Procmon Download Symbols

In the picture above, I show the path to the local symbols cache (between the asterisks in the Symbols path) on the D: drive. This is becausemy C: drive is short on space, and the the local symbols cache can get very big, many gigabytes. You can call it whatever you want, and put itwherever is expedient for you. A local drive is best for speed.

I do not use a private symbol server, and my d: drive is larger than my small c: drive, so the path to my local symbol cache (between the asterisks)is d:\symbols. You could use c:\symbols or wherever else is appropriate for you. For instance:

Download Zip 🔥 https://urlca.com/2y2EIV 🔥

You will have to create the symbols directory yourself - Process Explorer will not make it for you.The symbol cache can get quite large (many gigabytes), so make sure you have plenty of space on the drive.

Note that, especially at first, there may be a delay as the symbols are acquired from the Microsoft symbol server. Be patient. The symbols will automatically fill in as they are acquired. Let me emphasize that: be very patient! It may take a while until they start filling in, and you may think it is broken prematurely.In my experience, it has never taken more than 2-3 minutes to start going, but that can seem like a long time when just staring at the dialog box.

The Microsoft Symbol Server path and Symbols path format has not changed form in quite some time. That was not the problem.The problem was getting pointed to the right dbghelp.dll file. Because the place Microsoft puts it has changed, and manyarticles about Process Explorer symbols do not address the Dbghelp.dll path, it took me a while to get this right.

Even after configuring symbols, they still silently failed to load. So I stopped the capture, saved it and immediately opened the saved capture, to stop this instance of Procmon from capturing events on the local computer. I then started a second instance of Procmon, removed the Procmon exclusion from the filtering, and instead, added a filter to include Procmon (I also filtered specifically for the PID of the original Procmon, later):

Then I started the trace, switched back to the first Procmon, and tried to examine the stack. Of course, still no symbols, but now it was time to switch back to the second, active Procmon process and see what we found.

And what we found was that dbghelp.dll was looking for symsrv.dll in order to download its symbols. So we copied that also into the folder with procmon.exe and suddenly everything worked!

Thanks for the comment and for reading, Dave. While what you say is correct, the anomaly that I was interested in here was that procmon appeared to be constructing a local path containing that full srv*path*url string and passing that to CreateFile, resulting, unsurprisingly, in a NAME INVALID error. This was highlighted in the screenshot but perhaps not clear in my text.

When you know that the application you are tracing is a managed one, collect a full memory dump during the analysis (better later than sooner, so all the interesting modules are already loaded). You may use procdump -ma process name|PID for this purpose. Now, open the dump in windbg, load SOS (.loadby sos clr) and resolve the address from procmon:

Once symbols are configured, you'll get a stack trace corresponding to a filesystem event by simply doubleclicking on the line corresponding to the event. This is what I see after clicking on the first event of my tracing session (corresponds to opening my.ini file)

To conclude it seems that if WinDbg symbol download gets interrupted (I had a network dropout on 3G when I first tried to load this crash dump) you may need to overwrite the cache to get all publicly available symbols.

If you specify a path to source files in the Symbol Configuration dialog, the Stack dialog's Source button will enable for any frame for which line number symbols information is available and the source file is present in the paths you include. Clicking on the Source button opens a text viewer that highlights the source code line referenced.

As long as the Symsrv.dll file is in your C:\Program Files\\Common7\IDE folder - it's put there by installing Debugging Tools for Windows - you'll get the symbols in VS.NET. Here's a video explaining how.

You can also set up a Symbol Server at your company (we have one here at Corillian, but it's not well-advertised internally - yet). Here's a screenshot of part of my C:\symbols folder after debugging. Notice that I've set the folder with the Compressed attribute. That's useful because PDBs will typically squish at least in half.

i run the latest procmon from sysinternals on a windows 2000 pro up2date

system. I want to see some callstack information with the procmon on a

appliction i am testing. I could use a debugger for this, but i want to run

it without a debugger. For whatever reason the procmon does not show

symbol information. I use the ms symbol server with this path:

C:\Programme\Debugging Tools for Windows\Symbols*

works fine for my Debugging Tools from MS and other Debuggers, but

procmon does neither load nor download any symbols from the server.

The ms WinDbg does on the system but procmon not. What could cause

this situation?Procmon says "Loading Symbol Module for xyz.dll/sys, etc,.." and then

nothing happens. I still only can see the module and the offset address, but

no function name and address, as said only address,...System is Windows 2000 Pro Up2Date, procmon is v1.26RegardsK.--

-----------------------

Beste Grsse / Best regards / Votre bien devoue

Kerem Gmrkc

Microsoft Live Space: -g.spaces.live.com/

Latest Open-Source Projects:

-----------------------

"This reply is provided as is, without warranty express or implied."

> Hi,

> i run the latest procmon from sysinternals on a windows 2000 pro up2date

> system. I want to see some callstack information with the procmon on a

> appliction i am testing. I could use a debugger for this, but i want to run

> it without a debugger. For whatever reason the procmon does not show

> symbol information. I use the ms symbol server with this path:

> C:\Programme\Debugging Tools for Windows\Symbols*

> It works fine for my Debugging Tools from MS and other Debuggers, but

> procmon does neither load nor download any symbols from the server.

> The ms WinDbg does on the system but procmon not. What could cause

> this situation?

> Procmon says "Loading Symbol Module for xyz.dll/sys, etc,.." and then

> nothing happens. I still only can see the module and the offset address, but

> no function name and address, as said only address,...

> System is Windows 2000 Pro Up2Date, procmon is v1.26

> Regards

> K.

> --

> -----------------------

> news:ucqkvWDi...@TK2MSFTNGP05.phx.gbl...

>> Hi,

>> i run the latest procmon from sysinternals on a windows 2000 pro up2date

>> system. I want to see some callstack information with the procmon on a

>> appliction i am testing. I could use a debugger for this, but i want to

>> run

>> it without a debugger. For whatever reason the procmon does not show

>> symbol information. I use the ms symbol server with this path:

>> C:\Programme\Debugging Tools for Windows\Symbols*

>> It works fine for my Debugging Tools from MS and other Debuggers, but

>> procmon does neither load nor download any symbols from the server.

>> The ms WinDbg does on the system but procmon not. What could cause

>> this situation?

>> Procmon says "Loading Symbol Module for xyz.dll/sys, etc,.." and then

>> nothing happens. I still only can see the module and the offset address,

>> but

>> no function name and address, as said only address,...

>> System is Windows 2000 Pro Up2Date, procmon is v1.26

>> Regards

>> K.

>> --

>> -----------------------

----------------------------------------------------------------------------

GET /download/symbols/fltmgr.sys/44EAAFCE215c0/fltmgr.sys HTTP/1.1User-Agent: Microsoft-Symbol-Server/6.6.0007.5Host: msdl.microsoft.comConnection: Keep-AliveCache-Control: no-cacheHTTP/1.1 404 Not FoundContent-Length: 1635Content-Type: text/htmlServer: Microsoft-IIS/6.0X-Powered-By: ASP.NETDate: Mon, 17 Mar 2008 16:38:54 GMTThe page cannot be found BODY { font: 8pt/12pt verdana } H1 { font: 13pt/15pt verdana } H2 { font: 8pt/12pt verdana } A:link { color: red } A:visited { color: maroon }The page cannot be foundThe page you are looking for might have been removed, had its name changed,

or is temporarily unavailable.Please try the following:Make sure that the Web site address displayed in the address bar of your

browser is spelled and formatted correctly.If you reached this page by clicking a link, contact the Web site administrator to alert them that the link is incorrectly

formatted.Click the Back button to try

another link.HTTP Error 404 - File or directory not found.

Internet Information

Services (IIS)Technical Information (for support personnel)Go to Microsoft

Product Support Services and perform a title search for the words

HTTP and 404.Open IIS Help, which is accessible in IIS Manager (inetmgr), and search for topics titled Web Site Setup, Common

Administrative Tasks, and About Custom Error Messages.----------------------------------------------------------------------------

--Maybe the Symbols for Windows 2000 are no longer available over symbol

server. If this is the case, why they are still available for download? Only

this is the case,...I mean it is not that important, but i wanted to try my app on

windows 2000 and backtrack its functionality with procmon.RegardsK.-----------------------