270 likes | 467 Views
How to use Sysinternals tools to troubleshoot SharePoint/Office. Chad Schultz Chad.a@microsoft.com Premier Field Engineer, Microsoft. Sysinternals History. Started in 1996 Microsoft acquired Sysinternals in July, 2006
E N D
How to use Sysinternals tools to troubleshoot SharePoint/Office Chad Schultz Chad.a@microsoft.com Premier Field Engineer, Microsoft
Sysinternals History • Started in 1996 • Microsoft acquired Sysinternals in July, 2006 • Mark Russinovich working at Microsoft as Technical Fellow on Windows Azure • Sysinternals Forum • http://forum.sysinternals.com/
Sysinternals Tools Info/Download • Sysinternals on the “Net” • http://technet.microsoft.com/en-us/sysinternals/default.aspx • Download the tools • http://live.sysinternals.com/tools • Drag and Drop newest tools • NET USE S: http://live.sysinternals.com/tools
Sysinternals Tools Continued… • Not loaded on Windows operating systems by default • Work in Windows 2000 SP4 and up • No installer/uninstall for these tools • Always right-click and ‘Run as administrator’ on Vista & up • The first time the programs are run, the EULA will display, after accepting the EULA the first time, this screen should not reappear • Tool command line switches • ToolName /? • ToolName /AcceptEULA
Sysinternals Tools Process Explorer Process Monitor AccessEnum VMMap
Process Explorer Task Manager on steroids! Monitors running process in real time No historical data Graph data per machine and process Show parent/child processes Can view process DLLs, threads and handles Change default columns
More Process Explorer • Lists environment and privileges for each process • Shows DEP, ASLR, 32/64 bit and virtualized processes • Memory dumps • Process Highlighting • Load Dbghelp.dll from Debugging Tools for Windows • Windows SDK • Configure symbols for thread stack information • SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols • Find window • Real-time performance indicators per process
Process Explorer Excel Screenshot of Excel 2010 64-bit without ad-ins or macros Excel is only running native code. No .NET. Excel is running .Net code; Excel Automation, add-in, etc.
Lab 1 Use Process Explorer to troubleshoot blank page error
Process Monitor Collects system event data while running Monitors File, Registry, network and process activity Runs on Windows 2000 SP4, XP SP2, Vista, 2003, 2008 and Windows 7 32 bit and 64 bit Does not capture historical performance data Can save events for later research 3 formats; PML, CSV and XML Backed by page file; 199 million events max Performance impact minimal
More Process Monitor Filters; Menu & right-click Tools->Count Occurrences
Process Monitor Results Primer • Error results aren’t necessarily bad: • ACCESS DENIEDOften the source of problems • DELETE PENDING The file or folder is trying to delete, but an open handle may be stopping the delete • NOT FOUND, PATH NOT FOUND, NAME NOT FOUNDCommon in DLL PATH searches, queries for optional functionality or settings • BUFFER OVERFLOW, BUFFER TO SMALLApplication is asking how much data there is • FAST IO DISALLOWEDInternal indicator that optimized I/O path is not available • END OF FILEApplication tried to access beyond the end of a file, normal operation • REPARSESymbolic link traversal • For more information on these error codes see; http://msdn.microsoft.com/en-us/library/ms681381.aspx
Lab 2 Use Process Monitor to Troubleshoot “Server Error in ‘/’ Application
AccessEnum • Check permissions of a folder structure • Good to run after finding “Access Denied” events in Process Monitor • Common problem areas • ASP.Net temporary file location c:\windows\Microsoft.net\Framework(64)\v2.0.50727\Temorary ASPNET Files • %temp% file location
Process Monitor Excel Demo View Name Not Found event while loading Excel with .Net code
VMMap Graphical representation of virtual memory allocations for a process Live output Task Manager and Process Explorer is just one side of checking memory in use
Lab 3 How much total memory does Excel use?
SharePoint Processes to Monitor • Windows SharePoint Services Timer (OWSTIMER.EXE) • Internet Information Server application pools (w3wp.exe) • Office SharePoint Server Search parent process (mssearch.exe) • SharePoint Search crawl process (msdmn.exe)
SharePoint Issues to Monitor • Badly performing application pools • Security event login failures to local resources • Timer job errors • Crawling local file system content sources • Installation errors
SharePoint Issues not to Monitor • Crawling SharePoint Sites or external sources • SQL login failures • SQL connection issues • Performance issues where detailed historical performance information is needed
Links/Questions? • Most up to date tools: http://live.sysinternals.com • Sysinternals blog: http://blogs.technet.com/sysinternals • Sysinternals blog: http://forum.sysinternals.com/ • Chad’s Blog: http://blogs.technet.com/Chad • Mark’s Blog: http://blogs.technet.com/markrussinovich