{"id":665,"date":"2008-12-23T20:30:43","date_gmt":"2008-12-23T18:30:43","guid":{"rendered":"https:\/\/alax.info\/blog\/?p=665"},"modified":"2010-10-07T13:42:23","modified_gmt":"2010-10-07T11:42:23","slug":"processsnapshot-to-take-a-snapshot-of-process-modules-threads-stacks-and-performance","status":"publish","type":"post","link":"https:\/\/alax.info\/blog\/665","title":{"rendered":"ProcessSnapshot to take a snapshot of process modules, threads, stacks and performance"},"content":{"rendered":"<p>While troubleshooting released application on remote production site, it is very useful to grasp a state of the process for further analysis. There are several scenarios in which the following information about process state is helpful:<\/p>\n<ul>\n<li>modules (DLLs) loaded into process and their versions<\/li>\n<li>threads and their call stacks<\/li>\n<li>process and thread performance<\/li>\n<\/ul>\n<p>An utility ProcessSnapshot takes advantage of <a href=\"http:\/\/www.microsoft.com\/whdc\/devtools\/debugging\/default.mspx\">Debugging Tools API<\/a> (<a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/ms679294.aspx\">dbghelp.dll<\/a> &#8211; note the dialog also displays DLL version in the right bottom corner) and writes this helpful information to text file and it can also take a sequence of the snapshots to compare thread performance and\/or stacks and check the difference.<\/p>\n<p><a href=\"https:\/\/alax.info\/blog\/wp-content\/uploads\/2008\/10\/14-image001.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-666\" title=\"Process Snapshot\" src=\"https:\/\/alax.info\/blog\/wp-content\/uploads\/2008\/10\/14-image001-300x175.png\" alt=\"\" width=\"300\" height=\"175\" srcset=\"https:\/\/alax.info\/blog\/wp-content\/uploads\/2008\/10\/14-image001-300x175.png 300w, https:\/\/alax.info\/blog\/wp-content\/uploads\/2008\/10\/14-image001.png 641w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>The generated file is in the directory of the utility application and looks like:<\/p>\n<pre>Snapshot\r\n  System Time: 10\/14\/2008 8:46:33 PM\r\n  Local Time: 10\/14\/2008 11:46:33 PM\r\n\r\nPerformance\r\n  Creation System Time: 10\/14\/2008 8:46:28 PM\r\n  Kernel Time: 0.094 s\r\n  User Time: 0.031 s\r\n\r\nModules\r\n\r\n  Module: ProcessSnapshot.exe @00400000\r\n    Base Address: 0x00400000\r\n    Base Size: 0x0005b000 (372736)\r\n    Name: ProcessSnapshot.exe\r\n    Path: D:\\Projects\\Utilities\\ProcessSnapshot\\Release\\ProcessSnapshot.exe\r\n    Product Version: 1.0.0.1\r\n    File Version: 1.0.0.125\r\n\r\n  Module: ntdll.dll @7c900000\r\n    Base Address: 0x7c900000\r\n    Base Size: 0x000af000 (716800)\r\n    Name: ntdll.dll\r\n    Path: C:\\WINDOWS\\system32\\ntdll.dll\r\n    Product Version: 5.1.2600.5512\r\n    File Version: 5.1.2600.5512\r\n[...]\r\n\r\nThreads\r\n\r\n  Thread: 3824\r\n    Base Priority: 8\r\n    Creation System Time: 10\/14\/2008 8:46:57 PM\r\n    Kernel Time: 0.063 s\r\n    User Time: 0.031 s\r\n    Call Stack\r\n      ntdll!7c90e4f4 KiFastSystemCallRet (+ 0) @7c900000\r\n      USER32!7e4249c4 GetCursorFrameInfo (+ 460) @7e410000\r\n      USER32!7e424a06 DialogBoxIndirectParamAorW (+ 54) @7e410000\r\n      USER32!7e4247ea DialogBoxParamW (+ 63) @7e410000\r\n      ProcessSnapshot!00403f45 ATL::CDialogImpl&lt;CMainDialog,ATL::CWindow&gt;::DoModal (+ 67) [c:\\program files\\microsoft visual studio 9.0\\vc\\atlmfc\\include\\atlwin.h, 3478] (+ 28) @00400000\r\n      ProcessSnapshot!00403b6f CProcessSnapshotModule::RunMessageLoop (+ 74) [d:\\projects\\utilities\\processsnapshot\\processsnapshot.cpp, 67] (+ 0) @00400000\r\n      ProcessSnapshot!004049b9 ATL::CAtlExeModuleT&lt;CProcessSnapshotModule&gt;::Run (+ 17) [c:\\program files\\microsoft visual studio 9.0\\vc\\atlmfc\\include\\atlbase.h, 3552] (+ 0) @00400000\r\n      ProcessSnapshot!004041c3 ATL::CAtlExeModuleT&lt;CProcessSnapshotModule&gt;::WinMain (+ 48) [c:\\program files\\microsoft visual studio 9.0\\vc\\atlmfc\\include\\atlbase.h, 3364] (+ 5) @00400000\r\n      ProcessSnapshot!00434477 wWinMain (+ 5) [*d:\\projects\\utilities\\processsnapshot\\release\\processsnapshot.inj:5, 14] (+ 0) @00400000\r\n      ProcessSnapshot!00415058 __tmainCRTStartup (+ 274) [f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\crt0.c, 263] (+ 27) @00400000\r\n      !00360033<\/pre>\n<p><!--more--><\/p>\n<p>How exactly this can facilitate troubleshooting problems with software. Here are several scenarios:<\/p>\n<ul>\n<li>the applications shows an unexpected error message and it is desired to find out the position and call stack<\/li>\n<li>the application deadlocks and call stacks are required for further troubleshooting<\/li>\n<li>the application maxes out CPU load on one of the cores and the thread needs to be identified<\/li>\n<li>the applciation runs slowly and bottleneck thread is to be find out<\/li>\n<li>the application loads undesired third party module (or otherwise has it mapped into process, esp. antivirus software, or a DLL hosting undesired DirectShow filter) or a module with improper version<\/li>\n<\/ul>\n<p>In all mentioned above scenarios the snapshot is very helpful for troubleshooting, profiling, fixing.<\/p>\n<p>Update 23-Dec-2008. The application auto-enables <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/bb530716(VS.85).aspx\">SeDebugPrivilege<\/a> (SE_DEBUG_NAME) so that snapshot could be taken from processes such as service processes.<\/p>\n<p>A binary [<a href=\"http:\/\/www.assembla.com\/code\/roatl-utilities\/subversion\/nodes\/trunk\/ProcessSnapshot\/Win32\/Release\/ProcessSnapshot.exe?format=raw\">Win32<\/a>, <a href=\"http:\/\/www.assembla.com\/code\/roatl-utilities\/subversion\/nodes\/trunk\/ProcessSnapshot\/x64\/Release\/ProcessSnapshot.exe?format=raw\">x64<\/a>] and Visual C++ .NET 2008 source code <a href=\"http:\/\/trac2.assembla.com\/roatl-utilities\/browser\/trunk\/ProcessSnapshot\/Release\/ProcessSnapshot.exe\">are available from SVN<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>While troubleshooting released application on remote production site, it is very useful to grasp a state of the process for further analysis. There are several scenarios in which the following information about process state is helpful: modules (DLLs) loaded into process and their versions threads and their call stacks process and thread performance An utility&hellip; <\/p>\n<p><a class=\"moretag\" href=\"https:\/\/alax.info\/blog\/665\">Read the full article<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,21,2,20],"tags":[487,103,133,134,488,132,489],"class_list":["post-665","post","type-post","status-publish","format-standard","hentry","category-atl","category-seriously","category-utilities","category-wtl","tag-atl","tag-performance","tag-process","tag-snapshot","tag-source","tag-utility","tag-wtl"],"_links":{"self":[{"href":"https:\/\/alax.info\/blog\/wp-json\/wp\/v2\/posts\/665","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/alax.info\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/alax.info\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/alax.info\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/alax.info\/blog\/wp-json\/wp\/v2\/comments?post=665"}],"version-history":[{"count":0,"href":"https:\/\/alax.info\/blog\/wp-json\/wp\/v2\/posts\/665\/revisions"}],"wp:attachment":[{"href":"https:\/\/alax.info\/blog\/wp-json\/wp\/v2\/media?parent=665"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/alax.info\/blog\/wp-json\/wp\/v2\/categories?post=665"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/alax.info\/blog\/wp-json\/wp\/v2\/tags?post=665"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}