Crash Dump Analysis Patterns (Part 212)

Although in the case of system hangs we, usually, recommend dumping Stack Trace Collection, in some cases it is very time-consuming, especially when it involves thousands of processes such as in modern terminal services environments. In such a case, if the problem description indicates the last action such as a not progressing user logon or a recently launched process we first check the tail of the corresponding linked list where Last Object is usually added to the tail of the list:

Sometimes we can simply check the end of some enumerated collection such as sessions (dotted lines represent ALPC Wait Chains):

This analysis pattern can be added to the first tier of RSDP. If nothing found around a couple of Last Objects we then resort to the analysis of entire linked lists.

- Dmitry Vostokov @ + -

One Response to “Crash Dump Analysis Patterns (Part 212)”

  1. Dmitry Vostokov Says:

    Regarding many terminal sessions on Windows we can dump processes sorted by session via !sprocess -4 to spot last Incomplete Session.

Leave a Reply

You must be logged in to post a comment.