In the production environment, We will find some abnormal problems by running the log, here, We can't take it directlyVS Remote to server debugging, At the same time, the output information of the log cannot reflect the state of the object in memory, For example, we want to see all theSocket Connection state, Service routing information, etc.

Namely: How to analyze.Net Runtime memory object?

therefore, Today we recommend.Net Advanced necessary artifact:Windbg, Be based onWindbg Analyze the state of objects in memory.

Let's take the actual scene as an example, This is more practical, At the same time, it has more reference significance.

Business scenario:
Distributed environment, In each service container process, theSocket Connection information, Easy access between runtime services. But the network shakes occasionally, In the moment of shaking, Quite a lotSocket The connection is broken, The exception message received by the service caller is: Connection interrupted, etc.


How to quickly locateSocket Connection is broken? These interruptedSocket Which servers are connected to, port? This information can help us analyze specific network problems, Do some procedural compensation at the same time: Connection reconstruction. One goal, Keep programs highly available!

that, Please show our leading role today:Windbg, Official introduction of Microsoft:

http://windbg.org/ <http://windbg.org/>

Further said, We need to grab the memory image of the specified process at a certain moment, Then useWindbg Analyze various objects in memory, thread, Thread pool, Destructor queue, heap,CPU State of kernel time slice, etc.

therefore, First step, We need to process the memory analysis, Grab oneFull Dump file: Memory image file.

Task Manager-> Selection process-> Create dump file



The system willDump The file is stored in the specified directory, This directory needs to be copied, Spare.

The second step, Download and install fromWindbg:

https://developer.microsoft.com/en-us/windows/hardware/download-windbg
<https://developer.microsoft.com/en-us/windows/hardware/download-windbg>



According to the number of digits in the operating system, ChoiceX86 perhapsX64. Here we use64 Bit operating system, SelectiveWindbg(X64)

The third step:Ctrl+D, Open what I just grabbedDump file





The fourth step: For loading debuggingSOS.dll: .loadby sos clr
.loadby sos clr


The fifth step: View objects of the specified type in memory 
!dumpheap -Type Socket
ThereSocket Is a specific type, We want to seeSocket Connection state, So the type isSocket



ThereHeader inMT=Method Table

We need to useMT:00007ffafe50d700

The sixth step, View memory allSocket Address of the object:
!dumpheap -mt 00007ffafe50d700
 

Output results, The first column is oneSocket Object's memory address

here, We can use the following command, Randomly view oneSocket Object information:
!do 000001b2d188ae00
!do Meaning:!dumpObj 



  So here comes the question... Hundreds ofSocket object, If one by one!do See, It's too much work! Of course not,Windbg Yes.foreach command

  searchDebugging help.chm File,.foreach Here's an example:
.foreach /f ( place "g:\myfile.txt") { dds place }
Namely, Loop through a text file, For each row of data, Perform a command action.

good, Let's go back to our previous output: eachSocket Object's address list, We copy it, Only the first column is taken out with the text editing tool(Socket Address list), Preservation1.txt

The seventh step: Loop through each memory object
.foreach /f (adr "C:\1.txt") {!do adr}
output:



Put all output, Copy to text editor, Search query specified properties, for examplem_IsConnected=0, You can find the disconnectedSocket object, And then further use!gcroot
View the reference relationship of this object, Step by step, the information of each reference object can be roughly analyzed.

 

The above is.Net The whole process of memory object analysis, Share with you.

 

Guo Qing Zhou

2017/10/06