locked
Detect similar crashes by callstack RRS feed

  • Question

  • Hi,
    Our customers sometimes reports crash dumps (*.dmp files). These files contain information about occurred crash (callstack, file versions and other information). It happens that the same error could be reported by several different customers. We need a way to determine duplicates not to perform analysis several times.

    Friday, January 15, 2010 1:01 PM

Answers

  • Hi Stas,

    Thanks for your post.

    Sorry that I am not clear about the question. Do you want to use some way to automate the process to identify same cause dump file? Please let me know if it is not.

    Windows Debugging Tools provides a set of COM API to let you analyze dump files programmatically. Throught the COM API, you can get most of the information a debugger can get including call stack of dump. For detail, please check: Debugger Engine and Extension API.

    For your reference, Microsoft is doing the same process to simplify duplicate error identification. The way used by Windows Error Reporting system is to classify the error is by bucket ID. A user-mode crash bucket ID is classified by:
    Application name — for example, winword.exe
    Application version — for example, 10.0.2627.0
    Module name — for example, mso.dll
    Module version — for example, 10.0.2613.1
    Offset into module — for example, 00003cbb
    For detail, please refer to: http://www.microsoft.com/whdc/winlogo/maintain/WER/ErrClass.mspx

    Hope it helps. Thanks.

    Hongye Sun [MSFT]
    MSDN Subscriber Support in Forum
    If you have any feedback on our support, please contact msdnmg @ microsoft.com

    Please remember to mark the replies as answers if they help and unmark them if they provide no help.
    Welcome to the All-In-One Code Framework! If you have any feedback, please tell us.
    See what's happening in MSDN forum? Follow us at Twitter.
    Monday, January 18, 2010 5:36 AM

All replies

  • Hi Stas,

    Thanks for your post.

    Sorry that I am not clear about the question. Do you want to use some way to automate the process to identify same cause dump file? Please let me know if it is not.

    Windows Debugging Tools provides a set of COM API to let you analyze dump files programmatically. Throught the COM API, you can get most of the information a debugger can get including call stack of dump. For detail, please check: Debugger Engine and Extension API.

    For your reference, Microsoft is doing the same process to simplify duplicate error identification. The way used by Windows Error Reporting system is to classify the error is by bucket ID. A user-mode crash bucket ID is classified by:
    Application name — for example, winword.exe
    Application version — for example, 10.0.2627.0
    Module name — for example, mso.dll
    Module version — for example, 10.0.2613.1
    Offset into module — for example, 00003cbb
    For detail, please refer to: http://www.microsoft.com/whdc/winlogo/maintain/WER/ErrClass.mspx

    Hope it helps. Thanks.

    Hongye Sun [MSFT]
    MSDN Subscriber Support in Forum
    If you have any feedback on our support, please contact msdnmg @ microsoft.com

    Please remember to mark the replies as answers if they help and unmark them if they provide no help.
    Welcome to the All-In-One Code Framework! If you have any feedback, please tell us.
    See what's happening in MSDN forum? Follow us at Twitter.
    Monday, January 18, 2010 5:36 AM
  • Hi Stas,

    I am writing to follow up this issue. Please let me know if you still have any question on it. Thanks.

    Hongye Sun [MSFT]
    MSDN Subscriber Support in Forum
    If you have any feedback on our support, please contact msdnmg @ microsoft.com

    Please remember to mark the replies as answers if they help and unmark them if they provide no help.
    Welcome to the All-In-One Code Framework! If you have any feedback, please tell us.
    See what's happening in MSDN forum? Follow us at Twitter.
    Monday, January 25, 2010 3:57 AM
  • Hi Hongye,

    Thank you for your reply, it helped a lot.
    Monday, January 25, 2010 7:36 AM