How do I capture a process dump of a crashing application for Support?

A full process dump from a crashing application can quite often assist Support to determine what exactly is causing the application crash.

How to Capture a Process Dump a Crashing Application

There are quite a few ways of obtaining a full process dump file, although this isn’t typically created by default.

The easiest method is going to the Windows Task Manager before clicking on anything after the process has crashed (Windows Start > Run > taskmgr) and then right-click on the process you would like to collect a dump file from (we’re using Oxygen in our example):

If the application process isn’t listed, you have to capture the dump by adding a key to your registry and restarting Windows.

  1. To do so, the following registry key and value must be created:
  
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps] 
'DumpType'=dword:00000002
  
Note:  The 'LocalDumps' subkey does not typically exist by default, and must be created in addition to the actual 'DumpType' DWORD value within that subkey.

This will cause future crashes captured by WER (Windows Error Reporting) to have full process dumps written. The full process dumps caused by the 'DumpType' configuration are written to a '%LOCALAPPDATA%\CrashDumps' directory, which is relative to the current user profile.

So if a normal desktop application like XMetaL crashes, the full process dumps will be written to the 'C:\Users<username>\AppData\Local\CrashDumps\' directory for the interactive user who was logged on. If the application isn’t 'running as a user' and crashes, then the full process dumps will be written to 'C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\', which is the user profile area used by Windows system components.

2. After establishing the 'DumpType' configuration. restart Windows to be sure WER will be using the new 'DumpType' configuration, and then reproduce the issue or wait for the crash to happen again, at which point a full process dump should now be captured by WER and sent to us.

3. Ensure you remove this key after the dump file has been captured.