Information:

Environment

AppMon: 5.6+

Symptoms

In the <DT_HOME>/log folder appear big files with .dmp file extension.

Solution

These files are crash dumps and in general, the root cause of the crashes should be investigated. For crashing .NET applications (incl. IIS w3wp.exe worker processes), please take a look into the Windows event log ("Application" log) and search for unhandled managed exceptions. You will usually find the stacktrace already in a related error event log entry.

In case you don't find any Dynatrace involvement, please forward the stacktrace to the application developers and temporarily disable the crashdump creation with one of the 3 options to not flood the disk:

  • a global environment variable DT_SUPPRESSCRASHDUMP = true (affects all agents on that host)
  • more selectively in the registry by adding a string value named suppresscrashdump with the value true to the related .NET agent configuration below [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\dynaTrace\Agent\whitelist\<num>]
  • since .NET agent v6.3 by adding a debug flag to the related agent mapping named debugSuppressCrashDumpNative (set to "on") according to Setting AppMon Agent Debug Flags

Help on verifying if the Dynatrace agent is involved, can be provided by the automatic dump analysis tool SuperDump, which is maintained and used by the Dynatrace development team.

Root Cause

Webserver and .NET agents are implementing a crash handler that is automatically capturing a crash dump, independent of the root cause, simply for having data to analyze the crash. For the .NET agent, the behavior is still active by default, but can be disabled as mentioned above. For webserver agents it explicitly needs to be activated, since it is deactivated since v6.0.