BiteSizedChunks.comLearn one small thing at a time.
Course contentsShow
← C#
Lesson 1764 of 1,90816. Performance and DiagnosticsFree lesson

Using Minidumps for Post-Mortem Analysis

Learners will capture and inspect process memory dumps after a crash to find the root cause.

In this lesson, you will learn how to capture and inspect process minidumps to diagnose the precise state of your application at the exact moment of a crash.

When an application encounters an unhandled exception or enters an irrecoverable state, logs often only tell you that something went wrong, not why. A minidump is a snapshot of your process memory that acts as a "flight data recorder," allowing you to perform post-mortem debugging long after the process has terminated.

Capturing the Dump

In modern .NET environments, you don't necessarily need to attach a debugger beforehand. You can configure your environment to automatically generate a dump file when a crash occurs by setting environment variables. On Windows, setting COMPlus_DbgMiniDumpName provides a file path, while COMPlus_DbgMiniDumpType defines the content (e.g., Full for all memory or Mini for minimal thread/stack info).

Alternatively, if the process is still running but unresponsive, you can use the dotnet-dump CLI tool:

# Capture a dump of a running process
dotnet-dump collect -p <PID>

Analyzing the Dump

Once you have the .dmp file, you load it into a tool like WinDbg, Visual Studio, or the dotnet-dump analyzer. The analysis process involves inspecting the managed heap and thread stacks to find the culprit:

  1. Identify the Exception: Use clrstack or pe (print exception) to see which thread triggered the crash and what the call stack looked like.
  2. Inspect Managed Objects: Use dumpheap -stat to see if a memory spike caused an OutOfMemoryException.
  3. Cross-Reference: Check the objects in memory against your known code structures to see if a corrupted object or an unexpected null reference led to the termination.

By examining the thread state and local variables preserved in the dump, you can identify why an Async state machine was in an invalid state or why a lock was never released, effectively "freezing time" to perform surgery on a ghost process.

Key Takeaway: Minidumps transform opaque, production-level crashes into reproducible debugging sessions by capturing the full memory context of your process at the time of failure.