SlideShare a Scribd company logo
.NET Debugging Workshop 
#devconnections
SESSION TITLE 
#devconnections 
Sasha Goldshtein 
CTO, Sela Group 
Microsoft C# MVP, Azure MRS 
@goldshtn blog.sashag.net 
#devconnections
.NET DEBUGGING WORKSHOP 
In This Workshop… 
• Debugging issues in production 
environments 
• Automating triage and analysis 
processes 
• Analyzing system and application 
performance 
#devconnections
.NET DEBUGGING WORKSHOP 
Production Debugging 
• Requirements 
– Obtain actionable 
information about 
crashes and errors 
– Obtain accurate 
performance 
information 
• Limitations 
– Can’t install Visual 
Studio 
– Can’t suspend 
production servers 
– Can’t run intrusive 
tools 
#devconnections
.NET DEBUGGING WORKSHOP 
In the DevOps Process… 
• Automatic build (CI) 
• Automatic deployment (CD) 
• Automatic monitoring 
• Automatic error triage and analysis 
• Automatic remediation 
#devconnections
.NET DEBUGGING WORKSHOP 
The Tools 
• Sysinternals Procdump 
• DebugDiag 
• Windows SDK 
– Debugging Tools for Windows 
– Windows Performance Toolkit 
• PerfView 
#devconnections
Dump Files 
#devconnections
.NET DEBUGGING WORKSHOP 
Dump Files 
• A user dump is a snapshot of a running 
process 
• A kernel dump is a snapshot of the entire 
system 
• Dump files are useful for post-mortem 
diagnostics and for production debugging 
– Anytime you can’t attach and start live 
debugging, a dump might help 
#devconnections
.NET DEBUGGING WORKSHOP 
Limitations of Dump Files 
• A dump file is a static snapshot 
– You can’t debug a dump, just analyze it 
– Sometimes a repro is required (or more 
than one repro) 
• Sometimes several dumps must be 
compared 
#devconnections
.NET DEBUGGING WORKSHOP 
Taxonomy of Dumps 
• Crash dumps are dumps generated 
when an application crashes 
• Hang dumps are dumps generated 
on-demand at a specific moment 
• These are just names; the contents of 
the dump files are the same! 
#devconnections
.NET DEBUGGING WORKSHOP 
Generating a Hang Dump 
• Task Manager, right-click 
and choose 
“Create Dump File” 
– Creates a dump in 
%LOCALAPPDATA 
%Temp 
#devconnections
.NET DEBUGGING WORKSHOP 
Procdump 
• Sysinternals utility for creating dumps 
• Examples: 
Procdump -ma app.exe app.dmp 
Procdump -ma -h app.exe hang.dmp 
Procdump -ma -e app.exe crash.dmp 
Procdump -ma -c 90 app.exe cpu.dmp 
Procdump -m 1000 -n 5 -s 600 -ma app.exe 
#devconnections
.NET DEBUGGING WORKSHOP 
Windows Error Reporting 
• WER can create dumps automatically 
– HKLMSoftwareMicrosoftWindows 
Windows Error ReportingLocalDumps 
– http://tinyurl.com/localdumps 
• Can be application-specific, not 
system-wide 
#devconnections
.NET DEBUGGING WORKSHOP 
DebugDiag 
• Microsoft tool for 
monitoring and 
dump generation 
– Very suitable for 
ASP.NET 
– Dump analysis 
component 
included 
#devconnections
.NET DEBUGGING WORKSHOP 
Debugging Symbols 
• Debugging symbols link runtime 
memory addresses to function names, 
source file names and line numbers 
– PDB files 
– Required for proper debugging and 
dump analysis 
#devconnections
.NET DEBUGGING WORKSHOP 
Symbols for Microsoft Binaries 
• Microsoft has a public symbol server 
with PDB files for Microsoft binaries 
• Configure _NT_SYMBOL_PATH 
environment variable 
setx _NT_SYMBOL_PATH 
srv*C:symbols*http://msdl.microsoft.com/download/symbols 
#devconnections
.NET DEBUGGING WORKSHOP 
Opening Dump Files 
• Visual Studio can 
open dump files 
– For .NET, CLR 4.0+ 
and VS2010+ 
required 
– VS2013 
recommended 
#devconnections
.NET DEBUGGING WORKSHOP 
Opening Dump Files 
• WinDbg is a free 
lightweight 
debugger 
• No intrinsic .NET 
support, but has 
SOS debugging 
extension 
!analyze -v (CLR 4.0+) 
.loadby sos clr 
!printexception 
!clrstack 
#devconnections
.NET DEBUGGING WORKSHOP 
Configuring LocalDumps 
Obtaining and opening a dump file 
TRY IT OUT 
#devconnections
Automatic Dump Analysis 
#devconnections
.NET DEBUGGING WORKSHOP 
Basic Automation 
• Run WinDbg automatically on a bunch 
of files and log its output: 
@echo off 
for %%f in (.*.dmp) do ( 
echo Launching analysis of file %%f... 
start "Analyzing %%f" "C:Program Files (x86)Windows 
Kits8.1Debuggersx86cdb.exe" -z %%f -c ".logopen %%f.log; 
!analyze -v; .logclose; qd" 
) 
#devconnections
.NET DEBUGGING WORKSHOP 
Basic Automation 
• Parse the results for interesting tokens: 
for %%f in (.*.dmp.log) do ( 
echo In file %%f: 
findstr "EXCEPTION_MESSAGE MANAGED_OBJECT_NAME" %%f 
) 
#devconnections
.NET DEBUGGING WORKSHOP 
ClrMD 
• Text-based analysis of debugger 
command output is very fragile and 
limited 
• ClrMD is a .NET library for analyzing dump 
files (and running processes) 
– A managed API for interacting with the .NET 
debugging runtime (“SOS API”) 
– Distributed through NuGet (search “ClrMD”) 
#devconnections
.NET DEBUGGING WORKSHOP 
ClrMD Basic Classes 
#devconnections 
DDaattaaTTaarrggeett 
CCllrrRRuunnttiimmee CCllrrRRuunnttiimmee 
CCllrrHHeeaapp CCllrrTThhrreeaadd 
CCllrrTTyyppee CCllrrTTyyppee CCllrrTThhrreeaadd
.NET DEBUGGING WORKSHOP 
mscordacwks.dll 
• Managed dump analysis requires 
mscordacwks.dll matching the CLR 
version 
• It can be automatically downloaded 
from the Microsoft symbol server in 
most cases 
#devconnections
.NET DEBUGGING WORKSHOP 
Connecting to a Target 
#devconnections
.NET DEBUGGING WORKSHOP 
Basic Exception Triage 
#devconnections
.NET DEBUGGING WORKSHOP 
Getting stacks from a live process 
TRY IT OUT 
#devconnections
.NET DEBUGGING WORKSHOP 
Inspecting the Heap 
• Enumerate all heap 
objects and statistics 
• Find specific objects 
• Inspect GC 
information (roots, 
finalization queues, 
etc.) 
#devconnections 
ClrHeap 
EnumerateObjects 
GetObjectType 
EnumerateRoots 
ClrType 
GetSize 
EnumerateRefsOfObject 
GetFieldValue
.NET DEBUGGING WORKSHOP 
Wait Information 
• Threads have a list 
of blocking objects, 
which have owner 
threads 
• Wait analysis and 
deadlock detection 
is made possible 
ClrThread 
BlockingObjects 
BlockingObject 
Reason 
Object 
HasSingleOwner 
Owner/Owners 
Waiters 
#devconnections
ETW and PerfView 
#devconnections
.NET DEBUGGING WORKSHOP 
Event Tracing for Windows 
• High-performance facility for emitting 
100K+ log events per second with rich 
payloads and stack trace support 
• Used widely across Windows, .NET, 
drivers, services, third party 
components 
#devconnections
.NET DEBUGGING WORKSHOP 
ETW Participants 
• A provider generates ETW events 
• A controller starts and stops ETW 
collection 
• A consumer logs, analyzes, or 
processes ETW events 
#devconnections
.NET DEBUGGING WORKSHOP 
ETW Scenarios 
• Profile an app in sampling mode 
• Perform wait-time analysis 
• Log disk accesses including stacks 
• Log GC and JIT events 
• Log memory allocation statistics (C++) 
• Custom application event log 
#devconnections
.NET DEBUGGING WORKSHOP 
Custom ETW Events 
#devconnections
.NET DEBUGGING WORKSHOP 
ETW Tools 
• xperf.exe: Command-line tool for ETW 
capturing and processing 
• wpr.exe: Command-line and GUI for end 
users 
• wpa.exe: Visual trace analysis tool 
• PerfView.exe: Visual tool for capturing 
and recording ETW events from 
managed providers and the CLR 
#devconnections
.NET DEBUGGING WORKSHOP 
Capturing a Trace 
• Xperf 
xperf -on DiagEasy 
... 
xperf -d diag.etl 
• WPR 
#devconnections
.NET DEBUGGING WORKSHOP 
What’s In A Trace? 
• A trace is a huge list 
of events 
• Events have multiple 
columns (payload) 
• Useless without 
additional processing 
#devconnections
.NET DEBUGGING WORKSHOP 
Trace Processing with Xperf 
• I/O summary report 
per file 
xperf -i fileio.etl 
-o fileio.csv -a diskio 
-summary 
• Interactive profiling 
report (for a specific 
process) 
xperf -i cpu.etl 
-o cpu.html -symbols 
-a stacks -process 
app.exe -butterfly 
#devconnections
.NET DEBUGGING WORKSHOP 
Managed Stacks 
• To display managed stack traces 
correctly, additional CLR data is required 
• WPR & PerfView take care of this 
automatically 
• If using Xperf, see: 
http:// 
msdn.microsoft.com/en-us/library/windows/desktop/#devconnections
.NET DEBUGGING WORKSHOP 
Collecting file I/O information 
TRY IT OUT 
#devconnections
.NET DEBUGGING WORKSHOP 
Trace Analysis with WPA 
List of 
graphs 
List of 
graphs 
#devconnections 
Graph 
display 
Graph 
display 
Ungrouped 
Ungrouped 
columns 
Grouped columns 
columns 
Grouped 
columns Grouping 
Grouping 
bar 
bar
.NET DEBUGGING WORKSHOP 
Stack Summaries 
• Learn how to read 
stack summaries 
– Group by Stack 
column 
– Expand “hot path”, 
like in profiler 
• Stack resolution 
requires symbols 
(slow) 
#devconnections
.NET DEBUGGING WORKSHOP 
PerfView 
• ETW collection and analysis tool tailored 
for .NET applications (but not only) 
• Can be used as a sampling profiler 
• Can be used as an allocation profiler 
• Can be used for heap snapshot analysis 
#devconnections
.NET DEBUGGING WORKSHOP 
Collecting Data w/ PerfView 
• CLI 
PerfView run app.exe 
• GUI 
#devconnections
.NET DEBUGGING WORKSHOP 
PerfView Collection Options 
Profiling wall-clock 
Profiling wall-clock 
time 
time 
CPU sampling 
profiling 
#devconnections 
File/registry 
accesses 
File/registry 
accesses 
Allocation 
profiling 
Allocation 
profiling 
CPU sampling 
profiling
.NET DEBUGGING WORKSHOP 
PerfView Tables 
Grouping 
options Filtering 
Grouping 
options 
#devconnections 
Filtering 
options 
options 
CCaalll ls tsatacckk t rtereee 
In-trace activity 
highlighter 
In-trace activity 
highlighter
.NET DEBUGGING WORKSHOP 
Memory Leak Analysis 
• PerfView can 
generate heap 
snapshots (smaller 
than a dump), 
analyze, and 
compare them 
• Can also import 
dumps directly 
#devconnections
.NET DEBUGGING WORKSHOP 
Leak analysis with PerfView 
TRY IT OUT 
#devconnections
.NET DEBUGGING WORKSHOP 
Automatic ETW Analysis 
• The TraceEvent 
library provides an 
API for ETW analysis 
– Understands kernel 
and CLR events 
– Supports call stacks 
(incl. managed) 
#devconnections
.NET DEBUGGING WORKSHOP 
Example Analysis Scenarios 
• Monitor the system 
for CLR exceptions 
w/ stacks 
ExceptionTraceData 
• Get a profiling trace 
and look for 
regressions 
TraceLog 
SampledProfileTraceData 
TraceCallStack 
#devconnections
.NET DEBUGGING WORKSHOP 
Summary 
• Production debugging and 
performance investigation is here, and 
entirely possible thanks to dumps and 
ETW traces 
• Integrate automatic error analysis and 
triage into your devops process 
#devconnections
SESSION TITLE 
Rate This Session Now! 
#devconnections 
Rate with Mobile App: 
1. Select the session from the 
Agenda or Speakers menus 
2. Select the Actions tab 
3. Click Rate Session 
Rate Using Our Website: 
1. Register at www.devconnections.com/logintoratesession 
2. Go to www.devconnections.com/ratesession 
3. Select this session from the list and rate it 
Tell Us 
What 
You 
Thought 
of This 
Session 
Be Entered to WIN Prizes!

More Related Content

PPTX
Introduction to .NET Performance Measurement
PDF
DCSF 19 eBPF Superpowers
PPT
Mastering IntelliTrace in Development and Production
PPTX
Advanced windows debugging
PPTX
VS Debugging Tricks
PPTX
Advanced Debugging with WinDbg and SOS
PPTX
Power of linked list
PDF
Crash dump analysis - experience sharing
Introduction to .NET Performance Measurement
DCSF 19 eBPF Superpowers
Mastering IntelliTrace in Development and Production
Advanced windows debugging
VS Debugging Tricks
Advanced Debugging with WinDbg and SOS
Power of linked list
Crash dump analysis - experience sharing

What's hot (20)

PPTX
Who’s afraid of WinDbg
PDF
Devel::NYTProf v3 - 200908 (OUTDATED, see 201008)
PPTX
You didnt see it’s coming? "Dawn of hardened Windows Kernel"
PPTX
Racing with Droids
PDF
When is something overflowing
PDF
USENIX ATC 2017: Visualizing Performance with Flame Graphs
PPTX
Guardians of your CODE
PPTX
Vulnerability desing patterns
PPTX
Back to the CORE
PDF
Building Observable Applications w/ Node.js -- BayNode Meetup, March 2014
PPTX
Windows Kernel Exploitation : This Time Font hunt you down in 4 bytes
PPTX
Security research over Windows #defcon china
PDF
Rainbow Over the Windows: More Colors Than You Could Expect
PDF
Modern Evasion Techniques
PPTX
Hacking - high school intro
PDF
Process injection - Malware style
PPTX
How Safe is your Link ?
PPTX
Mesa and Its Debugging
PDF
CNIT 126 2: Malware Analysis in Virtual Machines & 3: Basic Dynamic Analysis
PPTX
How We Test Linux
Who’s afraid of WinDbg
Devel::NYTProf v3 - 200908 (OUTDATED, see 201008)
You didnt see it’s coming? "Dawn of hardened Windows Kernel"
Racing with Droids
When is something overflowing
USENIX ATC 2017: Visualizing Performance with Flame Graphs
Guardians of your CODE
Vulnerability desing patterns
Back to the CORE
Building Observable Applications w/ Node.js -- BayNode Meetup, March 2014
Windows Kernel Exploitation : This Time Font hunt you down in 4 bytes
Security research over Windows #defcon china
Rainbow Over the Windows: More Colors Than You Could Expect
Modern Evasion Techniques
Hacking - high school intro
Process injection - Malware style
How Safe is your Link ?
Mesa and Its Debugging
CNIT 126 2: Malware Analysis in Virtual Machines & 3: Basic Dynamic Analysis
How We Test Linux
Ad

Similar to .NET Debugging Workshop (20)

PDF
PAC 2019 virtual Christoph NEUMÜLLER
PDF
Docker presentasjon java bin
PPTX
Hot to build continuously processing for 24/7 real-time data streaming platform?
PDF
Atlanta Jenkins Area Meetup October 22nd 2015
PPTX
introduction to node.js
PDF
Jenkins Pipelines Advanced
PPTX
2 万林涛
PPTX
J1 2015 "Debugging Java Apps in Containers: No Heavy Welding Gear Required"
PDF
Surge2012
PDF
Raffaele Rialdi
PPTX
DIY Java Profiling
PPTX
Exploring Java Heap Dumps (Oracle Code One 2018)
PDF
Our Puppet Story (GUUG FFG 2015)
PPTX
SenchaCon 2016: Develop, Test & Deploy with Docker - Jonas Schwabe
PPTX
Performance Benchmarking: Tips, Tricks, and Lessons Learned
PPTX
¡El mejor lenguaje para automatizar pruebas!
PPTX
Introduction to jenkins
PPTX
Performance analysis and troubleshooting using DTrace
PDF
Web a Quebec - JS Debugging
PDF
Here Be Dragons – Advanced JavaScript Debugging
PAC 2019 virtual Christoph NEUMÜLLER
Docker presentasjon java bin
Hot to build continuously processing for 24/7 real-time data streaming platform?
Atlanta Jenkins Area Meetup October 22nd 2015
introduction to node.js
Jenkins Pipelines Advanced
2 万林涛
J1 2015 "Debugging Java Apps in Containers: No Heavy Welding Gear Required"
Surge2012
Raffaele Rialdi
DIY Java Profiling
Exploring Java Heap Dumps (Oracle Code One 2018)
Our Puppet Story (GUUG FFG 2015)
SenchaCon 2016: Develop, Test & Deploy with Docker - Jonas Schwabe
Performance Benchmarking: Tips, Tricks, and Lessons Learned
¡El mejor lenguaje para automatizar pruebas!
Introduction to jenkins
Performance analysis and troubleshooting using DTrace
Web a Quebec - JS Debugging
Here Be Dragons – Advanced JavaScript Debugging
Ad

More from Sasha Goldshtein (20)

PPTX
Modern Linux Tracing Landscape
PPTX
The Next Linux Superpower: eBPF Primer
PPTX
Staring into the eBPF Abyss
PPTX
Visual Studio 2015 and the Next .NET Framework
PPT
Swift: Apple's New Programming Language for iOS and OS X
PPT
C# Everywhere: Cross-Platform Mobile Apps with Xamarin
PPT
Modern Backends for Mobile Apps
PPT
Performance and Debugging with the Diagnostics Hub in Visual Studio 2013
PPTX
Introduction to RavenDB
PPTX
State of the Platforms
PPTX
Delivering Millions of Push Notifications in Minutes
PPTX
Building Mobile Apps with a Mobile Services .NET Backend
PPTX
Building iOS and Android Apps with Mobile Services
PPT
Task and Data Parallelism
PPT
What's New in C++ 11?
PDF
Attacking Web Applications
PPTX
Windows Azure Mobile Services
PPTX
First Steps in Android Development
PPTX
First Steps in iOS Development
PPTX
JavaScript, Meet Cloud: Node.js on Windows Azure
Modern Linux Tracing Landscape
The Next Linux Superpower: eBPF Primer
Staring into the eBPF Abyss
Visual Studio 2015 and the Next .NET Framework
Swift: Apple's New Programming Language for iOS and OS X
C# Everywhere: Cross-Platform Mobile Apps with Xamarin
Modern Backends for Mobile Apps
Performance and Debugging with the Diagnostics Hub in Visual Studio 2013
Introduction to RavenDB
State of the Platforms
Delivering Millions of Push Notifications in Minutes
Building Mobile Apps with a Mobile Services .NET Backend
Building iOS and Android Apps with Mobile Services
Task and Data Parallelism
What's New in C++ 11?
Attacking Web Applications
Windows Azure Mobile Services
First Steps in Android Development
First Steps in iOS Development
JavaScript, Meet Cloud: Node.js on Windows Azure

Recently uploaded (20)

PDF
Reach Out and Touch Someone: Haptics and Empathic Computing
PPTX
VMware vSphere Foundation How to Sell Presentation-Ver1.4-2-14-2024.pptx
PPTX
Cloud computing and distributed systems.
PDF
Modernizing your data center with Dell and AMD
PDF
Empathic Computing: Creating Shared Understanding
PPTX
Detection-First SIEM: Rule Types, Dashboards, and Threat-Informed Strategy
PDF
Unlocking AI with Model Context Protocol (MCP)
PDF
Spectral efficient network and resource selection model in 5G networks
PPTX
20250228 LYD VKU AI Blended-Learning.pptx
PDF
Peak of Data & AI Encore- AI for Metadata and Smarter Workflows
PDF
Machine learning based COVID-19 study performance prediction
PPTX
Effective Security Operations Center (SOC) A Modern, Strategic, and Threat-In...
PDF
How UI/UX Design Impacts User Retention in Mobile Apps.pdf
PDF
cuic standard and advanced reporting.pdf
PDF
Mobile App Security Testing_ A Comprehensive Guide.pdf
PDF
Diabetes mellitus diagnosis method based random forest with bat algorithm
PPT
Teaching material agriculture food technology
PPTX
Digital-Transformation-Roadmap-for-Companies.pptx
PDF
Bridging biosciences and deep learning for revolutionary discoveries: a compr...
PPTX
PA Analog/Digital System: The Backbone of Modern Surveillance and Communication
Reach Out and Touch Someone: Haptics and Empathic Computing
VMware vSphere Foundation How to Sell Presentation-Ver1.4-2-14-2024.pptx
Cloud computing and distributed systems.
Modernizing your data center with Dell and AMD
Empathic Computing: Creating Shared Understanding
Detection-First SIEM: Rule Types, Dashboards, and Threat-Informed Strategy
Unlocking AI with Model Context Protocol (MCP)
Spectral efficient network and resource selection model in 5G networks
20250228 LYD VKU AI Blended-Learning.pptx
Peak of Data & AI Encore- AI for Metadata and Smarter Workflows
Machine learning based COVID-19 study performance prediction
Effective Security Operations Center (SOC) A Modern, Strategic, and Threat-In...
How UI/UX Design Impacts User Retention in Mobile Apps.pdf
cuic standard and advanced reporting.pdf
Mobile App Security Testing_ A Comprehensive Guide.pdf
Diabetes mellitus diagnosis method based random forest with bat algorithm
Teaching material agriculture food technology
Digital-Transformation-Roadmap-for-Companies.pptx
Bridging biosciences and deep learning for revolutionary discoveries: a compr...
PA Analog/Digital System: The Backbone of Modern Surveillance and Communication

.NET Debugging Workshop

  • 1. .NET Debugging Workshop #devconnections
  • 2. SESSION TITLE #devconnections Sasha Goldshtein CTO, Sela Group Microsoft C# MVP, Azure MRS @goldshtn blog.sashag.net #devconnections
  • 3. .NET DEBUGGING WORKSHOP In This Workshop… • Debugging issues in production environments • Automating triage and analysis processes • Analyzing system and application performance #devconnections
  • 4. .NET DEBUGGING WORKSHOP Production Debugging • Requirements – Obtain actionable information about crashes and errors – Obtain accurate performance information • Limitations – Can’t install Visual Studio – Can’t suspend production servers – Can’t run intrusive tools #devconnections
  • 5. .NET DEBUGGING WORKSHOP In the DevOps Process… • Automatic build (CI) • Automatic deployment (CD) • Automatic monitoring • Automatic error triage and analysis • Automatic remediation #devconnections
  • 6. .NET DEBUGGING WORKSHOP The Tools • Sysinternals Procdump • DebugDiag • Windows SDK – Debugging Tools for Windows – Windows Performance Toolkit • PerfView #devconnections
  • 8. .NET DEBUGGING WORKSHOP Dump Files • A user dump is a snapshot of a running process • A kernel dump is a snapshot of the entire system • Dump files are useful for post-mortem diagnostics and for production debugging – Anytime you can’t attach and start live debugging, a dump might help #devconnections
  • 9. .NET DEBUGGING WORKSHOP Limitations of Dump Files • A dump file is a static snapshot – You can’t debug a dump, just analyze it – Sometimes a repro is required (or more than one repro) • Sometimes several dumps must be compared #devconnections
  • 10. .NET DEBUGGING WORKSHOP Taxonomy of Dumps • Crash dumps are dumps generated when an application crashes • Hang dumps are dumps generated on-demand at a specific moment • These are just names; the contents of the dump files are the same! #devconnections
  • 11. .NET DEBUGGING WORKSHOP Generating a Hang Dump • Task Manager, right-click and choose “Create Dump File” – Creates a dump in %LOCALAPPDATA %Temp #devconnections
  • 12. .NET DEBUGGING WORKSHOP Procdump • Sysinternals utility for creating dumps • Examples: Procdump -ma app.exe app.dmp Procdump -ma -h app.exe hang.dmp Procdump -ma -e app.exe crash.dmp Procdump -ma -c 90 app.exe cpu.dmp Procdump -m 1000 -n 5 -s 600 -ma app.exe #devconnections
  • 13. .NET DEBUGGING WORKSHOP Windows Error Reporting • WER can create dumps automatically – HKLMSoftwareMicrosoftWindows Windows Error ReportingLocalDumps – http://tinyurl.com/localdumps • Can be application-specific, not system-wide #devconnections
  • 14. .NET DEBUGGING WORKSHOP DebugDiag • Microsoft tool for monitoring and dump generation – Very suitable for ASP.NET – Dump analysis component included #devconnections
  • 15. .NET DEBUGGING WORKSHOP Debugging Symbols • Debugging symbols link runtime memory addresses to function names, source file names and line numbers – PDB files – Required for proper debugging and dump analysis #devconnections
  • 16. .NET DEBUGGING WORKSHOP Symbols for Microsoft Binaries • Microsoft has a public symbol server with PDB files for Microsoft binaries • Configure _NT_SYMBOL_PATH environment variable setx _NT_SYMBOL_PATH srv*C:symbols*http://msdl.microsoft.com/download/symbols #devconnections
  • 17. .NET DEBUGGING WORKSHOP Opening Dump Files • Visual Studio can open dump files – For .NET, CLR 4.0+ and VS2010+ required – VS2013 recommended #devconnections
  • 18. .NET DEBUGGING WORKSHOP Opening Dump Files • WinDbg is a free lightweight debugger • No intrinsic .NET support, but has SOS debugging extension !analyze -v (CLR 4.0+) .loadby sos clr !printexception !clrstack #devconnections
  • 19. .NET DEBUGGING WORKSHOP Configuring LocalDumps Obtaining and opening a dump file TRY IT OUT #devconnections
  • 20. Automatic Dump Analysis #devconnections
  • 21. .NET DEBUGGING WORKSHOP Basic Automation • Run WinDbg automatically on a bunch of files and log its output: @echo off for %%f in (.*.dmp) do ( echo Launching analysis of file %%f... start "Analyzing %%f" "C:Program Files (x86)Windows Kits8.1Debuggersx86cdb.exe" -z %%f -c ".logopen %%f.log; !analyze -v; .logclose; qd" ) #devconnections
  • 22. .NET DEBUGGING WORKSHOP Basic Automation • Parse the results for interesting tokens: for %%f in (.*.dmp.log) do ( echo In file %%f: findstr "EXCEPTION_MESSAGE MANAGED_OBJECT_NAME" %%f ) #devconnections
  • 23. .NET DEBUGGING WORKSHOP ClrMD • Text-based analysis of debugger command output is very fragile and limited • ClrMD is a .NET library for analyzing dump files (and running processes) – A managed API for interacting with the .NET debugging runtime (“SOS API”) – Distributed through NuGet (search “ClrMD”) #devconnections
  • 24. .NET DEBUGGING WORKSHOP ClrMD Basic Classes #devconnections DDaattaaTTaarrggeett CCllrrRRuunnttiimmee CCllrrRRuunnttiimmee CCllrrHHeeaapp CCllrrTThhrreeaadd CCllrrTTyyppee CCllrrTTyyppee CCllrrTThhrreeaadd
  • 25. .NET DEBUGGING WORKSHOP mscordacwks.dll • Managed dump analysis requires mscordacwks.dll matching the CLR version • It can be automatically downloaded from the Microsoft symbol server in most cases #devconnections
  • 26. .NET DEBUGGING WORKSHOP Connecting to a Target #devconnections
  • 27. .NET DEBUGGING WORKSHOP Basic Exception Triage #devconnections
  • 28. .NET DEBUGGING WORKSHOP Getting stacks from a live process TRY IT OUT #devconnections
  • 29. .NET DEBUGGING WORKSHOP Inspecting the Heap • Enumerate all heap objects and statistics • Find specific objects • Inspect GC information (roots, finalization queues, etc.) #devconnections ClrHeap EnumerateObjects GetObjectType EnumerateRoots ClrType GetSize EnumerateRefsOfObject GetFieldValue
  • 30. .NET DEBUGGING WORKSHOP Wait Information • Threads have a list of blocking objects, which have owner threads • Wait analysis and deadlock detection is made possible ClrThread BlockingObjects BlockingObject Reason Object HasSingleOwner Owner/Owners Waiters #devconnections
  • 31. ETW and PerfView #devconnections
  • 32. .NET DEBUGGING WORKSHOP Event Tracing for Windows • High-performance facility for emitting 100K+ log events per second with rich payloads and stack trace support • Used widely across Windows, .NET, drivers, services, third party components #devconnections
  • 33. .NET DEBUGGING WORKSHOP ETW Participants • A provider generates ETW events • A controller starts and stops ETW collection • A consumer logs, analyzes, or processes ETW events #devconnections
  • 34. .NET DEBUGGING WORKSHOP ETW Scenarios • Profile an app in sampling mode • Perform wait-time analysis • Log disk accesses including stacks • Log GC and JIT events • Log memory allocation statistics (C++) • Custom application event log #devconnections
  • 35. .NET DEBUGGING WORKSHOP Custom ETW Events #devconnections
  • 36. .NET DEBUGGING WORKSHOP ETW Tools • xperf.exe: Command-line tool for ETW capturing and processing • wpr.exe: Command-line and GUI for end users • wpa.exe: Visual trace analysis tool • PerfView.exe: Visual tool for capturing and recording ETW events from managed providers and the CLR #devconnections
  • 37. .NET DEBUGGING WORKSHOP Capturing a Trace • Xperf xperf -on DiagEasy ... xperf -d diag.etl • WPR #devconnections
  • 38. .NET DEBUGGING WORKSHOP What’s In A Trace? • A trace is a huge list of events • Events have multiple columns (payload) • Useless without additional processing #devconnections
  • 39. .NET DEBUGGING WORKSHOP Trace Processing with Xperf • I/O summary report per file xperf -i fileio.etl -o fileio.csv -a diskio -summary • Interactive profiling report (for a specific process) xperf -i cpu.etl -o cpu.html -symbols -a stacks -process app.exe -butterfly #devconnections
  • 40. .NET DEBUGGING WORKSHOP Managed Stacks • To display managed stack traces correctly, additional CLR data is required • WPR & PerfView take care of this automatically • If using Xperf, see: http:// msdn.microsoft.com/en-us/library/windows/desktop/#devconnections
  • 41. .NET DEBUGGING WORKSHOP Collecting file I/O information TRY IT OUT #devconnections
  • 42. .NET DEBUGGING WORKSHOP Trace Analysis with WPA List of graphs List of graphs #devconnections Graph display Graph display Ungrouped Ungrouped columns Grouped columns columns Grouped columns Grouping Grouping bar bar
  • 43. .NET DEBUGGING WORKSHOP Stack Summaries • Learn how to read stack summaries – Group by Stack column – Expand “hot path”, like in profiler • Stack resolution requires symbols (slow) #devconnections
  • 44. .NET DEBUGGING WORKSHOP PerfView • ETW collection and analysis tool tailored for .NET applications (but not only) • Can be used as a sampling profiler • Can be used as an allocation profiler • Can be used for heap snapshot analysis #devconnections
  • 45. .NET DEBUGGING WORKSHOP Collecting Data w/ PerfView • CLI PerfView run app.exe • GUI #devconnections
  • 46. .NET DEBUGGING WORKSHOP PerfView Collection Options Profiling wall-clock Profiling wall-clock time time CPU sampling profiling #devconnections File/registry accesses File/registry accesses Allocation profiling Allocation profiling CPU sampling profiling
  • 47. .NET DEBUGGING WORKSHOP PerfView Tables Grouping options Filtering Grouping options #devconnections Filtering options options CCaalll ls tsatacckk t rtereee In-trace activity highlighter In-trace activity highlighter
  • 48. .NET DEBUGGING WORKSHOP Memory Leak Analysis • PerfView can generate heap snapshots (smaller than a dump), analyze, and compare them • Can also import dumps directly #devconnections
  • 49. .NET DEBUGGING WORKSHOP Leak analysis with PerfView TRY IT OUT #devconnections
  • 50. .NET DEBUGGING WORKSHOP Automatic ETW Analysis • The TraceEvent library provides an API for ETW analysis – Understands kernel and CLR events – Supports call stacks (incl. managed) #devconnections
  • 51. .NET DEBUGGING WORKSHOP Example Analysis Scenarios • Monitor the system for CLR exceptions w/ stacks ExceptionTraceData • Get a profiling trace and look for regressions TraceLog SampledProfileTraceData TraceCallStack #devconnections
  • 52. .NET DEBUGGING WORKSHOP Summary • Production debugging and performance investigation is here, and entirely possible thanks to dumps and ETW traces • Integrate automatic error analysis and triage into your devops process #devconnections
  • 53. SESSION TITLE Rate This Session Now! #devconnections Rate with Mobile App: 1. Select the session from the Agenda or Speakers menus 2. Select the Actions tab 3. Click Rate Session Rate Using Our Website: 1. Register at www.devconnections.com/logintoratesession 2. Go to www.devconnections.com/ratesession 3. Select this session from the list and rate it Tell Us What You Thought of This Session Be Entered to WIN Prizes!