1

My machine is a Windows 10 and it freezes for 2 mins, which is really disruptive. The things is that everything is so slow I don't get to see list of process in order to investigate further.

  1. What is the best way capture the process causing the issue?
  2. Based on what factors do I need to filter the process list in order to find the troublesome process? (From previous experience, I know I should be looking at the memory usage and CPU usage while spikes happen. Please let me know what else I should be looking at?)

I have used prefmon to find the time of CPU and memory peaks. I am more curious to find a way to find the troublesome process. One simple trick I did is that I scheduled a job to dump tasklist output into a text file every minute. But, I could see the scheduled job was NOT running for 3-4 minutes when the peaks were happening.

1 Answer 1

1

One approach would be to crash the entire machine and get a "Full" memory dump when you know it's hung.

You should setup the computer in advance to initialize a crash from the keyboard by following this KBA:

You also need to configure the computer to create a full dump. A quick Google came up with:

Either way I'll assume at this point you can get a memory.dmp file when the computer was in the hung state, then you can:

  1. Download the Windows SDK in order to install just the Debugging Tools component. This will get you Windbg i.e. C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\windbg.exe

  2. Launch Windbg and load in the dump file. "File" → "Open Crash dump".

  3. Now this is where it can get heavy, but if you want just a easy to use process tree you can use an extension called DbgKit. To use it, copy the 64-bit dll into C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\winext\

  4. In Windbg, load the extension using the following command:

    .load dbgkit
    

    The following command will show that it's loaded:

    .chain
    
  5. You can then run:

    !dbgkit.ps
    

This will give you a Process Explorer-type view of the dump so you can see what the processes were doing. It will take a while to extract various information but it will give you what you're after.

Hopefully this will be a good start. Beyond this I would suggest reviewing a few videos in The Defrag Tools series on Channel 9 on how to debug a memory dump for a hang.

1
  • I just hope the machine would crash as soon as you press the manual crash shortcut keys... not after the freeze cleared the pipeline.
    – user477799
    Jan 21, 2017 at 10:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .