Exception Monitor Overview

Exception Monitor 8.0 enables users and support engineers to monitor and view system information for the purpose of debugging that system when an exception or system failure occurs. The tool features a user-friendly, Graphical User Interface (GUI) for handling tasks that previously required extensive debugging knowledge. Users and support engineers can use Exception Monitor to:

  • Gather and display system information automatically, including all running processes, stopped and running services, and active and completed monitoring sessions.
  • Start an automatic monitoring or manual debugging session.
  • View exception log results, including the exception type, instructions, offending call stack, and detailed log contents.
  • Monitor a system locally, from a network, or remotely.
  • Restart a service automatically after a shutdown/failure.
  • Notify an operator automatically via a Net Send command or email when an exception occurs.
  • Generate MSInfo log file (.NFO) or full or partial process information dump.

Related Topics

Exception Monitor Architecture

When to Use Exception Monitor

Overview of Workflow

Configuration Requirements


Exception Monitor Architecture

As a user-friendly debugging and monitoring tool, Exception Monitor uses three executables, one of which the user sees, while the others operate in the background:

  1. Exception Monitor Application (Em.exe) - The user interface that provides a window to the monitoring and debugging engines, permitting users to view the status of services, processes, and applications, and initiate debugging sessions using standard command sets.
  2. Exception Monitor Service (EmSvc.exe) - The monitoring engine that runs automatically in the background, monitoring services, processes, and applications.
  3. Console Debugger for Windows (CDB.exe) - The debugging engine launched by the Exception Monitor Service.

Related Topics

Exception Monitor Overview

When to Use Exception Monitor

Overview of Workflow

Configuration Requirements


When to Use Exception Monitor

Users and support engineers can use Exception Monitor to monitor services, processes, and applications for diagnosing system problems due to, but not limited to:

  • Exceptions
  • Access violations
  • Deadlocks between applications or processes

Related Topics

Exception Monitor Overview

Exception Monitor Architecture

Overview of Workflow

Configuration Requirements


Overview of Workflow

When users experience an exception, they can monitor a selected process, service, or application as follows:

  1. Launch the Exception Monitor Application (Em.exe).
  2. Connect to a local or remote computer.
  3. Specify monitoring session options and start an automatic monitoring session or a manual debugging session for a selected process, service, or application.
  4. View the log file, including the exception type, location, failing instruction, call stack, and detailed log contents.
  5. Generate files, including system information (.nfo) or dump (.dmp) files, to assist in debugging later.

Related Topics

Exception Monitor Overview

Exception Monitor Architecture

When to Use Exception Monitor

Configuration Requirements


Configuration Requirements

The following operating systems support Exception Monitor 8.0:

  • Windows 2000 or later

Note Users of earlier operating systems must use Exception Monitor 7.0 or earlier.

Related Topics

Exception Monitor Overview

Exception Monitor Architecture

When to Use Exception Monitor

Overview of Workflow


Launch Exception Monitor Application

Launch the Exception Monitor Application

You must first launch the Exception Monitor application and connect to a computer in order to view all running or stopped applications and services on that computer.

To launch the application:

  • From the Start menu, point to Programs, Microsoft Debugging Tools, then Exception Monitor.

Related Topics

Connect to Local or Remote Computer


Connect to Local or Remote Computer

Before you can monitor a computer for exceptions, you first must connect to it. With Exception Monitor 8.0, you can monitor a local computer or a remote computer on the network:

  1. On the File menu, click Connect.

    -or-

    Click the Connect to Server icon.

  2. In Select Computer, choose My Computer to monitor the local machine or Remote Computer to monitor another machine.

    Note If you select Remote Computer, you must specify a computer name.

  3. Click Connect.

    This connects to the specified computer and displays the main application view listing all running processes, running and stopped services, and completed monitoring sessions, as applicable.

Related Topics

Change Main Application View

Disconnect from Server


Change Main Application View

When you connect to either a local or remote computer, the main application view automatically displays a list of all running processes, running and stopped services, and completed monitoring sessions, as applicable.

You can filter or sort the main application view contents.

  1. To filter the main application view:

    On the View menu, click the desired filter parameter (Applications, Services, Completed Debug Sessions, Log Files, Dump Files, or MSInfo Files).

    -or-

    Click the desired filter icon (Switch to Applications View, Switch to Services View, Switch to Completed Sessions View, Switch to Log Files View, Switch to Dump Files View or Switch to MSInfo Files View).

    2. Note To return to the default view of all items, on the View menu, click All Running Tasks or click the Switch to Services and Applications View icon.

  2. To sort the view contents:

    Click on any column heading to sort the contents by that value.

Related Topics

View Properties


Start Automatic Monitoring Session

You can use Exception Monitor to automatically monitor a running process, a stopped service, or a running service. When you initiate an automatic monitoring session, you select the item to monitor, and specify the session options, including the debug command set to use. When the session completes, you can view the log results.

To start an automatic monitoring session:

  1. Select the process or service to monitor.

  2. On the Action menu, click Automatic Session.

    -or-

    Click the Start Automatic Session icon.

    -or-

    Right click and select Automatic Session.

  3. In Automatic Monitoring Session, select the desired session options as follows:

    4. Option | When Selected...
Notify Admin | Notifies an administrator of the exception via email or Net Send. You must specify an email address or machine name, as appropriate. Note: Email notification is not available on workstations as it requires installation of SMTP service and CDONTS (available on Servers only).
Recursive Mode | Continually restarts a monitoring session after every service shutdown or failure (applies to services only). Note: to halt the loop resulting from a recursive mode, you must stop the session.
Produce User Dump | Generates a complete process memory dump (.dmp) that can be used for extensive debugging later.
Produce Mini Dump | Generates a partial process memory dump (.dmp) that can be used for minimal debugging later.
Alternative Symbol Path | Specifies an alternative path for the symbol file. When you leave this field blank, Exception Monitor uses the _NT_SYMBOL_PATH to retrieve the symbol file. The symbol file maps machine code to source code.
Command Set | Uses the selected script (.ecx file) for debugging during this monitoring session. See Command Set Reference for a description of each .ecx file.
Remember Settings | Updates the registry and preserves your settings for the next time you use Exception Monitor.

  4. Select OK to begin monitoring of the selected item. This updates the status as appropriate.

    5. Note Exception Monitor prompts you for additional input when you select a process where a monitoring session is already in progress. See Spectate or Adopt a Session In Progress.

Related Topics

Configure the server to send mails

Stop Session

Cancel Session

Delete Session

Refresh Selected Item

View Properties

Spectate or Adopt a Session In Progress


Start Manual Debugging Session

You can use Exception Monitor to perform a manual debugging session. Typically, this is completed in cooperation with a support engineer who will monitor your computer from a remote location. To start a manual debugging session:

  1. Select the process or service to monitor.

  2. On the Action menu, click Manual Session.

    -or-

    Click the Start Manual Session icon.

    -or-

    Right click and select Manual Session.
  3. In Remote Monitoring Session, select the desired session options as follows:

    4. Option | When Selected...
Port | Specifies the TCP/IP port over which the two computers will communicate.
Username | Specifies the logon name of the computer to be monitored.
Password | Specifies the password associated with the specified username. Note: When combined with the username, the password secures the remote debugging session per basic authentication as defined by the HTTP specification.
Alternative Symbol Path | Specifies an alternative path for the symbol file. When you leave this field blank, Exception Monitor uses the _NT_SYMBOL_PATH to retrieve the symbol file. The symbol file maps machine code to source code.
Command Set | Uses the selected standard script for debugging during this monitoring session.
Remember Settings | Updates the registry and preserves your settings for the next time you use Exception Monitor.

  4. Select OK to start the manual debugging session using the specified options.

    5. Note Exception Monitor prompts you for additional input when you select a process where a debugging session is already in progress. See Spectate or Adopt a Session In Progress.

Related Topics

Stop Session

Refresh Selected Item

View Properties

Spectate or Adopt a Session in Progress


Spectate or Adopt a Session in Progress

When you attempt to start a monitoring session, another user may already be monitoring the same process. The user who is in control of the monitoring session is referred to as a master. Only the master can stop, cancel, or delete a session. You can also become a spectator and observe a session when a master already exists. A spectator can only view the session's status as it updates and cannot perform any actions on the session.

When Exception Monitor prompts you to become a spectator:

  1. Click Yes to become a spectator.

    This does not affect the session in progress. It only allows you to observe the session as a spectator.
  2. Click No to cancel.

Exception Monitor also allows a user to start a monitoring session, and disconnect from the server without stopping the session. A session that is in progress, but without a master is referred to as an orphan. You can adopt an orphaned session and become the master of that session. Again, only the master you can stop, cancel, or delete the session.

When Exception Monitor prompts you to adopt a session:

  1. Click Yes to adopt the session.
  2. Click No to cancel.

If you do not adopt the session, Exception Monitor then prompts you to become a spectator of the orphaned session:

  1. Click Yes to become a spectator.
  2. Click No to cancel.

Related Topics

Start Automatic Monitoring Session

Start Manual Debugging Session


Cancel Session

Users with the Windows Whistler operating system can cancel a currently running session manually. When you cancel a monitoring session, the action stops the session and backs it out, as if it never started.

Note For users with Windows NT or Windows 2000 operating systems, Cancel Session operates in the same manner as Stop Session.

To cancel a currently running session (Windows Whistler users only):

  1. Select a currently running session.

  2. On the Action menu, click Cancel Session.

    -or-

    Click the Cancel Session icon.

    -or-

    Right click and select Cancel Session.

    3. This cancels the session and returns the process or service to the same state as before the session was initiated.

Related Topics

Stop Session

Delete Session


Stop Session

While you monitor a process or service, you can stop the session manually. To stop a currently running session:

  1. Select a currently running session.

  2. On the Action menu, click Stop Session.

    -or-

    Click the Stop Session icon.

    -or-

    Right click and select Stop Session.

    3. This stops the session, kills the process or service, and updates the status.

Related Topics

Cancel Session

Delete Session


Delete Session

You can delete a completed monitoring session, which removes it from the main application view.

Note When you delete a completed session, Exception Monitor automatically removes the associated log and dump files from the server. Once deleted, you cannot recover these files!

To delete a completed session:

  1. Select a completed monitoring session.

  2. On the Action menu, click Delete Session.

    -or-

    Click the Delete Session icon.

    -or-

    Right click and select Delete Session.

    3. This deletes the completed session and removes it from the main application view.

Related Topics

Stop Session

Cancel Session


Refresh Display Contents

Refresh Main Application View

To refresh the main application view:

  • On the View menu, click Refresh All.

    -or-

    Click the Refresh All icon.

    -or-

    Press the F5 button.

    • This refreshes all items in the main application view.

Related Topics

Change Main Application View


Refresh Selected Item

While you monitor a process or service, Exception Monitor automatically updates the session status by default every 30 seconds. To change the refresh interval, see Change Refresh Settings.

You can also manually refresh the status of a currently selected item:

  1. Select an item in the main application view.

  2. On the Action menu, click Refresh Item.

    -or-

    Click the Refresh Item icon.

    -or-

    Right click and select Refresh Item.

    3. This refreshes the selected item.

Related Topics

Change Refresh Settings

Refresh Main Application View


Change Refresh Settings

By default, Exception Monitor updates the status of a monitoring session every 30 seconds. To change the refresh interval:

  1. On the Tools menu, click Options.
  2. In Options, enter a new refresh rate from 1 to 300 seconds.
  3. Click OK.

    This updates the rate by which Exception Monitor refreshes the status of sessions being monitored.

Related Topics

Refresh Selected Item


View Properties

You can view the properties of any item in the main application view. When you select a process or a service, you can view general, log file, and dump file properties. When you select a log or dump file, you can view only the general properties of the selected item.

To view the properties of a selected item:

  1. Select an item in the main application view.

  2. On the Action menu, click Properties.

    -or-

    Click the Display Properties icon.

    -or-

    Right click and select Properties.

    3. This displays the properties of the selected item, including the name, task type, status, process ID, and start and end date.

  3. Click the Log Files tab (if applicable) to view log file properties, including the name, size, time, and process of the log file(s).

    Note Click Export All to save the log file(s) on the local machine or click View Log File to view the log results.

  4. Click the Dump Files tab (if applicable) to view dump file properties, including the name, size, time, and process of the dump file(s).

    5. Note Click Export All to save the dump file(s) on the local machine.

Related Topics

Refresh Selected Item


View Log Results

You can view critical exception information and detailed log file contents created by a monitoring session. To view the log results:

  1. In Properties, click the Log Files tab, select the desired log file and click View Log File, or double click on the desired log file.

    -or-

    Filter the main application view to display log files. Then right click on the desired log file and select Open.

    This displays the Log File Viewer showing the exception type and location, failing instruction, and call stack.

  2. Click Advanced>> to view detailed log contents.
  3. Click <<Advanced to close detailed log contents.

Related Topics

Delete Session


Generate Files

When you debug a process or service, you can generate files to assist with further debugging later. The file types include System Information files (.nfo) and process memory dump files (.dmp).

You can generate two types of dump files. User dump files (also called full dump files) document a complete process memory dump and permit extensive debugging analysis. Mini dump files (or partial dump files) permit minimal debugging analysis.

When you start an automatic session and select Produce Mini Dump and/or Produce User Dump, Exception Monitor automatically generates the dump file(s) when an exception occurs.

You also can generate dump files on running services or processes at any time.

  1. To generate a mini dump (.dmp):

    Select a running service or process, and on the Actions menu, click Generate Mini Dump.

    -or-

    Select a running service or process and click the Generate Mini Dump icon.

    -or-

    Right click on a session and select Generate Mini Dump.

  2. To generate a user dump (.dmp):

    Select a running service or process, and on the Actions menu, click Generate User Dump.

    -or-

    Select a running service or process and click the Generate User Dump icon.

    -or-

    Right click on a session and select Generate User Dump.

  3. To generate a System Information file (.nfo):

    On the Actions menu, click Generate MSInfo File.

Related Topics

View Properties


Disconnect from Server

You can disconnect from the server and terminate your session. To disconnect:

  1. On the File menu, click Disconnect.

    -or-

    Click the Terminate Connection icon.

  2. Click OK.

    This disconnects from the computer.

Related Topics

Connect to Local or Remote Computer


Command Set Reference

Exception Monitor 8.0 provides a simplified mechanism for preparing and installing alternate command sets. In short, a command set is a text file named SomeUniqueName.ECX that contains a set of debug commands.

Command File Requirements:

  • Must be ANSI text files.
  • Must contain valid debug commands compatible with the debugger.
  • Must have the following as the first line:

    • !EMDBG.comment "Friendly Name to Be Displayed in Log and EM"
  • Must have one of the following as the second line, if viewing of exception information is supported:

    • !EMDBG.comment"READLOGS_AV"
    !EMDBG.comment"READLOGS_DB"

    Where the READLOGS signifies that the log is read logs friendly and the AV or DB signifies which type of log it is (Exception type or Deadlock type).
  • Command files with !EMDBG.comment"READLOGS_AV" must contain the following commands in any order:

    • kv
    u eip
    lm
  • Command files with !EMDBG.comment"READLOGS_DB" must contain the following commands in any order:

    • ~*kv
    !locks
  • Must be installed in the \EM\ECX subdirectory of your debugger's installation directory.

The representative command sets are:

File | Common Name | Suggested Application
Basic.ecx | Basic Command Set | Use this default command set to obtain general information about any exception when it occurs.
Av.ecx | Access Violation Command Set | Use to look for and trap access violation exceptions only. All other types of exceptions are ignored. This is especially useful where other types of exceptions are tripping the debugger.
Cplus.ecx | C++ Exception Command Set | Use to monitor C++ exceptions and print out the call stack whenever this type of exception occurs. Cplus.ecx is especially useful when you see C++ exceptions unexpectedly. You can also use it to locate C++ exception handlers experiencing an excessive number of exceptions and potentially causing performance or reliability issues.
Hang.ecx | Hang Analysis Command Set | Use when an application hangs, but there is no indication of an exception. To use this command set, first start an automatic monitoring session with Hang.ecx, then let the application run until it hangs. Once it hangs, stop the monitoring session which will generate a log file, and optionally a dump file. You then view the log and dump files, as applicable, to determine what the process was doing during the hang.


Environment Variable Reference

Exception Monitor 8.0 does not use any environment variables directly. However, the CDB debugger uses the following environment variable to retrieve the symbol path:

    _NT_SYMBOL_PATH


Additional Dependencies

Exception Monitor uses a debug extension DLL that is provided by the EM package. This includes:

    EMDBG.DLL


Additional Resources

To learn more about Exception Monitor and general debugging concepts visit the Web at:

http://msdndevstg/workshop/server/iis/ixcptmon.asp

http://msdn.microsoft.com/workshop/server/iis/readlogs.asp


Steps to Configure your Internet Information Server (IIS):

In order to send mail from your IIS server via your SMTP server (assuming that they are different computers), complete the following steps:

  • On your IIS computer, open the Microsoft Management Console (MMC).
  • In the left pane, expand the "Internet Information Server" section.
  • In the left pane, select and expand your IIS server.
  • In the right pane, right-click "Default SMTP server" and select "Properties"
  • Select the "Delivery" tab.
  • In the "Fully Qualified Domain Name" text box, enter the IIS computer name.
  • In the "Smart Host" text box, enter the name of your SMTP server.

Related Topics

Start Automatic Monitoring Session