[SOLVED] How to look for a thread with specific call stacks (from thousands of threads)

How to look for a thread with specific call stacks (from thousands of threads)

I need to look at a thread with specific stack trace from a dump-file. This file has has thousands of threads

0:638> !threads
ThreadCount:      23800
UnstartedThread:  175
BackgroundThread: 4569
PendingThread:    194
DeadThread:       19053
Hosted Runtime:   no

I used ~* e !clrstack in an attempt to get all stacks that I can later search through. But I guess windbg buffer is small enough because when I scroll to the top, I simply getting few hundred thread stacks. I try to use the option to write the results in text file but that only seem to just writeout whatever is in the buffer. Any idea I can get either make the windbg window buffer really really big or any other trick to look for thread that may have a specific callstack?

Solution

use .logopen yourpath\foo.txt prior to any command windbg will log everything in the txt file

0:000> .logopen d:\foo.txt
Opened log file 'd:\foo.txt'

0:000> ~* e kb
RetAddr           : Args to Child                                                           : Call Site
00007ff8`c4d3444f : 00000072`ece4d000 00007ff8`c4d8d4b0 00007ff8`c4d8d4b0 00007ff8`c4d8d4b0 : ntdll!LdrpDoDebuggerBreak+0x30
xx
RetAddr           : Args to Child                                                           : Call Site
xx

0:000> .logclose
Closing open log file d:\foo.txt
0:000> q

cat d:\foo.txt
Opened log file 'd:\foo.txt'

0:000> ~* e kb
RetAddr           : Args to Child                                                           : Call Site
00007ff8`c4d3444f : 00000072`ece4d000 00007ff8`c4d8d4b0 00007ff8`c4d8d4b0 00007ff8`c4d8d4b0 : ntdll!LdrpDoDebuggerBreak+0x30

cat d:\foo.txt | wc
     27     193    2736