How to build an application that displays more stack information in Process Monitor?

Question

I've just discovered Sysinternal's Process Monitor and love the insights it gives on what a process is doing. However, when I try to see detail of a software call to the kernel, the stack is filled with "unknowns". How should I build my application so that function names appear at the stack trace?

Answer 1

Often compiling it with /Zi, and linking it with /debug should be enough. You should get a PDB file which contains all the debug information of your application. As long as you don't move the executable or PDB, Process Monitor should normally find it.

If you have multiple versions of your application, or if you want to investigate the call stack on other machines, it might be better to set up a Symbol Server. You then need to store all your EXE's and PDB files into the Symbol Server (using the symstore utility), and set up your system so that Process Monitor uses the Symbol Server to find the debug information. The information at http://support.microsoft.com/kb/311503 should get your started.

One way that works normally is to set an environment variable _NT_SYMBOL_PATH:

set _NT_SYMBOL_PATH=symsrv*symsrv.dll*\\yourserver\symbols*http://msdl.microsoft.com/download/symbols

... where \\yourserver\symbols would be a share that is writable and readable, but could just as well be a local path on your computer. This is where the symbols get cached for repeated use.