Memory Dump Analysis Anthology- P15: This is a revised, edited, cross-referenced and thematically organized volume of selected blog posts about crash dump analysis and debugging written in 2006 - 2007 for software engineers developing and maintaining products on Windows platforms, technical support and escalation engineers dealing with complex software issues and general Windows users. | High Contention 421 HIGH CONTENTION Some Windows synchronization objects like executive resources and critical sections have a struct member called ContentionCount. This is the number of times a resource was accessed or in another words it is the accumulated number of threads waiting for an object when a thread tries to acquire an object and is put into a wait state the count is incremented. Hence the name of this pattern High Contention. Here is an example. In a kernel memory dump we have just one exclusively owned lock and it seems that no other threads were blocked by it at the time the dump was saved. However the high contention count reveals CPU spike 3 kd locks DUMP OF ALL RESOURCE OBJECTS KD Scanning for held locks. Resource @ 0x8abc11f0 Exclusively owned Contention Count 19648535 Threads 896395f8-01 KD Scanning for held locks. Resource @ 0x896fab88 Shared 1 owning threads Threads 88c78608-01 KD Scanning for held locks. 15464 total locks 2 locks currently held 3 kd thread 896395f8 THREAD 896395f8 Cid RUNNING on processor Not impersonating DeviceMap Owning Process Wait Start TickCount Context Switch Count UserTime KernelTime Teb 1 e3d4c008 8a035020 36969283 1926423 00 00 00 13 7ffde000 Win32Thread bc922d20 Image Ticks 0 LargeStack Win32 Start Address 0 00401478 Start Address 0x77e617f8 Stack Init ba14b000 Current ba14abf8 Base ba14b000 Limit ba146000 Call 0 Priority 11 BasePriority 6 PriorityDecrement 5 ChildEBP RetAddr ba14ac94 bf8c6505 001544c8 bf995948 000c000a nt _wcsicmp 0x3a ba14ace0 bf8c6682 00000000 00000000 00000000 win32k _FindWindowEx 0xfb ba14ad48 8088978c 00000000 00000000 0012f8d4 win32k NtUserFindWindowEx 0xef ba14ad48 7c8285ec 00000000 00000000 0012f8d4 nt KiFastCallEntry 0xfc Please purchase PDF Split-Merge on to remove this watermark 422 PART 3 Crash Dump Analysis Patterns 3 kd process 8a035020 PROCESS 8a035020 SessionId 9 Cid 04c0 Peb 7ffdf000 ParentCid 10e8 DirBase cffaf7a0 ObjectTable .
