Capture IIS Application Pool (Worker Process) crash dumps using Debug Diagnostic Tool

Download and install the Debug Diagnostic Tool from https://www.microsoft.com/en-us/download/details.aspx?id=103453.

Once installed, open DebugDiag 2 Collection, select Crash as the Rule Type, then click Next.

Choose A specific IIS web application pool as the Target Type, then click Next.

Select the IIS application pool from which you want to capture crash dumps, then click Next.

If you don't know the application pool corresponding to your IIS website, please refer to the steps below to retrieve it.

• Press the Win key + R or right-click the Start menu and click on Run to open the Run dialog. Then, type inetmgr and press Enter to open the IIS Manager.

  

• Right-click on the website for which you want to retrieve the Application Pool, then select Manage Website -> Advanced Settings.... In the Advanced Settings window that pops up, you will find the name of the Application Pool corresponding to the website.

  

In the Advanced Configuration page, click Breakpoints... to enter the Configure Breakpoints page, then click Add Breakpoint....

Select the first option from the list: Ntdll!ZwTerminateProcess. This value will automatically fill the Breakpoint Expression box. Set Action Type to Full Userdump and Action Limit to 5. Click OK to save. You should then see the entry you just configured in the Breakpoints list. Click Save & Close to close the current window.

You will return to the Advanced Configuration page. Keep all other settings as default, then click Next.

Here, an automatically generated Rule name and a default path for saving crash dumps will be provided. If you want to change the path, choose your preferred location for saving crash dumps, then click Next.

If you want the rule monitoring Application Pool crashes to take effect immediately, select Activate the rule now and then click Finish.

DebugDiag might display a confirmation box regarding the Symbol search path. Click Yes.

At this point, you should see the rule you just created in the Rules list, which means the configuration is complete. Now we just wait for the application pool to crash next time. DebugDiag will automatically capture the crash dump.

After the Application Pool crashes, open DebugDiag 2 Collection. You can check whether the Userdump Count has increased to confirm whether the crash dump was successfully captured. Then, you can find the corresponding crash dump file in the userdump path.

After obtaining the crash dump, if you no longer want to use this rule, you can right-click on the rule and choose Remove Rule to remove it, or Deactivate Rule to disable it but keep the settings for future use.