This article will detail the action plan you can implement to create a rule in Debug Diagnostic 1.2 to automate a dump generation when an IIS process is crashing (in example a "W3WP.exe" process).

This action plan can be applied when your W3WP.exe process is crashing which means, in an IIS context, the specified process has been killed or restarted for an obscure reason. This implies a stop of the process and if it has been restarted, a change in the Process ID. You really have to make the difference between a crash and a hang, as configuring a crash rule if you are facing a hang will not generate any dumps.

Action Plan

• Debug Diagnostic 1.2 can be download at the following URL: http://www.microsoft.com/download/en/details.aspx?id=26798
• Once the tool has been installed and executed on the IIS server, the wizard "Select Rule Type" loads
• Select "Crash" and then click on "Next >"

• In the window "Select Target Type"
  • Check "A specific IIS web application pool", then click on "Next >"
    This will have for effect to only generate a dump on the W3WP.exe process corresponding to your Application Pool
    • If you want to monitor every processes owned by IIS, you can select "All IIS/COM+ related processes"
    • You can also select "A specific process" to monitor every instances of a process or just a unique one (a specific process with a specific PID)
      The drawback of "A specific process" for a unique instance is you need to recreate the rule each time the process is restarted as his PID would have changed

• Select the Application Pool facing the crash issue, then click on "Next >"

• Add the breakpoint as you can see in the below screenshot
  • This allows you to generate a dump as soon as the command "TerminateProcess" is sent in the process without waiting for a complete stop
  • In addition, if a problem is detected by WAS in the process, it will stop it with this command, so without this breakpoint, no dump will be generated while the process is facing a crash

• Then click on "Next >"

• Choose a name and a location for dumps file, then click on "Next >"
  • Setting those dumps on another disk than C:\ is possible
  • Please check you have enough available space disk as the dump size will be equal to the memory consumed by the process you are monitoring

• In the window "Rule Completed", select "Activate the rule now", and then click on "Finish"
  • The rule is now configured and ready to generate dumps

• Check the status is "Active"
  • If it's not, The "DbgSvc" service is surely not started
  • You can go in "Administrative Tools > Services" and start it
• When a dump will be generated, you'll see the column "UserDump Count" being incremented

The dumps are located by default in "C:\Program Files\DebugDiag\Logs\Crash rule for all IIS_COM+ related processes" or in "C:\Program Files\DebugDiag\Logs\Rule_Name".

We hope this article will help you out.
See you soon.
Sylvain Lecerf and the French IIS Microsoft Support Team