How to use Sysinternals tools to troubleshoot SharePoint/Office Chad Schultz [email protected]...
-
Upload
shannon-sharp -
Category
Documents
-
view
224 -
download
4
Transcript of How to use Sysinternals tools to troubleshoot SharePoint/Office Chad Schultz [email protected]...
How to use Sysinternals tools to troubleshoot SharePoint/Office
Chad [email protected] Field Engineer, Microsoft
Started in 1996 Microsoft acquired Sysinternals in July, 2006 Mark Russinovich working at Microsoft as Technical
Fellow on Windows Azure Sysinternals Forum
http://forum.sysinternals.com/
Sysinternals History
Sysinternals on the “Net” http://technet.microsoft.com/en-us/sysinternals/default.aspx
Download the tools http://live.sysinternals.com/tools
Drag and Drop newest tools NET USE S: http://live.sysinternals.com/tools
Sysinternals Tools Info/Download
Not loaded on Windows operating systems by default Work in Windows 2000 SP4 and up No installer/uninstall for these tools Always right-click and ‘Run as administrator’ on Vista & up The first time the programs are run, the EULA will display,
after accepting the EULA the first time, this screen should not reappear
Tool command line switches ToolName /? ToolName /AcceptEULA
Sysinternals Tools Continued…
Process Explorer Process Monitor AccessEnum VMMap
Sysinternals Tools
Task Manager on steroids! Monitors running process in real time No historical data Graph data per machine and process Show parent/child processes Can view process DLLs, threads and handles Change default columns
Process Explorer
Lists environment and privileges for each process Shows DEP, ASLR, 32/64 bit and virtualized processes Memory dumps Process Highlighting Load Dbghelp.dll from Debugging Tools for Windows
Windows SDK Configure symbols for thread stack information
SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Find window Real-time performance indicators per process
More Process Explorer
Screenshot of Excel 2010 64-bit without ad-ins or macros
Excel is only running native code. No .NET.
Excel is running .Net code; Excel Automation, add-in, etc.
Process Explorer Excel
Use Process Explorer to troubleshoot blank page error
Lab 1
Collects system event data while running Monitors File, Registry, network and process activity Runs on Windows 2000 SP4, XP SP2, Vista, 2003, 2008
and Windows 7 32 bit and 64 bit Does not capture historical performance data Can save events for later research 3 formats; PML, CSV
and XML Backed by page file; 199 million events max Performance impact minimal
Process Monitor
Filters; Menu & right-click Tools->Count Occurrences
More Process Monitor
Error results aren’t necessarily bad: ACCESS DENIED
Often the source of problems DELETE PENDING
The file or folder is trying to delete, but an open handle may be stopping the delete NOT FOUND, PATH NOT FOUND, NAME NOT FOUND
Common in DLL PATH searches, queries for optional functionality or settings BUFFER OVERFLOW, BUFFER TO SMALL
Application is asking how much data there is FAST IO DISALLOWED
Internal indicator that optimized I/O path is not available END OF FILE
Application tried to access beyond the end of a file, normal operation REPARSE
Symbolic link traversal For more information on these error codes see; http://msdn.microsoft.com/en-us/library/ms681381.aspx
Process Monitor Results Primer
Use Process Monitor to Troubleshoot “Server Error in ‘/’ Application
Lab 2
Check permissions of a folder structure Good to run after finding “Access Denied” events in
Process Monitor Common problem areas
ASP.Net temporary file location c:\windows\Microsoft.net\Framework(64)\v2.0.50727\Temorary ASPNET Files
%temp% file location
AccessEnum
View Name Not Found event while loading Excel with .Net code
Process Monitor Excel
Demo
Graphical representation of virtual memory allocations for a process
Live output Task Manager and Process Explorer is just one side of
checking memory in use
VMMap
How much total memory does Excel use?
Lab 3
Windows SharePoint Services Timer (OWSTIMER.EXE) Internet Information Server application pools
(w3wp.exe) Office SharePoint Server Search parent process
(mssearch.exe) SharePoint Search crawl process (msdmn.exe)
SharePoint Processes to Monitor
Badly performing application pools Security event login failures to local resources Timer job errors Crawling local file system content sources Installation errors
SharePoint Issues to Monitor
Crawling SharePoint Sites or external sources SQL login failures SQL connection issues Performance issues where detailed historical
performance information is needed
SharePoint Issues not to Monitor
Most up to date tools:http://live.sysinternals.com
Sysinternals blog:http://blogs.technet.com/sysinternals
Sysinternals blog:http://forum.sysinternals.com/
Chad’s Blog:http://blogs.technet.com/Chad
Mark’s Blog:http://blogs.technet.com/markrussinovich
Links/Questions?