Exploring Kernel Memory Space Analyzer
It takes approximately 10 - 30 minutes to process an average 2Gb complete memory dump. After loading couple of dumps I found the following useful features so far:
- You can save analysis tree in a file and open it later for further analysis (but you need to keep dump file too)
- Wait chains might be useful. However the tool reports too many of them (608 in my dump). They are sorted by length so it might be useful in detecting lengthy chains
- It also detects anomalous (corrupt) critical sections in user processes
- It detects deadlocks (you don’t need to enable driver verifier and reboot the system to get a new dump)
I’m currently using this tool with every memory dump I get and will post interesting cases.
- Dmitry Vostokov -