Generic Process
This section covers installing Sysinternals ProcDump as the just-in-time debugger, configured to collect a full memory dump.
- On the affected machine, download procdump.exe from Microsoft Sysinternals
- Create a dumps directory such as c:\dumps\
- Open an Administrator command prompt, change directory to where you downloaded procdump.exe and run the following command:
procdump -i -ma c:\dumps
- Reproduce the crash with the affected process and gather any dumps for the affected process that get created at c:\dumps
- Uninstall
- At an Administrator command prompt, uninstall procdump with the following command:
procdump -u
DLP Agent
This section covers disabling the DLP agent's built-in crash dump handler, and installing Microsoft ProcDump as the just-in-time debugger, configured to collect a full memory dump.
In the Enforce Console
- Navigate to the appropriate agent configuration (covering the affected agent machine), go to Advanced Settings, and set CrashDump.ENABLE_CRASH_DUMP_COLLECTION.int = 0
- Save the Agent Configuration change.
- Be sure to Apply this updated configuration.
- On the affected machine, ensure that the agent's configuration (cg.ead) has been updated before continuing.
- If the agent is crashing before it can get an updated configuration, use vontu_sqlite to update cg.ead to disable crash dump collection (see the additional information section of this article for manual steps).
- On the affected machine, download procdump.exe from Microsoft Sysinternals
- Create a dumps directory such as c:\dumps\
- Open an Administrator command prompt, change the directory to where you downloaded procdump.exe and run the following command:
procdump -i -ma c:\dumps
- Reproduce the agent crash and gather the dump that gets created at c:\dumps
- Uninstall
- At an Administrator command prompt, uninstall procdump with the following command:
procdump -u
- Revert the agent crash dump handler setting in the Agent Configuration, CrashDump.ENABLE_CRASH_DUMP_COLLECTION.int = 1