The Case of the Unexplained….pptx

The Case of the Unexplained…Mark Russinovich Technical Fellow Windows AzureWCL304OutlineIntroduction Sluggish Performance Application Hangs Error Messages Malware Blue ScreensCase of the Unexplained…This is the 2011 version of the “case of the unexplained” talk series Previous versions covered different cases Can view webcast on Sysinternals->Mark’s webcasts Based on real case studies Some of these have been written up on my blogTroubleshootingMost applications do a poor job of reporting unexpected errors Locked, missing or corrupt files Missing or corrupt registry data Permissions problems Errors manifest in several different ways Misleading error messages Crashes or hangsPurpose of TalkShow you how to solve these classes of problems by peering beneath the surface Interpreting process, file and registry activity Interpreting call stacks You’ll learn tools and techniques to help you solve seemingly unsolvable problemsTools We’ll UseSysinternals: (\\redmond\files\SYSINTERNALS\LBI\Latest) Process Explorer – process/thread viewer Process Monitor – file/registry/process/thread tracing Autoruns – displays all autostart locations SigCheck – shows file version information PsExec – execute processes remotely or in the system account TcpView – shows TCP/IP endpoints Strings – dumps printable strings in any file Zoomit – presentation tool I’m using Microsoft downloads: Debugging Tools for Windows: Windbg application and kernel debugger: (//dbg) OutlineSluggish Performance Application Hangs Error Messages Malware Blue ScreensProcess ExplorerProcess Explorer is a Task Manager replacement You can literally replace Task Manager with Options->Replace Task Manager Hide-when-minimized to always have it handy Hover the mouse to see a tooltip showing the process consuming the most CPU Open System Information graph to see CPU usage history Graphs are time stamped with hover showing biggest consumer at point in time Also includes other activity such as I/O, kernel memory limitsProcess Explorer 2010 UpdatesVersions 12 and 14 included many enhancements, big and small: Network and disk activity Multi-tab system information Tree CPU usage Improved DLL scanning algorithm Command-lines in process tooltips Svchost information Service threads .NET assembly information Support for > 64More precise CPU accountingTask Manager, Resource Monitor and older Process Explorer versions use time-slice accounting Whatever thread is executing at a timer tick (typically 15.6ms) is charged for the entire time slice Charge is kernel mode if thread is in kernel mode, user mode for user mode Process Explorer v14.1 uses cycle counts Full cycle count usage on Win7/Server 2008 R2 because of new API On Vista uses cycle counts to detect Mark’s Webcasts My blog Windows Internals: understand the way the OS works If you’ve solved one, send me a description, screenshots and log files!Track ResourcesDon’t forget to visit the Cloud Power area within the TLC (Blue Section) to see product demos and speak with experts about the Server & Cloud Platform solutions that help drive your business forward.You can also find the latest information about our products at the following links: Windows Azure - System Center - Forefront - Server - Cloud Power - Private Cloud - R On-Demand & CommunityMicrosoft Certification & Training ResourcesResources for IT ProfessionalsResources for D LearningConnect. Share. Discuss.Complete an evaluation on CommNet and enter to win!Scan the Tag to evaluate this session now on myTech•Ed Mobile。