标签: sos

背景:我是WinDbg的新手并试图让它第一次运行.我想检查一下从Windows Server 2008(x86)上的IIS 7中运行的运行的ASP.NET 4站点获取的内存转储,并下载到我的本地计算机.

我安装了调试工具并首次启动了WinDbg,打开了故障转储.我去了File | 符号文件路径并设置路径*srv*c:\symbols*http://msdl.microsoft.com/download/symbols*并等待加载的所有符号.

在尝试加载SOS时,我遇到了问题.首先,我尝试了以下命令......

.loadby sos mscorwks

......并收到了答复Unable to find module 'mscorwks'.

在搜索网页后,我尝试通过执行以下命令来加载mscorwks ...

sxe ld mscorwks.dll
g

...并收到响应"'g'中没有可运行的调试对象错误"

我将SOS.dll(从C:\ Windows\Microsoft.NET\Framework\v4.0.30319)复制到WinDbg目录中,然后尝试...

.load sos

......并收到错误......

The call to LoadLibrary(sos) failed, Win32 error 0n193
    "%1 is not a valid Win32 application."
Please check your debugger configuration and/or network access.

我不太清楚如何继续.我只是想加载SOS并挖掘这个转储文件.任何帮助将不胜感激.

Fyi ...我正在尝试使用64位版本的Windbg在64位版本的Windows 7上打开转储文件.

我的一些应用程序出了问题.它是在Windows 2003 Server(x86)中的IIS6下运行的基于wcf的应用程序:
在事件日志中,我从"W3SVC-WP"源(EventID = 2262)得到这样的错误:

ISAPI 'C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll' reported itself as unhealthy for the following reason: 'Deadlock detected'.

我正在尝试弄清楚发生了什么.我已按照此KB中的描述为Orphan Worker Process设置了转储.发生死锁时会创建一个小型转储.
然后我拿这个小型泵试图了解发生了什么.这是我被困住了.

我运行WinDbg x86,打开我的转储然后:

0:037> .loadby sos clr
0:037> .sympath SRV*c:\temp\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*c:\temp\symbols*http://msdl.microsoft.com/download/symbols
Expanded Symbol search path is: srv*c:\temp\symbols*http://msdl.microsoft.com/download/symbols
0:037> !clrstack
The version of SOS does not match the version of CLR you are debugging.  Please load the matching version of SOS for the version of CLR you are debugging.
CLR Version: 4.0.30319.1
SOS Version: …

"罢工之子"这个名字有什么意义？它有什么意义,还是听起来很酷？

我有以下转储委托对象:

Name: MyEventHandler  
MethodTable: 132648fc  
EEClass: 1319e2b4  
Size: 32(0x20) bytes  
Fields:  
     MT    Field   Offset                 Type VT     Attr    Value Name  
790fd0f0  40000ff        4        System.Object  0 instance 014037a4 _target  
7910ebc8  4000100        8 ...ection.MethodBase  0 instance 00000000 _methodBase  
791016bc  4000101        c        System.IntPtr  1 instance 2ef38748 _methodPtr  
791016bc  4000102       10        System.IntPtr  1 instance        0 _methodPtrAux  
790fd0f0  400010c       14        System.Object  0 instance 00000000 _invocationList  
791016bc  400010d       18        System.IntPtr  1 instance        0 _invocationCount  

如何获取委托指出的方法名称？

我发现"EE"对我来说是一个神奇的词.

在CLR内部,有一个"EEClass",它由CLR类加载器创建.而且我不知道它为何被称为EEClass.

现在,来到SOS世界,这里有更多的EE,比如EEHeap,EEStack [-EE],Name2EE ....它们在这里代表相同的含义吗？

我正在尝试使用WinDBG来分析我们的一台生产机器的崩溃转储.我的问题的根源似乎是我有一个不同于生产机器的.NET框架版本,只是我不知道如何解决问题.当我转!sym吵闹然后运行!dlk(来自SOSEX)我得到以下错误,因为它试图找到mscordacwks dll

0:000> !dlk
CLRDLL: c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll:2.0.50727.3623 f:0
doesn't match desired version 2.0.50727.3607 f:0
SYMSRV:  c:\mysymbols\mscordacwks_x86_x86_2.0.50727.3607.dll\4ADD5446590000\mscordacwks_x86_x86_2.0.50727.3607.dll not found
SYMSRV:  http://msdl.microsoft.com/download/symbols/mscordacwks_x86_x86_2.0.50727.3607.dll/4ADD5446590000/mscordacwks_x86_x86_2.0.50727.3607.dll not found
SYMSRV:  c:\mysymbols\mscordacwks_x86_x86_2.0.50727.3607.dll\4ADD5446590000\mscordacwks_x86_x86_2.0.50727.3607.dll not found
SYMSRV:  c:\mysymbols\mscordacwks_x86_x86_2.0.50727.3607.dll\4ADD5446590000\mscordacwks_x86_x86_2.0.50727.3607.dll not found
SYMSRV:  http://msdl.microsoft.com/download/symbols/mscordacwks_x86_x86_2.0.50727.3607.dll/4ADD5446590000/mscordacwks_x86_x86_2.0.50727.3607.dll not found
SYMSRV:  c:\mysymbols\mscordacwks_x86_x86_2.0.50727.3607.dll\4ADD5446590000\mscordacwks_x86_x86_2.0.50727.3607.dll not found
CLRDLL: Unable to find mscordacwks_x86_x86_2.0.50727.3607.dll by mscorwks search
CLRDLL: Unable to find 'mscordacwks_x86_x86_2.0.50727.3607.dll' on the path
SYMSRV:  c:\mysymbols\mscorwks.dll\4ADD5446590000\mscorwks.dll not found
SYMSRV:  http://msdl.microsoft.com/download/symbols/mscorwks.dll/4ADD5446590000/mscorwks.dll not found
SYMSRV:  c:\mysymbols\mscorwks.dll\4ADD5446590000\mscorwks.dll not found
DBGHELP: C:\Program Files\Debugging Tools for Windows (x86)\mscorwks.dll - file not found
SYMSRV:  c:\mysymbols\mscorwks.dll\4ADD5446590000\mscorwks.dll not found …

我试图了解32位和64位处理器之间的对象大小差异.假设我有一个简单的课程

class MyClass   
{  
    int x;  
    int y;  
}  

所以在32位机器上,整数是4个字节.如果我将Syncblock添加到其中(另外4个字节),则对象大小将为12个字节.为什么显示16个字节？

0:000> !do 0x029d8b98  
Name: ConsoleApplication1.Program+MyClass  
MethodTable: 000e33b0  
EEClass: 000e149c  
Size: 16(0x10) bytes  
 (C:\MyTemp\ConsoleApplication1\ConsoleApplication1\bin\x86\Debug\ConsoleApplication1.exe)  
Fields:  
      MT    Field   Offset                 Type VT     Attr    Value Name  
71972d70  4000003        4         System.Int32  1 instance        0 x  
71972d70  4000004        8         System.Int32  1 instance        0 y  

在64位机器上,一个整数仍然是4个字节,唯一改变的是Syncblock将是8个字节(因为指针是64位机器上的8个字节).这意味着对象大小将是16个字节.为什么显示24个字节？

0:000> !do 0x00000000028f3c90  
Name: ConsoleApplication1.Program+MyClass  
MethodTable: 000007ff00043af8  
EEClass: 000007ff00182408  
Size: 24(0x18) bytes  
 (C:\MyTemp\ConsoleApplication1\ConsoleApplication1\bin\Debug\ConsoleApplication1.exe)  
Fields:  
              MT    Field   Offset                 Type VT     Attr            Value Name  
000007fef4edd998  4000003        8         System.Int32  1 instance                0 x  
000007fef4edd998 …

我有一个来自生产服务器的崩溃转储,显示OutOfMemoryException.例外本身与此无关.

我碰巧运行了一个!dso来查看堆栈对象:

0:042> !dso
OS Thread Id: 0x1014 (42)
ESP/REG  Object   Name
246eeb24 109a21bc System.UnhandledExceptionEventHandler
246eeb2c 39083998 System.Runtime.Remoting.Proxies.__TransparentProxy
246eeb34 39083b5c System.UnhandledExceptionEventArgs
246eeb48 39073280 System.Byte[]
246eec10 2e720050 System.OutOfMemoryException
[snip]
246ef250 0ac1c4d0 System.IO.MemoryStream <-- interesting

我以为MemoryStream可能与错误有关,所以我把它丢弃了:

0:042> !do 0ac1c4d0 
Name: System.IO.MemoryStream
MethodTable: 7932d5e4
EEClass: 790ec318
Size: 52(0x34) bytes
 (C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll)
Fields:
      MT    Field   Offset                 Type VT     Attr    Value Name
7933061c  400018a        4        System.Object  0 instance 00000000 __identity
7992cbcc  4001b6c        8 ...ream+ReadDelegate  0 instance 00000000 _readDelegate
7992cc58  4001b6d        c ...eam+WriteDelegate  0 instance 00000000 _writeDelegate …

我正在研究为什么托管进程使用大量内存.有没有办法GC.Collect(3)从WinDbg 运行,以便我可以专注于实际的内存分配？

0:025> !pe
Failed to load data access DLL, 0x80004005
Verify that 1) you have a recent build of the debugger (6.2.14 or newer)
            2) the file mscordacwks.dll that matches your version of mscorwks.dll is 
                in the version directory
            3) or, if you are debugging a dump file, verify that the file 
                mscordacwks_<arch>_<arch>_<version>.dll is on your symbol path.
            4) you are debugging on the same architecture as the dump file.
                For example, an IA64 dump file must be debugged on an …