CollectDumpsOnPerfTrigger.ps1

$dataFolder = 'C:\CollectedData'
$procdumpBinary = 'C:\tools\sysinternals\procdump.exe'

#####

$localComputerName = [Environment]::MachineName

function Log($logString)
{
    (Get-Date).ToString("o") + " " + $logString
}

# Monitor counter for threshold
function WaitForCounter($counter, $value, $duration)
{
    Log ("Started watching " + $counter + " to reach " + $value + " for " + $duration)
    $timeCounterReached = [DateTime]::MaxValue

    Get-Counter -Counter $counter -Continuous |
    % { 
        Log ($_.CounterSamples[0].CookedValue);
        $now = [DateTime]::Now;
        if ($_.CounterSamples[0].CookedValue -eq $value) 
        {
            if ($timeCounterReached -gt $now) 
            {
                Log ("The counter reached the threshold. Waiting " + $duration + " before collection.")
                $timeCounterReached = $now
            }
            
            if ($timeCounterReached -le $now)
            {
                $currentDuration = $now - $timeCounterReached
                Log ("Counter reached desired value " + $currentDuration + " ago.")
                if ($currentDuration -ge $duration)
                {
                    Log ("Trigger hit!")
                    Log ("Generating procdump...")
                    & $procdumpBinary store.exe $dataFolder -accepteula
                    & $procdumpBinary Microsoft.Exchange.RpcClientAccess.Service.exe $dataFolder -accepteula
                    # Send-MailMessage -To user@contoso.com -From user@contoso.com -Subject "Alert on $localComputerName" -Body "Trigger hit" -SmtpServer mail.contoso.com
                    Log ("Done!")
                    break
                }
            }
        }
        else 
        {
            if ($timeCounterReached -lt $now)
            {
                Log ("Counter dropped below threshold.")
                $timeCounterReached = [DateTime]::MaxValue
            }
        }
    }
    # End of script block
}

##############################
#
# Here's where we start monitoring. Adjust as needed.
#

WaitForCounter "\MSExchangeIS\RPC Operations/sec" 0 (new-object TimeSpan(0, 0, 20))

#
##############################