Crash Dump Analysis Patterns (Part 212)
Sunday, October 5th, 2014Although in the case of system hangs we, usually, recommend dumping Stack Trace Collection, in some cases it is very time-consuming, especially when it involves thousands of processes such as in modern terminal services environments. In such a case, if the problem description indicates the last action such as a not progressing user logon or a recently launched process we first check the tail of the corresponding linked list where Last Object is usually added to the tail of the list:
Sometimes we can simply check the end of some enumerated collection such as sessions (dotted lines represent ALPC Wait Chains):
This analysis pattern can be added to the first tier of RSDP. If nothing found around a couple of Last Objects we then resort to the analysis of entire linked lists.
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -