A change in the functionality of COM+ in Windows Server 2003 to support automatic collection of a process dump file and process termination

This article describes a change in the functionality of Microsoft COM+ (Component Services) in Microsoft Windows Server 2003. By default, when a COM+ component experiences an unusually high call time, no information is recorded for the COM+ component that experiences the problem. Additionally, no action is taken to try to recover from the problem.

After you apply Microsoft Windows Server 2003 Service Pack 2 (SP2), an event is logged when a COM+ component experiences an unusually high call time. The event log identifies the COM+ component that experiences the problem. Additionally, the event log mentions this Microsoft Knowledge Base article. You can configure the system to perform one or both of the following actions:

• Automatically collect a process dump file for root cause analysis of the problem.
• Terminate the process to help recover from the problem without manual intervention.

After the system collects a dump file, you can use the Debug Diagnostics Tool (DebugDiag) to generate a report that describes the problem. Additionally, this report describes the possible solutions for the problem, if they are known.

Default behavior

Consider the following scenario:

• You apply Windows Server 2003 SP2.
• The call time for a COM+ component exceeds 10 minutes.
• While the application that hosts this long-running COM+ component is still running, you open the Component Services Microsoft Management Console (MMC) snap-in.

In this scenario, the following event is logged in the Application log:

Event Type: Information
Event Source: COM+
Event Category: (117)
Event ID: 782
Description: The average call duration has exceeded 10 minutes. If this is not the expected behavior, please see article 910904 in the Microsoft Knowledge Base at http://support.microsoft.com for details on how to use the COM+ AutoDump feature to automatically generate dump files and/or terminate the process if the problem occurs again.
Server Application ID: {YourAppID}
Server Application Instance ID: {YourAppInstanceID}
Server Application Name: YourAppName

Configuration options

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

You can configure the system to perform one or both of the following actions when a long-running COM+ component is detected:

• Automatically collect a process dump file.
• Terminate the process.

To do this, use the following registry values: To globally define the actions to be taken for all COM+ components on the computer, add the configuration values under the following registry key:To define the actions to be taken for a specific COM+ component regardless of the global settings, add the configuration values under the following registry key:

Recommendations

Collect full dump files

For best supportability, collect a full dump file when a COM+ component experiences an unusually high call time. For example, to do this, create the following single registry value:See the "Considerations" section for more information about how to select an appropriate AverageCallThreshold registry value for your particular environment.

Similarly, collect a full dump file when an unhandled exception occurs in a COM+ application. To do this, click to select the Enable Image Dump on Application Fault check box on the Dump tab in the properties of each COM+ application.

Analyze the dump files

When a dump file is produced, perform an initial analysis of the problem. To do this, follow these steps:

1. Download and install the appropriate version of the Microsoft Internet Information Services (IIS) Diagnostics Toolkit. For more information about how to obtain the IIS Diagnostics Toolkit, visit the following Microsoft Web site:
   http://www.microsoft.com/windowsserver2003/iis/diagnostictools/default.mspx (http://www.microsoft.com/windowsserver2003/iis/diagnostictools/default.mspx)
2. Use the Debug Diagnostics Tool (DebugDiag) of the IIS Diagnostics Toolkit to generate an analysis report for the dump file. To do this, follow these steps:
   1. Click Start, point to Programs, point to IIS Diagnostics (32 bit), point to Debug Diagnostics Tool, and then click Debug Diagnostics Tool 1.0.
   2. If the Select Rule Type dialog box opens, click Cancel.
   3. On the Tools menu, click Options And Settings.
   4. Click the Folders and Search Paths tab.
   5. In the Symbol Search Path For Analysis box, type srv*C:\symbols\*http://msdl.microsoft.com/download/symbols.
   6. Click the Advanced Analysis tab.
   7. In the Available Analysis Scripts list, click IISAnalysis.asp.
   8. Click Add Data Files.
   9. Select the dump file that you want to analyze, and then click OK.
   10. Click Start Analysis.
       
       The resulting HTML report is displayed in a new Microsoft Internet Explorer window on the desktop. Additionally, this report is saved to the DebugDiag Reports directory. The default location for this directory is C:\Program Files\IIS Resources\DebugDiag\Reports.
3. To resolve the problem, follow the guidance that is provided in the "Recommendation" section of the report. This section of the report may recommend the following things:
   • It may direct you to a Microsoft Knowledge Base article that describes known issues.
   • It may provide the developers of the application with information that they can use to make corrections.
   • It may suggest that you follow up with the appropriate vendor or with Microsoft Support. When you contact Microsoft Support for more help, provide the report file to speed the analysis process. The full dump file may also be requested if it is necessary.

Considerations

The AverageCallThreshold registry value

A value of 300 seconds is an appropriate threshold for many environments. However, the ideal value may vary depending on the particular environment. To make sure that action is taken as quickly as possible but only when a legitimate problem occurs, select the smallest possible value that is exceeded only in a problematic scenario.

The TerminateProcess registry value

Terminating the process when high call times occur may help the COM+ component automatically recover from some problems. This may be especially desirable in environments where high availability is a major concern. When you use this feature, notice that it is especially important to select an appropriate AverageCallThreshold registry value to avoid unintentionally terminating the process.

The DumpType registry value

Minidump files are faster to create and take less disk space than full dump files. However, minidump files are less useful for problem analysis because they frequently lack the required data. Typical full dump files for a Dllhost.exe process are approximately 10 megabytes (MB) to 50 MB and take a matter of seconds to generate. However, the size of full dump files varies depending on the size of the working set of the process that is dumped.

The dump file options

By default, the dump files are stored in the %systemroot%\system32\com\dmp directory. You can use the settings in the Image Dump Directory box and under the Maximum Number of Dump Images area for the appropriate COM+ application to control the location of the dump files and the number of dump files.

The call time

The call time for a COM+ component is a running average for all instances of the COM+ component. The call time is calculated by the COM+ System Application. Additionally, the call time is displayed in the Call Time (ms) column of the Status View in the Component Services MMC snap-in.