PostMortem

A basic analyzer for memory dumps containing managed code. Reports are provided as .md and .html files.

The console app is targeting .net core 2.2, while the PostMorem.Core and PostMorem.Markdown libraries target .net standard 2.0.

The idea and analysing code is heavily inspired (if not just copy-pasted) from the ClrMD project.

Examples

Examples are based on memory dumps generated on the aspnet-crash website

Hang

Worker Processes hanging in Thread.Sleep

Analysis Report 1 HTML | Markdown
Analysis Report 2 HTML | Markdown
Compare Report HTML | Markdown

Crash

StackOverflowException by recursion and creating thousands of SomeData instances

Analysis Report HTML | Markdown

Memory Leak

Caused by not disposing MemoryStreams and XmlSerializers

Analysis Report 1 HTML | Markdown
Analysis Report 2 HTML | Markdown
Compare Report HTML | Markdown

Libraries used

Usage

Clone this repository, run dotnet restore and publish it. In the published directory, run

dotnet .\PostMortem.dll

with the following parameters

  -p, --path          Required. Path to the memory dump

  -v, --verbose       (Default: false) Verbose output

  -o, --output-dir    Required. Directory where the results should be saved

  -s, --path2         Path to the second memory dump

  --help              Display this help screen.

  --version           Display version information.

Features

Analysis Report

The analysis report provides the following information:

Runtime Info

Pointer Size
Heap Count
Flag indicating if Server Garbage Collection is in use

Memory Regions

Total Size
Count
Type

Heap Segments

Start
End
Committed End
Reserved End
Heap
Type

Heap Balance

Heap
Size in Bytes

App Domains

Name
Loaded Modules

Threads

Indication if thread contains exception
Information about exception, such as type, message and hresult
Stack trace
- Stack Pointer
- Instruction Pointer
- Method Display String

Top Objects

Displays top 1000 objects by total size
- Type
- Indicator if type directly implements IDisposable
- Count / number of instances
- Total size in bytes

Compare Report

PostMortem allows you to compare two memory dumps. See the --help details, on which parameters to use.

Matching Threads

Displays threads where the thread id within both dumps matches.

Matching stack traces are displayed in the table below. A visual indication (:snowflake:) is given when both stack traces seem to be equal.

Object Count Diff

Displays a list of the most common objects, order by the difference in instances between the two dumps.

If a type directly implements IDisposable a visual indication (:warning:) is displayed in the Implements IDisposable column.

schwindelig/postmortem