ProcDump与Procexp一样是Windows平台上的内部调试工具，Procexp采用图形界面体现系统整体及个别进程的性能信息，而ProcDump则与我们在Unix平台上使用的性能分析工具类似使用CLI命令行界面。
Procdump目前的版本号为3.04，可以从其Homepage上下载到该工具，该监控软件由Mark Russinovich开发，是一款Free Software。其官方介绍如下:
ProcDump is a command-line utility whose primary purpose is monitoring an application for CPU spikes and generating crash dumps during a spike that an administrator or developer can use to determine the cause of the spike. ProcDump also includes hung window monitoring (using the same definition of a window hang that Windows and Task Manager use), unhandled exception monitoring and can generate dumps based on the values of system performance counters. It also can serve as a general process dump utility that you can embed in other scripts.
Procdump可以用于监控应用进程的CPU峰值，并在峰值阶段生成crash dump转储信息，其功能还包括：
- 监控hang住的窗口
- 可以为未处理的意外(unhandled exceptions)生成dump
- 基于系统性能计数器(system performance counters)生成dump
- 因为Procdump是基于命令行的，所以它可以被嵌入在脚本中
以下为Procdump的命令行选项:
-64 By default Procdump will capture a 32-bit dump of a 32-bit process
when running on 64-bit Windows. This option overrides to create a
64-bit dump.
-b Treat debug breakpoints as exceptions (otherwise ignore them).
-c CPU threshold at which to create a dump of the process.
-e Write a dump when the process encounters an unhandled exception.
Include the 1 to create dump on first chance exceptions.
-h Write dump if process has a hung window (does not respond to
window messages for at least 5 seconds).
-m Memory commit threshold in MB at which to create a dump of the
process.
-ma Write a dump file with all process memory. The default
dump format includes thread and handle information.
-mp Write a dump file with thread and handle information, and all
read/write process memory. To minimize dump size, memory areas
larger than 512MB are searched for, and if found, the largest
area is excluded. A memory area is the collection of same
sized memory allocation areas. The removal of this (cache)
memory reduces Exchange and SQL Server dumps by over 90%.
-n Number of dumps to write before exiting.
-o Overwrite an existing dump file.
-p Trigger on the specified performance counter when the threshold
is exceeded. Note: to specify a process counter when there are
multiple instances of the process running, use the process ID
with the following syntax: "\Process(_)\counter"
-r Reflect (clone) the process for the dump to minimize the time
the process is suspended (Windows 7 and higher only).
-s Consecutive seconds before dump is written (default is 10).
-t Write a dump when the process terminates.
-u Treat CPU usage relative to a single core.
-x Launch the specified image with optional arguments.
以下为常见的Procdump使用示例:
To just create a dump of a running process, omit the CPU threshold. If
you omit the dump file name, it defaults to _.dmp.
Example: Write up to 3 dumps of a process named 'consume' when it exceeds
20% CPU usage for five seconds to the directory
c:\dump\consume with the name consume.dmp:
C:\>procdump -c 20 -s 5 -n 3 -o consume c:\dump\consume
Example: Write a dump for a process named 'hang.exe' when one of it's
windows is unresponsive for more than 5 seconds:
C:\>procdump -h hang.exe hungwindow.dmp
Example: Write 3 dumps 5 seconds apart:
C:\>procdump -s 5 -n 3 notepad.exe notepad.dmp
Example: Launch a process and then monitor it for excessive CPU usage:
C:\>procdump -c 30 -s 10 -x consume.exe consume.dmp
Example: Write a dump of a process named 'iexplore' to a dump file
that has the default name iexplore.dmp:
C:\>procdump iexplore
Example: Write a dump of a process named 'outlook' when total system
CPU usage exceeds 20% for 10 seconds:
C:\>procdump outlook -p "\Processor(_Total)\% Processor Time" 20
Example: Write a dump of a process named 'outlook' when Outlook's handle count
exceeds 10000:
C:\>procdump outlook -p "\Process(Outlook)\Handle Count" 10000
具体使用Procdump监控Oracle进程的方法:
在我们的场景中某个服务线程消耗了大量的CPU资源: Terminal A: sqlplus / as sysdba SQL> select count(1) from obj$,obj$,obj$; Terminal B: C:\Users\Maclean Liu>procdump -c 20 -ma oracle.exe ProcDump v3.04 - Writes process dump files Copyright (C) 2009-2011 Mark Russinovich Sysinternals - www.sysinternals.com Process: oracle.exe (1776) CPU threshold: 20% of system Performance counter: n/a Commit threshold: n/a Threshold seconds: 10 Number of dumps: 1 Hung window check: Disabled Exception monitor: Disabled Terminate monitor: Disabled Dump file: C:\Users\Maclean Liu\oracle.dmp [19:56.51] CPU: 25% 1s [19:56.52] CPU: 24% 2s [19:56.53] CPU: 24% 3s [19:56.54] CPU: 25% 4s [19:56.55] CPU: 24% 5s [19:56.56] CPU: 24% 6s [19:56.57] CPU: 24% 7s [19:56.58] CPU: 25% 8s [19:56.59] CPU: 24% 9s [19:57.00] CPU: 25% 10s Process has hit CPU spike threshold. Writing dump file C:\Users\Maclean Liu\oracle_110805_195700.dmp ... Dump written. Dump count reached. 因为Oracle.exe的cpu峰值达到了我们所设置的20,所以产生了进程dump转储文件oracle_110805_195700.dmp
Windbg是windows平台上的图形化dump分析工具，可以通过安装Debugging Tools for Windows包获得该程序，或者直接点击这里下载。
成功安装debugging工具后，从start->Debugging Tools for Windows (x86)->windbg启动工具，在主界面上选中File->Open Crash Dump 并输入dump文件的位置，成功分析后的显示:
Comment