Dump-ScanningProcessOnTimeout.ps1

# Dump-ScanningProcessOnTimeout

###################################
#
# Change these paths as needed.
# 

$dumpFolder = 'C:\data'
$procdumpBinary = 'C:\ProgramData\chocolatey\lib\sysinternals\tools\procdump.exe'

#
###################################

$serverName = [Environment]::MachineName
$startTime = (Get-Date).ToString("o")
"Watching for events. Ctrl-C to exit."
$dumpsGenerated = $false
while ($true)
{
    $newEvents = Get-WinEvent -ComputerName $serverName -FilterHashTable @{LogName="Application";StartTime=$startTime;ID=2213} -ErrorAction SilentlyContinue
    if ($newEvents -eq $null)
    {
        Start-Sleep -Milliseconds 250
        continue
    }

    foreach ($event in $newEvents)
    {
        $m = $event.Message | Select-String "PID=(\d+)"
        $p = $m.Matches.Groups[1].Value

        Write-Host "Timeout detected on scanningprocess PID $p"
        Write-Host "Dumping PID $p"
        & $procdumpBinary -ma $p $dumpFolder -accepteula
        $dumpsGenerated = $true
    }

    if ($dumpsGenerated)
    {
        "Dumps were generated. Pausing for 1 minute..."
        Start-Sleep 60
        $dumpsGenerated = $false
    }

    $startTime = (Get-Date).ToString("o")
    "Watching for events. Ctrl-C to exit."
}