How to create a user dump file for an unresponsive process

Technical Articles ID: KB82827
Last Modified: 7/2/2021

Environment

McAfee Endpoint Security (ENS) 10.x

Summary

When a process is not responding, you can generate a user-mode dump file for the specific process with a debugging tool such as userdump.exe from Microsoft. You can also perform extra functions with the Microsoft Debug Diagnostic Tool.

The Debug Diagnostic Tool allows you to specify other processes for which to obtain dumps. The additional processes are useful when troubleshooting issues where you believe that ENS might have caused the process to stop responding.

Solution 1

To obtain a user-mode dump file with the userdump.exe utility:

Download the userdump.exe utility from the Microsoft userdump.exe utility page.
Extract userdump.exe to the root of the C:\ drive.
Press Windows+R, type cmd, and click OK.
At the prompt, type: C:\
Use the following syntax to create the dump file:

userdump <process_name> <dump_file>

Where:
<process_name> is the name of the executable file that corresponds to the unresponsive process
<dump_file> is the name of the user-mode dump file

Example:
To create a dump file for the sqlservr process, the command would be:

C:\userdump sqlservr.exe sqlservr.dmp

This command generates a user-mode dump named sqlservr.dmp for the sqlservr process.

The new dump file is saved in the root of the C: drive.

Solution 2

If a running third-party process is closing with an exception or memory reference error while ENS is running, do the following:

Install the Microsoft Debug Diagnostic Tool on the client. This tool is available from the Microsoft Debug Diagnostic Tool page.
Configure the Debug Diagnostic Tool to monitor the process:
1. Open the Debug Diagnostic Tool user interface.
2. Click Add Rule and click Next.
3. Select Crash for the rule type and click Next.
4. Select A specific process, highlight the running process that you want to monitor, and click Next.
5. Under Advanced Configuration, set the Action type for Unconfigured first chance exceptions to None and click Next.
6. Select a rule name and dump location.
7. Activate the rule and click Finish.
  
  The Debug Diagnostic Tool creates a user-mode process dump for the configured process when a process termination occurs.
Use the Debug Diagnostic Tool to obtain another dump for the McAfee FireSvc.exe process:
1. Open the Debug Diagnostic Tool user interface.
2. Navigate to the Processes tab.
3. Right-click the FireSvc.exe process.
4. To create a process dump, select Create Full Userdump.
To collect system information and logs, run the McAfee WebMer information tool on the client. For instructions, see: KB59385 - How to use MER tools with supported McAfee products.

Solution 3

Use the following method to obtain a user-mode dump file only for Windows Vista, Windows 7, Windows Server 2008, and Windows Server 2008 R2 platforms:

Press Ctrl+Alt+Del, and then select Task Manager.
Identify a process for which to create the dump.
Right-click the process and select Create dump file.

NOTE: The dump file is created in your Windows Temp folder and is named ProcessName.dmp.
Navigate to the temp folder by typing %temp% in the Windows address bar or command prompt, and press Enter. By default, this folder is located at C:\Users\<user>\AppData\Local\Temp.

Affected Products

Diagnostic Data Collection
Endpoint Security Firewall 10.7.x
Endpoint Security Firewall 10.6.x
Endpoint Security Threat Prevention 10.7.x
Endpoint Security Threat Prevention 10.6.x
Endpoint Security Web Control 10.7.x
Endpoint Security Web Control 10.6.x
Troubleshooting

Languages:

This article is available in the following languages:

German
English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro
Chinese Simplified

Knowledge Center

How to create a user dump file for an unresponsive process

Environment

Summary

Solution 1

Solution 2

Solution 3

Affected Products

Languages:

Title

Title

Knowledge Center

How to create a user dump file for an unresponsive process

Environment

Summary

Solution 1

Solution 2

Solution 3

Affected Products

Languages:

Choose your region

Title

Title