This post explains how to find the ax user that caused an AOS crash - before reaching this stage you need to first have captured a memory dump, and then set up WinDbg ready to do some analysis, we have posts which explain both of those steps:
Capturing memory dumps:
Setting up WinDbg:
Once you have your memory dumps and have set up WinDbg, just open WinDbg, go to file- open a crash dump, and open the *.dmp file you created. Then there are a few basic commands you can run in WinDbg which will allow you to identify the AX user associated with the thread that crashed an AOS (for an AOS crash dump).
In AX4 32 bit:
You need to add the “+60” to the location copied from the thread local storage. This will return some further memory locations, take the first location and then run:In AX2009 64 bit:
You need to add the “+15c” or “+e4” to the end of the location. This should return the user’s name, if it doesn’t then go back to the results from !tls and take the next location and run the dq and du commands again. In addition to the user you can also add other offsets to the end of the location to find some other variables:In AX2009 64 bit:+258 = current AX company+2fc = name of user’s client machine
In AX4 32 bit:+140 = current AX company+1a8 = name of user’s client machine
Here is an example of those commands being run in WinDbg for an AOS crash dump. Note that the example uses AX2009 64 bit, for AX4 32 bit the memory locations will only be 8 digits long and the offsets we add on to them are different (listed in the detail above) but otherwise it is the same process.
What we are actually is doing with these commands is - we know that at an offset of 60 from one of the thread local storage locations will be the user’s session block, then once we find the session block at an offset of 15c from that will be the username variable.
You can apply the exact same technique also if your AOS is running high CPU, or hanging, just take a memory dumps from it and run the same commands as described above on each thread (you can switch to each thread from "View->processes and threads" in WinDbg).
Next you might want to find out what X++ the user was running at the time, see this post:
There is an easier way to do this for AX2009 x64 - we have created scripts to automate the process in WinDbg - see this post: