How do I get the “bucket id” that winqual uses if I have a minidump file or exception structure? (Windows c++)

Question

There are a few related questions on SO - but have not found the answer -

I would like to generate a "signature"/bucket id to report a minidump/crash back to our issue tracking system. Since MS already does this with "bucket ids" I figured I could just re-use their bucket/signature generation.

Can I get that ID from either a top level filter or the _EXCEPTION_POINTERS object I have inside the filter or the _MINIDUMP_EXCEPTION_INFORMATION structure or from the minidump itself?

This is a C++ application.

Answer 1

There's a paper talking about how Microsoft guys create bucket id at the first place (, and yes, of course, this paper is from Microsoft). You don't really need to reverse engineering exactly the same bucketing algorithm they use. It's the idea that works.

The paper can be found at http://www.sigops.org/sosp/sosp09/papers/glerum-sosp09.pdf They also do a slide since this is a SIGOPS paper: http://www.sigops.org/sosp/sosp09/slides/glerum-slides-sosp09.pdf

Answer 2

Not sure which bucket id you need. The numeric id is assigned by the server and you can find it after the report is sent by looking at the event log. Look for event ID 1001 in the application event log.

To find the bucket id in string format use windbg or cdb and use the !analyze command.

Note that for the purpose of actually bucketing you will probably want to look at WATSON_STAGEONE_URL rather than BUCKET_ID.