Host and Dig under Windows

Recently I had some DNS problems, I was looking for a Host and Dig command under windows. There is an excellent port that also includes whois command. I totally forgot that under windows there is nslookup (I am getting too old for this). But I figured out that I know how to do it based on system.net library, so I used PowerShell to resolve a host:

[System.Net.Dns]::GetHostAddresses("www.google.com")

I always keep in my memory a public google DNS server.

google public DNS: 8.8.8.8

But unfortunately there is no way for .NET to specify what DNS server use to resolve a host. The reason for that is because DNS.Resolve method relies on the internal Win32 APIs which in turn go through the DNS servers associated with the network connection. In order to change a DNS server one needs to change and configure a network adapter. Ech... I can tell that I am more a developer then admin :)

A great query to identify missing indexes and print it as a create index query. They are ordered by a Total Cost

SELECT  TOP 10 
        [Total Cost]  = ROUND(avg_total_user_cost * avg_user_impact * (user_seeks + user_scans),0) 
        , avg_user_impact
        , TableName = statement
        , [EqualityUsage] = equality_columns 
        , [InequalityUsage] = inequality_columns
        , [Include Cloumns] = included_columns
FROM        sys.dm_db_missing_index_groups g 
INNER JOIN    sys.dm_db_missing_index_group_stats s 
       ON s.group_handle = g.index_group_handle 
INNER JOIN    sys.dm_db_missing_index_details d 
       ON d.index_handle = g.index_handle
ORDER BY [Total Cost] DESC;

Where Total Cost stands for:

total cost=(avg_total_user_cost *avg_user_impact *(user_seeks +user_scans))/1000'000

• avg_total_user_cost – Average cost of the user queries that could be reduced by the index in the group
• avg_user_impact – Average percentage benefit that user queries could experience if this missing index group was implemented. The value means that the query cost would on average drop by this percentage if this missing index group was implemented
• user_seeks – Number of seeks caused by user queries that the recommended index in the group could have been used for
• user_scans – Number of scans caused by user queries that the recommended index in the group could have been used for

Below is a nice query to generate an actual command for an index creation:

PRINT 'Missing Indexes: '
PRINT 'The "improvement_measure" column is an indicator of the (estimated) improvement that might '
PRINT 'be seen if the index was created. This is a unitless number, and has meaning only relative '
PRINT 'the same number for other indexes. The measure is a combination of the avg_total_user_cost, '
PRINT 'avg_user_impact, user_seeks, and user_scans columns in sys.dm_db_missing_index_group_stats.'
PRINT ''
PRINT '-- Missing Indexes --'
SELECT CONVERT (varchar, getdate(), 126) AS runtime,
  mig.index_group_handle, mid.index_handle,
  CONVERT (decimal (28,1), migs.avg_total_user_cost * migs.avg_user_impact * (migs.user_seeks + migs.user_scans)) AS improvement_measure,
  'CREATE INDEX missing_index_' + CONVERT (varchar, mig.index_group_handle) + '_' + CONVERT (varchar, mid.index_handle)
  + ' ON ' + mid.statement
  + ' (' + ISNULL (mid.equality_columns,'')
    + CASE WHEN mid.equality_columns IS NOT NULL AND mid.inequality_columns IS NOT NULL THEN ',' ELSE '' END + ISNULL (mid.inequality_columns, '')
  + ')'
  + ISNULL (' INCLUDE (' + mid.included_columns + ')', '') AS create_index_statement,
  migs.*, mid.database_id, mid.[object_id]
FROM sys.dm_db_missing_index_groups mig
INNER JOIN sys.dm_db_missing_index_group_stats migs ON migs.group_handle = mig.index_group_handle
INNER JOIN sys.dm_db_missing_index_details mid ON mig.index_handle = mid.index_handle
WHERE CONVERT (decimal (28,1), migs.avg_total_user_cost * migs.avg_user_impact * (migs.user_seeks + migs.user_scans)) > 10
ORDER BY migs.avg_total_user_cost * migs.avg_user_impact * (migs.user_seeks + migs.user_scans) DESC
PRINT ''
GO 

Thread, Wait and debugging Sitecore under WinDbg

When running a command to display all threads and stack assigned to a thread it is common to see a following picture:

~*e !CLRStack
...
OS Thread Id: 0x10ec (37)
Child-SP         RetAddr          Call Site
000000000c4de8e0 000007ff006e168f Sitecore.IO.FileWatcher.Worker()
000000000c4de930 000007ff0100e510 System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
000000000c4de980 000007fef96ceb52 System.Threading.ThreadHelper.ThreadStart()
OS Thread Id: 0x10f8 (38)
...
OS Thread Id: 0x1268 (43)
Child-SP         RetAddr          Call Site
000000000ba5e4e0 000007ff01298285 System.Threading.WaitHandle.WaitAny(System.Threading.WaitHandle[], Int32, Boolean)
000000000ba5e540 000007ff006e168f System.Net.TimerThread.ThreadProc()
000000000ba5e610 000007ff0100e510 System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
000000000ba5e660 000007fef96ceb52 System.Threading.ThreadHelper.ThreadStart()
...
OS Thread Id: 0x1368 (46)
Child-SP         RetAddr          Call Site
000000000cf7e5c0 000007ff00f6ed56 System.Threading.Thread.Sleep(System.TimeSpan)
000000000cf7e600 000007ff006e168f Sitecore.Services.Heartbeat.WorkLoop()
000000000cf7e6c0 000007ff0100e510 System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
000000000cf7e710 000007fef96ceb52 System.Threading.ThreadHelper.ThreadStart()
...
the process
OS Thread Id: 0x1008 (49)
Child-SP         RetAddr          Call Site
000000000d03e5f0 000007ff0163a0b7 Sitecore.Threading.Semaphore.P()
000000000d03e640 000007ff006e168f Sitecore.Threading.ManagedThreadPool.ProcessQueuedItems()
000000000d03e6a0 000007ff0100e510 System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
000000000d03e6f0 000007fef96ceb52 System.Threading.ThreadHelper.ThreadStart()
...

Each of listed above stack traces appear few times in a memory dump. When analyzing any of those stacks there is no magic or suspicious staff. This is how Sitecore was designed and how it works.

PerfMon typical counters

A list of general counters that I usually use. I set up a PerfMon to run in a background and log data.

Web Service->Current Connections->Publishing-shared
Web Service->Get Requests/sec->Publishing-shared
Web Service->Current Anonymous Users->Publishing-shared
System -> Processor Queue Length
Processor -> % Processor Time->_Total
Process -> Working Set->_Total
PhysicalDisk -> Current Disk Queue Length->_Total
PhysicalDisk -> Disk Bytes/sec->_Total
Network Interface-> Bytes Total/sec->[Select network adapter]
Network Interface-> Output Queue Length->[Select network adapter]
Network Interface-> Packets Received Errors->[Select network adapter]
Memory -> Available MBytes
Memory -> Pages Input/sec

IIS logs

Some people tried to convince me that by default IIS does not log response time. IIS supports 3 types of logging formats:

• IIS
• NCSA
• W3C
• Custom

And by default W3C is used. W3C is the only one not including Custom, that allowed you to specify fields that are logged. By default it's configuration looks like below:

The filed that is responsible for logging a response time is time-taken, and by default it is turned on.
And here is one more query that I found useful, I tend to run it with GET, POST, and not like GET or POST, to compare what type of requests are hitting my site.

logparser "SELECT count(cs-uri-stem) FROM u_ex121103.log where cs-method = 'GET'"

Analyzing IIS logs

Some useful badly written queries to analyze IIS logs, when something wrong is going on. Logparser needs to be installed.
Mostly hit resource on a server, filtered by media files

logparser -i:IISW3C "SELECT TOP 10 cs-uri-stem AS Url, MIN(time-taken) as [Min], AVG(time-taken) AS [Avg], max(time-taken) AS [Max], count(time-taken) AS Hits FROM  u_ex121025.log TO 'MostHitResourcesFiltered121025.csv' WHERE cs-uri-stem NOT LIKE '%media%' AND cs-uri-stem NOT LIKE '%.swf' AND cs-uri-stem NOT LIKE '%.jpg' AND cs-uri-stem NOT LIKE '%.mp3' AND cs-uri-stem NOT LIKE '%.js' AND cs-uri-stem NOT LIKE '%.woff' AND cs-uri-stem NOT LIKE '%.css' AND cs-uri-stem NOT LIKE '%.png' AND cs-uri-stem NOT LIKE '%.gif' AND cs-uri-stem NOT LIKE '%.eot' AND cs-uri-stem NOT LIKE '%.ico' GROUP BY Url ORDER BY [Hits] DESC"  -o:csv

Requests that took longest time to anwser - I like to order it by Avg, Min and Max. Below just sorted by Avg example.

logparser -i:IISW3C "SELECT TOP 10 cs-uri-stem AS Url, MIN(time-taken) as [Min], AVG(time-taken) AS [Avg], max(time-taken) AS [Max], count(time-taken) AS Hits FROM  u_ex121025.log  TO 'Avg121025.csv' WHERE cs-uri-stem NOT LIKE '%media%' AND cs-uri-stem NOT LIKE '%.swf' AND cs-uri-stem NOT LIKE '%.jpg' AND cs-uri-stem NOT LIKE '%.mp3' AND cs-uri-stem NOT LIKE '%.js' AND cs-uri-stem NOT LIKE '%.woff' AND cs-uri-stem NOT LIKE '%.css' AND cs-uri-stem NOT LIKE '%.png' AND cs-uri-stem NOT LIKE '%.gif' AND cs-uri-stem NOT LIKE '%.eot' GROUP BY Url HAVING Hits > 5 ORDER BY [Avg] DESC" -o:csv

When I am interested in some specific site, and I want to know as much as I can about it. In example below, I am interested in a url that has 'last' string inside it.

logparser -i:IISW3C "SELECT date, time, s-ip, cs-method, cs-uri-stem, cs-uri-query, s-port, cs-username, c-ip, cs(User-Agent), sc-status, sc-substatus, sc-win32-status, time-taken FROM  u_ex121103.log  TO 'WhoHitLMO121103.csv' WHERE cs-uri-stem NOT LIKE '%media%' AND cs-uri-stem NOT LIKE '%.swf' AND cs-uri-stem NOT LIKE '%.jpg' AND cs-uri-stem NOT LIKE '%.mp3' AND cs-uri-stem NOT LIKE '%.js' AND cs-uri-stem NOT LIKE '%.woff' AND cs-uri-stem NOT LIKE '%.css' AND cs-uri-stem NOT LIKE '%.png' AND cs-uri-stem NOT LIKE '%.gif' AND cs-uri-stem NOT LIKE '%.eot' AND cs-uri-stem LIKE '%last%'" -o:csv

A load testing tool

JMeter takes to much time to set up, usually I am not interested in results or response time. The simplest way to load test an app, use tinyget:

tinyget -srv:uat3.google.com -uri:/usa/offers/LHO -threads:10 -loop:20

Profiling SQL Server 2005 and 2008

I am used to use SQL Server Dashboard for profiling SQL Server 2005. By profiling I mean, something nasty is going on between application and SQL Server and no one has any clue what is the reason. This is why Microsoft wrote a series of useful reports that gather information, or use data stored in Master database, to help you to understand what may be the reason. Unfortunately SQL Server 2008 does not support Dashboard, it was replaced by SQL Server Performance Studio. I installed recently Performance Studio, I was hoping to see something similar to Dashboard, unfortunately Performance Studio is a full blown Warehouse - it gathers plenty of additional counters when application is running. It hugely increase CPU usage. While running it in my Test Bed, I receive plenty of Timeout requests to a DB server, I don't recommend it to be installed on a machine that is facing CPU Utilization or memory problems :) Due to that I had to use good old SQL queries to figure out what is going on. There is a nice article explaining how to do it. To see what DB is hit the most I use

SELECT TOP 10 
        [Total Reads] = SUM(total_logical_reads)
        ,[Execution count] = SUM(qs.execution_count)
        ,DatabaseName = DB_NAME(qt.dbid)
FROM sys.dm_exec_query_stats qs
CROSS APPLY sys.dm_exec_sql_text(qs.sql_handle) as qt
GROUP BY DB_NAME(qt.dbid)
ORDER BY [Total Reads] DESC;

SELECT TOP 10 
        [Total Writes] = SUM(total_logical_writes)
        ,[Execution count] = SUM(qs.execution_count)
        ,DatabaseName = DB_NAME(qt.dbid)
FROM sys.dm_exec_query_stats qs
CROSS APPLY sys.dm_exec_sql_text(qs.sql_handle) as qt
GROUP BY DB_NAME(qt.dbid)
ORDER BY [Total Writes] DESC;

Null means temporary table not assigned to any DB. To see the most costly queries

SELECT TOP 10 
 [Average IO] = (total_logical_reads + total_logical_writes) / qs.execution_count
,[Total IO] = (total_logical_reads + total_logical_writes)
,[Execution count] = qs.execution_count
,[Individual Query] = SUBSTRING (qt.text,qs.statement_start_offset/2, 
         (CASE WHEN qs.statement_end_offset = -1 
            THEN LEN(CONVERT(NVARCHAR(MAX), qt.text)) * 2 
          ELSE qs.statement_end_offset END - qs.statement_start_offset)/2) 
        ,[Parent Query] = qt.text
,DatabaseName = DB_NAME(qt.dbid)
FROM sys.dm_exec_query_stats qs
CROSS APPLY sys.dm_exec_sql_text(qs.sql_handle) as qt
ORDER BY [Average IO] DESC;

Queries executed most often

SELECT TOP 10 
 [Execution count] = execution_count
,[Individual Query] = SUBSTRING (qt.text,qs.statement_start_offset/2, 
         (CASE WHEN qs.statement_end_offset = -1 
            THEN LEN(CONVERT(NVARCHAR(MAX), qt.text)) * 2 
          ELSE qs.statement_end_offset END - qs.statement_start_offset)/2)
,[Parent Query] = qt.text
,DatabaseName = DB_NAME(qt.dbid)
FROM sys.dm_exec_query_stats qs
CROSS APPLY sys.dm_exec_sql_text(qs.sql_handle) as qt
ORDER BY [Execution count] DESC;

Usefull PerfMon counters for Memory Profiling

Counters that I usually add to PerfMon to figure out what is going on in a memory.

Counters that we need attached to w3wp.exe:
    .NET CLR Memory/# Bytes in all Heaps
    .NET CLR Memory/Large Object Heap Size
    .NET CLR Memory/Gen 2 heap size
    .NET CLR Memory/Gen 1 heap size
    .NET CLR Memory/Gen 0 heap size
    Process/Private Bytes
    Process/Virtual Bytes

.NET crash dump debugging

Yet again I was debugging an application using WinDbg recently. Here is a list of more commands, that I found useful. First, when I load WinDbg under Windows 7 i first run:

*SRV*DownstreamStore*http://msdl.microsoft.com/download/symbols*
.sympath srv*
.reload
.loadby sos mscorwks

Then I install in some folder useful extension. Those extensions are useful, especially for GC Collection debugging, and searching for deadlocks. A brief description of commands. And I run:

.load C:\worek\sosex\sosex

With an extension installed I can check for deadlocks

!locks                     -- original WinDbg command
!dlk                       -- really nice extension

After checking for deadlocks I look at a memory. I am interested in how much memory is used. Unknown memory is a virtual memory.

!address -summary
......
--- Usage Summary ---------------- RgnCount ----------- Total Size -------- %ofBusy %ofTotal
Free                    713      7fb`d81ce000 (   7.984 Tb)           99.80%
<unknown>        2328        3`fb052000 (  15.922 Gb)  95.78%    0.19%
Heap                    188        0`18782000 ( 391.508 Mb)   2.30%    0.00%
Image                  3046        0`11147000 ( 273.277 Mb)   1.61%    0.00%
Stack                   303        0`03280000 (  50.500 Mb)   0.30%    0.00%
Other                    19        0`001bc000 (   1.734 Mb)   0.01%    0.00%
TEB                     101        0`000ca000 ( 808.000 kb)   0.00%    0.00%
PEB                       1        0`00001000 (   4.000 kb)   0.00%    0.00%
.....

To see what is inside virtual memory one can run:

!address -f:VAR

Then I look at types in memory. I am looking at a number of objects allocated per type, and amount of memory used. String is primitive type that eats huge amount of memory.

!dumpheap -stat
.........
000007fef8eeeb88   109006      4360240 System.Collections.ArrayList
000007fef8ee7590   190421      4570104 System.Object
000007ff009bfa08    24963      4792896 Sitecore.Data.Items.Item
000007ff00a76300   102363      9826848 Sitecore.Caching.Cache+CacheEntry
000007fef8eef5f8   156519     13773672 System.Collections.Hashtable
000007fef8ed5a90   181410     17197296 System.Object[]
000007ff009bc690   573156     27511488 Sitecore.Data.ID
000007fef8eefce0     6083     43988712 System.Byte[]
000007fef8eef7c0   156694     63591264 System.Collections.Hashtable+bucket[]
000007fef8ee7ca0   903961    149734600 System.String
00000000011b5cc0     8161   1172482272      Free
Total 3615363 objects
Fragmented blocks larger than 0.5 MB:
            Addr     Size      Followed by
0000000143871e38    0.7MB 000000014392e858 System.String
0000000143b48248    0.6MB 0000000143bdb670 System.String
000000023f531080    9.1MB 000000023fe4f130 System.Threading.Overlapped

To identify who is holding a type:

!dumpheap -type TTC.TT.Nelson.Services.Data.DepartureData
...
Heap 0
         Address               MT     Size
00000000ff453010 000007ff01591f00       88     
0000000100115190 000007ff015925a8       64     
0000000100116a38 000007ff015925a8       64     
0000000100658c70 000007ff015925a8       64     
0000000100658cb0 000007ff015c6b10       64     
0000000100658d18 000007ff015925a8       64     
0000000100800e88 000007ff01591f00       88     
0000000100800fb0 000007ff01591f00       88     
00000001008010d8 000007ff01591f00       88     
0000000100801200 000007ff01591f00       88     
0000000100801328 000007ff01591f00       88     
....

I go to a specific address and try to see a trace:

!gcroot 00000000ff453010
...
Scan Thread 99 OSTHread 1384
DOMAIN(000000000263FAA0):HANDLE(Pinned):16415c0:Root:00000001ff419258(System.Object[])->
0000000140791438(System.Func`2[[TTC.TT.Nelson.Services.Data.DepartureData, TTC.TT.Nelson],[TTC.TT.Entities.TropicsAvailabilityStatus, TTC.TT.Entities]])
...

To see just managed threads:

!threads
...
                                              PreEmptive                                                Lock
       ID OSID        ThreadOBJ     State   GC     GC Alloc Context                  Domain           Count APT Exception
  10    1  e90 00000000025ec820      8220 Enabled  0000000000000000:0000000000000000 00000000025e7950     0 Ukn
  20    2  560 00000000026003f0      b220 Enabled  0000000000000000:0000000000000000 00000000025e7950     0 MTA (Finalizer)
  21    3  41c 000000000263e700    80a220 Enabled  0000000000000000:0000000000000000 00000000025e7950     0 MTA (Threadpool Completion Port)
  22    4 1270 000000000263f4d0      1220 Enabled  0000000000000000:0000000000000000 00000000025e7950     0 Ukn
  25    8 14a0 0000000004a701f0   200b020 Enabled  0000000000000000:0000000000000000 000000000263faa0     0 MTA
...

To see threads with a stack assigned to a thread:

~*e !CLRStack
...
OS Thread Id: 0x14a0 (25)
Child-SP         RetAddr          Call Site
0000000008fdede0 000007fef8da2bbb Sitecore.IO.FileWatcher.Worker()
0000000008fdee30 000007fef8e3aa7d System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
0000000008fdee80 000007fef9cc0282 System.Threading.ThreadHelper.ThreadStart()
OS Thread Id: 0x3d8 (26)
Child-SP         RetAddr          Call Site
000000000918e950 000007fef8da2bbb Sitecore.IO.FileWatcher.Worker()
000000000918e9a0 000007fef8e3aa7d System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
000000000918e9f0 000007fef9cc0282 System.Threading.ThreadHelper.ThreadStart()
...

To see what objects are waiting to be finalized:

!finalizequeue
...
000007fef8ee88c0       76         3648 System.Globalization.AgileSafeNativeMemoryHandle
000007fef8ed5270       35         4200 System.IO.FileStream
000007fef8ee8740       57         5928 System.Threading.Thread
000007fef5380810      239        13384 System.Web.DirMonCompletion
000007fef8edf1b8      444        14208 System.WeakReference
000007fef52fc188      319        25520 System.Web.UI.WebControls.Style
000007fef8f10548      956        68832 System.Reflection.Emit.DynamicResolver
000007fef5391310    18366       734640 System.Web.HttpResponseUnmanagedBufferElement

To see CPU utilization with info about how many threads/timers are in use:

!threadpool
...
CPU utilization 61%
Worker Thread: Total: 10 Running: 0 Idle: 10 MaxLimit: 400 MinLimit: 4
...

To profile a cache

!dumpheap -type System.Web.Caching.Cache -stat
Heap 3
total 5288 objects
------------------------------
total 22083 objects
Statistics:
              MT    Count    TotalSize Class Name
000007fef53815a0        1           24 System.Web.Caching.CacheKeyComparer
000007fef5381090        1           24 System.Web.Caching.Cache
000007fef5381848        1           32 System.Web.Caching.CacheKey
000007fef53813e0        1           40 System.Web.Caching.CacheMultiple
...

Then I follow the System.Web.Caching.Cache object:

!dumpheap -mt 000007fef5381090
...
Heap 1
         Address               MT     Size
000000013f41d210 000007fef5381090       24 
...
Heap 3
         Address               MT     Size
total 0 objects
------------------------------
total 1 objects
Statistics:
              MT    Count    TotalSize Class Name
000007fef5381090        1           24 System.Web.Caching.Cache

And I dump the object to see the stack:

!do 000000013f41d210
              MT    Field   Offset                 Type VT     Attr            Value Name
000007fef5380ed0  40013aa        8 ...ing.CacheInternal  0 instance 000000013f41d358 _cacheInternal
000007fef8f281e0  40013a8      370      System.DateTime  1   shared           static NoAbsoluteExpiration
                                 >> Domain:Value  00000000025e7950:NotInit  000000000263faa0:000000013f423990 0000000004d49820:NotInit  <<
000007fef8f280e0  40013a9      378      System.TimeSpan  1   shared           static NoSlidingExpiration
                                 >> Domain:Value  00000000025e7950:NotInit  000000000263faa0:000000013f4239a8 0000000004d49820:NotInit  <<
000007fef5380dd8  40013ab      380 ...emRemovedCallback  0   shared           static s_sentinelRemovedCallback
                                 >> Domain:Value  00000000025e7950:NotInit  000000000263faa0:000000013f423a08 0000000004d49820:NotInit  <<

To dump LHO heap I use

!dumpheap -min 85000
...
00000002353fa698 00000000011b5cc0 19578352 Free
00000002366a6488 000007fef8ee7ca0   114496     
00000002366c23c8 00000000011b5cc0 134666512 Free
000000023e72fcd8 000007fef8eefce0   524312     
000000023e7afcf0 00000000011b5cc0  2618528 Free
000000023ea2f190 000007fef8eef7c0   242496     
total 118 objects
------------------------------
total 450 objects
Statistics:
              MT    Count    TotalSize Class Name
000007ff01101028        1        98304 System.Data.Linq.IdentityManager+StandardIdentityManager+IdentityCache`2+Slot[[TTC.TT.Nelson.DataAccess.ZPermanentRedirect, TTC.TT.Nelson],[System.Int32, mscorlib]][]
000007fef8ee9598        1       131096 System.Char[]
000007fef8ed5a90        2       262208 System.Object[]
000007ff01ea0858        1       524280 System.Data.Linq.IdentityManager+StandardIdentityManager+IdentityCache`2+Slot[[TTC.IV.Nelson.DataAccess.ZSitecoreUrl, TTC.IV.Nelson],[System.Guid, mscorlib]][]
000007ff010d6450        1       524280 System.Data.Linq.IdentityManager+StandardIdentityManager+IdentityCache`2+Slot[[TTC.TT.Nelson.DataAccess.ZSitecoreUrl, TTC.TT.Nelson],[System.Guid, mscorlib]][]
000007fef8eef7c0       15      6673440 System.Collections.Hashtable+bucket[]
000007fef8eefce0       22     40672944 System.Byte[]
000007fef8ee7ca0      277     48983200 System.String
00000000011b5cc0      130   1151450896      Free
...

To see what's inside GC collection 2, just be careful it may crash your WinDbg session.

!dumpgen 2