Capturing Crash Dumps for Analysis

Sometimes, folks report crashes to the IE team that we are unable to reproduce internally. That’s usually because, as mentioned often, most crashes are caused by buggy browser add-ons.

In some cases, however, crashes occur even when running with browser add-ons off, and if we cannot reproduce the problem, the next best thing is a crash dump file from the affected machine.

Collecting crash dumps isn’t hard:

  1. Install WinDBG from (See the “Standalone Debugging Tools” section)
  2. Configure WinDBG to run whenever a crash occurs: In an elevated command prompt, run WinDBG with the -I (case-sensitive) parameter.  For instance: 

    C:\debuggers\windbg.exe –I

  3. When the crash occurs, WinDBG opens.  Type the following command to generate a .DMP file:

    .dump /ma %USERPROFILE%\Desktop\IECrash.dmp

Dump files tend to be dozens to hundreds of megabytes in size, so they typically cannot be readily passed around via email (although they often compress well). If a DMP file is requested, the person asking for the file will typically tell you how to return the file to them.

If you allowed the “Watson” Windows Error Reporting system to upload a crash report, you can help us find “your” crash by letting us know the “bucket number.” All Windows Error reporting logs are presented in the event viewer as Event ID 1001.  After the crash report is sent, go into Computer Management and drill down to Event Viewer\Windows Logs\Applications, search for the Event ID 1001 that corresponds to the time the crash occured, open it up, the failure bucket id will be listed there.

Depending on the problem reported, we may also want to get a network traffic log or a Process Monitor log


Update: The Visual Studio team just posted a blog on capturing dumps with Visual Studio or Task Manager.

Comments (5)

  1. EricLaw [MSFT] says:

    MarkRuss just blogged about analyzing IE crashes here:…/3335060.aspx

  2. @chentiangemalc blogged about collecting crash dumps without WinDBG here:…/case-of-the-totally-broken-trustedinstaller

  3. Another post on crash dumps; the last option may be the simplest:…/configuring-automatic-crash-dumps.aspx

  4. abhinavvaid says:

    It’s a classic example with IE Browser where the reproducibility is not 100%. While capturing the crash dump is a good idea, but it does not capture every IE exception. Attaching a debugger is also a good idea but then it increases the system overhead. Configuring a custom view under Event Viewer and enabling Event Level can help with a minimal overhead. Even tasks, triggers, events can be attached to the specific exception events.

  5. Yet another topic on getting dump files:…/what-is-a-dump-and-how-do-i-create-one.aspx including Visual Studio, Task Manager, and ProcDump.