Summary

Memory dumps of processes can be examined at a later point using some different tools in order to determine what has happened, or why, and can be useful for all sorts of issues, ex. why something has crashed, why an error message has popped up, or why something is leaking memory. This document aims to outline how to take a proper memory dump.

Bitness

We only support 64-bit Windows operating systems, but our processes (ICC.exe, ICS.exe, ILA.exe, LogReceiver.exe etc) may run as either 32-bit processes or as 64-bit processes. There are big differences in all sorts of layers, but for the purpose of this document we don’t care about the differences - we only acknowledge that they are very important.

How to determine the bitness of a running process?

Task Manager on Windows 10

The “Processes” tab

As you can see, the processes running as 32-bit have an appended “32-bit” text. Please note, the task manager has “grouped” multiple processes together - you need to expand the list in order to see the individual processes!

The “Details” tab

1. Right click on a column
   
2. Ensure that "Platform" is checked
   
   
3. Click OK
4. See the "Platform" column for the bitness for a specific process.

How to create a memory dump

Using Task Manager

It’s crucial to take the memory dump using a tool running with the same bitness as the process whose memory you are going to take a memory dump.

1. Determine the bitness of the process you want to take a memory dump of
2. Ensure that the Task Manager (taskmgr.exe) is running with the same bitness
3. If it's not running with the same bitness, you need to close the Task Manager, and then start a version with the proper bitness
   1. Press [WIN]+[R] ("Run")
   2. For 32-bit Task Manager, run: C:\Windows\SysWOW64\Taskmgr.exe
   3. For 64-bit Task Manager, run: C:\Windows\System32\Taskmgr.exe
   4. If you are uncertain, you can check that the bitness of the Task Manager is correct using the instructions above in this document.
4. Right click on the process you want to take a memory dump of and click "Create Dump File"
5. After a while, a dialog will popup with the path to the newly taken memory dump.

Related articles