schwindelig / postmortem

:skull: :fire: :snowflake: A basic analyzer for memory dumps containing managed code

PostMortem

A basic analyzer for memory dumps containing managed code. Reports are provided as .md and .html files.

The console app is targeting .net core 2.2, while the PostMorem.Core and PostMorem.Markdown libraries target .net standard 2.0.

The idea and analysing code is heavily inspired (if not just copy-pasted) from the ClrMD project.

Examples

Examples are based on memory dumps generated on the aspnet-crash website

Hang

Worker Processes hanging in Thread.Sleep

• Analysis Report 1 HTML | Markdown
• Analysis Report 2 HTML | Markdown
• Compare Report HTML | Markdown

Crash

StackOverflowException by recursion and creating thousands of SomeData instances

• Analysis Report HTML | Markdown

Memory Leak

Caused by not disposing MemoryStreams and XmlSerializers

• Analysis Report 1 HTML | Markdown
• Analysis Report 2 HTML | Markdown
• Compare Report HTML | Markdown

Libraries used

• ClrMD
• ClrMD.Extensions
• MarkDig
• Newtonsoft.Json
• Serilog
• Serilog.Sinks.Console
• CommandLineParser

Usage

Clone this repository, run dotnet restore and publish it. In the published directory, run

dotnet .\PostMortem.dll

with the following parameters

  -p, --path          Required. Path to the memory dump

  -v, --verbose       (Default: false) Verbose output

  -o, --output-dir    Required. Directory where the results should be saved

  -s, --path2         Path to the second memory dump

  --help              Display this help screen.

  --version           Display version information.

Features

Analysis Report

The analysis report provides the following information:

Runtime Info

• Pointer Size
• Heap Count
• Flag indicating if Server Garbage Collection is in use

Memory Regions

• Total Size
• Count
• Type

Heap Segments

• Start
• End
• Committed End
• Reserved End
• Heap
• Type

Heap Balance

• Heap
• Size in Bytes

App Domains

• Name
• Loaded Modules

Threads

• Indication if thread contains exception
• Information about exception, such as type, message and hresult
• Stack trace
  • Stack Pointer
  • Instruction Pointer
  • Method Display String

Top Objects

• Displays top 1000 objects by total size
  • Type
  • Indicator if type directly implements IDisposable
  • Count / number of instances
  • Total size in bytes

Compare Report

PostMortem allows you to compare two memory dumps. See the --help details, on which parameters to use.

Matching Threads

Displays threads where the thread id within both dumps matches.

Matching stack traces are displayed in the table below. A visual indication (:snowflake:) is given when both stack traces seem to be equal.

Object Count Diff

Displays a list of the most common objects, order by the difference in instances between the two dumps.

If a type directly implements IDisposable a visual indication (:warning:) is displayed in the Implements IDisposable column.