Configure Automatic Collection of Process Crash Dumps on Windows for Sfc.exe Process
Available Languages
Introduction
This document describes how to collect crash dumps on Windows for the sfc.exe process.
Prerequisites
Requirements
Cisco recommends that you have knowledge of these topics:
- Cisco Secure Endpoint connector
- Command Prompt Windows
Componenets Used
This document is not restricted to software and hardware versions. The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.
Problem
- Cisco Secure Endpoint application may enter a disabled or disconnected state due to a crash of sfc.exe. This could be caused by an unexpected Windows shutdown or other Windows activities.
- Windows activates a debugging tool configured in the AeDebug registry values. In this scenario, a program can be pre-selected as the tool to use, which is referred to as the postmortem debugger.
Solution
1. Download Procdump (to be used as the AeDebug postmortem debugger) from Sysinternals Suite.
2. Extract procdump.exe in C: drive and create Dumps folder for crash dump collection:
Note: There are main two ways to collect dumps using procdump64.exe:
• procdump64.exe -ma -i C:\Dumps installs Procdump as the postmortem debugger (AeDebug) and specifies the folder (C:\Dumps) where crash dumps will be saved automatically when a process crashes. This mode sets up Procdump to monitor for crashes and save full memory dumps to the specified directory. It is useful if you notice that sfc.exe crashes frequently.
• procdump64.exe -ma <PID | Process Name> manually triggers a full memory dump (-ma) of the specified running process by its PID or process name. This command captures the dump immediately rather than waiting for a crash event.
In summary, the -i option with a folder path installs Procdump as a crash handler saving dumps on crashes to that folder, while specifying a PID or process name captures a dump of that process on demand. Both use the -ma flag to create a full memory dump. This usage is described in the Cisco document on collecting process crash dumps on Windows with Procdump64.exe
3a. Set Procdump as AeDebugger with the command:
procdump64.exe -ma -i C:\Dumps
3b. Alternatively use this command to create dump on demand:
procdump64.exe -ma <PID | Process Name>
Example for sfc.exe:
procdump64.exe -accepteula -ma -e -x c:\Dumps %ProgramFiles%\Cisco\AMP\8.2.3.30119\sfc.exe
4. Navigate to the C:\Dumps folder as shown. Zip it and share it for analysis:
Uninstallation
To uninstall procdump use:
procdump64.exe -u
Note: Crash dumps can occupy a significant amount of disk space, so it is important to stop procdump once the collection is complete.
Although, you can also use the workaround to compress the size of the folder:
Use CLI
Use this command on Command prompt to enable compression.
compact /c /s:c:\install
Use GUI
1. Navigate to Properties of the Dumps folder and check original size of the folder on the disk as shown :
2. Navigate to the Advanced option, enable compression, and apply it. This process may take several minutes.
3. In the end, you can observe that the folder size has significantly reduced, almost reaching half of its original size.
Revision History
| Revision | Publish Date | Comments |
|---|---|---|
1.0 |
24-Mar-2025
|
Initial Release |
FeedbackContact Cisco
- Open a Support Case
- (Requires a Cisco Service Contract)