Windows Error Reporting

微軟官方說明

These registry values represent the global settings. You can also provide per-application settings that override the global settings. To create a per-application setting, create a new key for your application under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps (for example, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\MyApplication.exe). Add your dump settings under the MyApplication.exe key. If your application crashes, WER will first read the global settings, and then will override any of the settings with your application-specific settings.

 

After an application crashes and prior to its termination, the system will check the registry settings to determine whether a local dump is to be collected. After the dump collection has completed, the application will be allowed to terminate normally. If the application supports recovery, the local dump is collected before the recovery callback is called.

These dumps are configured and controlled independently of the rest of the WER infrastructure. You can make use of the local dump collection even if WER is disabled or if the user cancels WER reporting. The local dump can be different than the dump sent to Microsoft.

 

DumpFolder:REG_EXPAND_SZ:%LOCALAPPDATA%\CrashDumps

DumpCount:REG_DWORD:10

DumpType:REG_DWORD:2

• 0: Custom dump
• 1: Mini dump
• 2: Full dump

CustomDumpFlags:REG_DWORD:0

• MiniDumpWithDataSegs | MiniDumpWithUnloadedModules | MiniDumpWithProcessThreadData.

 

1. 移除默認的調試器

 

如果你的機器裝了VS開發工具，會在注冊表里寫入調試器地址，需要把它刪除。

找到注冊表刪除以下2個項目
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\Debugger

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\DbgManagedDebugger

在 64 位 操作系統上也刪除以下注冊表項：

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\AeDebug\Debugger

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger

 

2. 修改WER注冊表配置

 

這個功能在Windows中默認是關閉的，想打開的話修改方式如下：

1. 運行Regedit

2. 找到這個： HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps

3. 有四個值需要配置：

a. Value:DumpFolder, Type：REG_EXPAND_SZ - 顧名思義，就是存儲dump的位置

b. Value:DumpCount, Type：REG_DWORD - 最大保留的dump個數，默認為10.

c. Value:DumpType, Type：REG_DWORD - Dump類型，0：Custom dump， 1： Mini dump, 2： Full dump. 默認值為1

d. Value:CustomDumpFlags, Type：REG_DWORD - 沒怎么用，暫時不解釋。

 

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\w3wp.exe]
"DumpFolder"=hex(2):64,00,3a,00,5c,00,64,00,75,00,6d,00,70,00,73,00,00,00
"DumpCount"=dword:00000002
"DumpType"=dword:00000002

 

3. 啟動 Windows Error Reporting Service 服務

 

 

借鑒參考IIS轉儲腳本

rem 可根據實際情況修改磁盤路徑DMPPATH=d:\dumps
SET DMPPATH=d:\dumps
SC CONFIG WerSvc START= AUTO
NET START WerSvc
ECHO 啟用完成
 
REG DELETE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\Debugger /f
REG DELETE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\DbgManagedDebugger /f
 
REG DELETE HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\AeDebug\Debugger /f
REG DELETE HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger /f
 
ECHO 刪除完成
 
REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\w3wp.exe"  /f
REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\w3wp.exe"  /t REG_SZ  /v DumpFolder /d   %DMPPATH% /f
REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\w3wp.exe"  /t REG_DWORD   /v DumpCount /d  2 /f
REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\w3wp.exe"  /t REG_DWORD   /v DumpType /d  2 /f
 
ECHO 啟用完成
 
PAUSE 

 

 

https://docs.microsoft.com/en-us/windows/win32/wer/windows-error-reporting