As you may know, sysinternals' procdump is a great tool to capture crash dump files when certain condition meets.
However, it can only work for one process at a time, by either pid or image name.
If there are more than one processes with the same name opened on your machine, it will just reports:
>procdump chrome.exe
ProcDump v9.0 - Sysinternals process dump utility
Copyright (C) 2009-2017 Mark Russinovich and Andrew Richards
Sysinternals - www.sysinternals.com
[17:17:17] Multiple processes match the specified name.
The same logic happens to "-w" option in that it only monitors the next ONE process started afterwards.
That's why I decide to enhance it with a new wrapper named ProcDumpEx. It can dump multiple processes in one single command. Use "-d" option I invented to work with existing processes, and "-w" option to wait for certain processes. You can also use all the existing options provided by procdump utility.
**NOTE: This tool uses WMI to check new process event and thus need administrative priviledge to run. You can download the executable from the release tab.
Here are some examples:
- Dump all the running notepad.exe processes
procdumpex -ma -e -d notepad.exe
- Dump all notepad.exe processes started from now on
procdumpex -ma -e -w notepad.exe
- Combine both cases above
procdumpex -ma -e -w notepad.exe -d notepad.exe
You can list multiple process names with comma separated in one command.
- Dump all notepad.exe and calc.exe started later on when they use more than 30% CPU for 3 seconds
procdumpex -ma -e -c 30 -s 3 -w "notepad.exe,calc.exe"
A more realistic example is to dump process when a performance counter hits (-p option provided by procdump), for example:
- Dump following processes when the system total CPU hits 80%.
procdumpex -ma -e -s 2 -n 3 -w "chrome.exe,wmplayer.exe" -d "chrome.exe,wmplayer.exe" -p "\Processor(_Total)\% Processor Time" 80 C:\temp\dump\PROCESSNAME_PID_YYMMDD_HHMMSS.dmp
- Dump all (actually up to 100) first chance exceptions (-e 1) of a deferred launched image names.
ProcDumpEx.exe -ma -e 1 -n 100 -w foobar.exe
Another good feature is you just need to click CTRL+C to clean up all command windows that are opened.