEXT::SetupStateMachinePhase2+0x7e
0b 0671fa44 730a61c3 iiscore!W3_CONTEXT::SetupStateMachine+0x241
0c 0671fa58 730a6642 iiscore!W3_MAIN_CONTEXT::StartNotificationLoop+0x3f
0d 0671fa70 72ea1568 iiscore!W3_MAIN_CONTEXT::OnNewRequest+0x47
0e 0671fa7c 72ea14e6 w3dt!UL_NATIVE_REQUEST::DoStateProcess+0x26
0f 0671fa88 72ea154c w3dt!UL_NATIVE_REQUEST::DoWork+0x60
10 0671fa9c 7324265a w3dt!OverlappedCompletionRoutine+0x1a
11 0671fad4 7324289a w3tp!THREAD_POOL_DATA::ThreadPoolThread+0x89
12 0671fae8 73241e95 w3tp!THREAD_POOL_DATA::ThreadPoolThread+0x24
13 0671fb00 75b533aa w3tp!THREAD_MANAGER::ThreadManagerThread+0x39
14 0671fb0c 778a9ef2 kernel32!BaseThreadInitThunk+0xe
15 0671fb4c 778a9ec5 ntdll!__RtlUserThreadStart+0x70
16 0671fb64 00000000 ntdll!_RtlUserThreadStart+0x1b

What were they doing? They were trying to get a configuration file. The fact is this one:

Starting form IIS 7, the web server’s pipeline changed including new features and new integration with .NET.
Even if customer was not using any feature of ASP.Net (consider that his app is sharing images over the web) IIS was looking for web.config files at every content level on the file server.
The problem was there, customer file server was hosting hundreds and hundreds of folders, so the constant work to research web.config files caused the bottleneck.

What was the resolution? We have two possible resolutions here:

We could configure IIS in order to research webConfig file every 10 minutes for example. To do that we have to set the following registry key as mentioned below:
HKLM\System\CurrentControlSet\Services\W3SVC\Parameters\ConfigPollMilliSeconds = 600000
Further details here: http://support.microsoft.com/kb/954864
Of course this setting is not related to a single web application, it has an impact on web server.
This solution could not work for all web applications installed on your IIS, furthermore a new change on your webConfig will be not reflected
immediately.
This is my preferred solution, read here: http://www.iis.net/configreference/system.applicationhost/sites/site/application/virtualdirectory

“Optional Boolean attribute.
Specifies whether IIS looks for Web.config files in content directories lower than the current level (true) or does not look for Web.config files in content directories lower than the current level (false).
The default value is true.”

If you change the value of allowSubDirConfig to false in every application’s root, our goal is achieved: IIS will stop to research for web config file stored on application’s subfolder.

What happened at the end… J IIS7 worked 5 times faster than IIS6 on customer’s environment.

Thx,
Carmelo

How to collect a memory dump properly

2012-12-03T14:38:32Z

After discussing the following topics:

I believe it is right time to share with you how to collect a process memory dump properly. Why properly? Because there is not a single way to collect it: you have to act accordingly to your trouble.

The tool that allows us to collect a memory dumps is called DebugDiag. Please download the x86 version or the x64 version in according with your O.S.'s architecture http://www.microsoft.com/download/en/details.aspx?id=26798

Let’s start to analyse our scenarios:

Taking a dump in case of process's crash

The following rule allows us to collect a memory dump, in case of process's crash. We will not do any assumption on first chance exception, or heap corrupting and so on... We want to take a picture of our process before that it crashes.

Start DebugDiag. Select crash in the first interface and press the button called “next”:
Select the item called “A specific process”. In case of web app problem, select “A specific IIS web application pool”
Select process where the issue occurs or write its name with the extension exe. For web app issue, select Application Pool where your web application is working on.
Configure the last interface as reported below:
Create and active the rule.

In case that your process is not crashing but you observe that it closes itself in an unexpected way, please change the step 4 with the following one:

Basically, we will add a break point on our process as soon as it tries to close itself.

Hang scenarios: my process stops to respond but I do not know why

There are situations, where your process does not crash but for some unknown reasons it stops to do its work.
In these cases, we can collect a dump in the following way:

Start DebugDiag and select the button called cancel in the first interface:
Click on the tab called: “Processes”. DebugDiag shows the list of processes that are running on your machine.
Right click on the process affected by the issue:
Select the item: “Create Full Userdump”

In case, that you are troubleshooting an IIS issue, and you are not sure which application pool instance to dump you can have a look at http://blogs.msdn.com/b/carloc/archive/2007/04/13/find-which-w3wp-exe-instance-is-hosting-your-application.aspx to know which process is hosting the blocked application

Troubleshooting a fist chance exception

There are situations, especially working with IIS, where your application does not handle a particular exception. In this situation, it could be expected that hosting process (w3wp for web application) crashes. It is not completely true. I do not want to go in deep about this topic on this post (probably in a new one ) but let’s say that IIS is robust enough to handle the exceptions for us.

In this situation, there is no process's crash so we cannot use the rule mentioned on "Taking a dump in case of process's crash" section. Technically, we are interested on a fist chance exception or better we are interested to get a dump when a first chance exception come out. How to proceed?
Follow the steps mentioned on section "Taking a dump in case process's crash" but change the step 4 with this one:

Performance issues

This rule is valid only for web applications and we should use it in case that our web application is working in a slow way.

For example, typically a specific page MyPage.aspx answers in 5 seconds to final users. Sometimes, without having network issue, the same page is shown back to final users in 30 - 60 seconds. What it is going on! A dump will help us:

Run debugDiag and select the item: Performance
After that, please select the item: HTTP Response Time. > Add UR
DebugDiag will show the following interface:

Set timeout to 30 seconds (or a proper value) and press O

Press next and “Add dump target”
Please select application pool affected by the issue.
Configure the last interface as showed below:

Hope this help,
Carmelo

The importance to collect a memory dump at right time

2012-11-13T18:05:00Z

Collect a memory dump (in some scenarios) is the only way to understand what it is going wrong inside your process. Why? Since you have the possibility to check your application from inside.

As I wrote here, a memory dump is a "picture" of your application for a specific moment of its life. So, it is particularly relevant for me to share with you why it is important to collect a memory dump at right time. To understand it, let me share with you the following example. It is a game that should better explain the topic of this post:

We have four people and three chairs. As soon as a specific condition occurs, the four people have to sit in one of the available chairs at the same time. As you can understand, it is expected that one person has not the possibility to find his sit.
The game's goal is to understand what person is not able to take his chair. The only possibility to active this goal is to take a picture of the room where our people are gaming on.
How can you active this goal? It is easy, you have to take a picture of our room game as soon as all 3 chairs are occupied by our players. In that moment and exactly in that moment, you will be able to understand what person was not able to find his sit.

Taking a picture in a different moment, will not allow you to achieve your goal. You can do some suppositions, but the only way to be 100% sure about your answer is that: take a picture when all chairs are occupied.

This example should explain the importance to collect a picture, so a memory dump, at right time. Consider for example that you are troubleshooting a first chance exception for your application. Taking a memory dump after two or three minutes that exception occurred is not a good action to understand what is going on. Why? Since the process moved its internal state to a different point, so inside the dump you can see threads not at relevant moment.

You can consider threads as our game players: taking a picture of them in a wrong moment do not allow you to understand where the issue is!

So be sure to collect a dump properly, according to the issue you are trying to figure out.

Thx,

Carmelo