Clint Huffman's Windows Troubleshooting in the Field Blog

Clint Huffman is a Microsoft Premier Field Engineer (PFE) who has been with Microsoft for over 10 years. This blog documents the challenges he faces week to week in hopes that these experiences will help others.

Clint Huffman's Windows Troubleshooting in the Field Blog

  • Using Autoruns to validate system drivers

    Recently, one of my enterprise customers had a system crash popularly known as a “blue screen of death” and this reminded me of the importance to validate drivers. Validating drivers is something I commonly do with my non-techie friends and family as...
  • Convert a performance counter data collector template into a PAL threshold file

    If you want to have all of the counters in a counter log be represented in a PAL report, then use the AllCounterStats feature in the PAL Wizard. This will use all of the thresholds in the PAL threshold files as well as ensure that all of the counters...
  • Tracking page file reads and writes

      The only real way of knowing if a page file is actually being “read from” is to get a file IO trace. This can be collected and/or viewed with tools such as the Microsoft Performance Recorder/Analyzer, Microsoft Resource Monitor, or Sysinternals...
  • Full debugging of VBScripts using Visual Studio 2005

    Want to do *full* debugging of a VBScripts, then use this procedure. One of the hardest parts about scripting is getting to know the properties and methods of objects and state of a script during execution.  In this procedure, I show you how to modify...
  • Out of Pool Paged memory on 32-bit Windows Server 2003

    Lately, I have been assisting customers who are still using 32-bit Windows Server 2003 and inevitably running out of kernel pool memory. When one of the kernel pools (Pool Paged and Pool Nonpaged) are full (meaning a memory allocation to one of these...
  • My personal reminder of common debugging commands

    I don’t get as many opportunities to debug as I would like, but when I do, I always forget the command that I like to use, so this is my personal document to remind me of those commands. !sym noisy This gives me details of symbol resolution. .reload ...
  • Detecting ephemeral port exhaustion

    Ephemeral ports are range of ports that Windows and Windows Server use for outbound communications over the TCP/IP network protocol. When an outbound connection is finished, the port associated to the connection is put into a TIMED_WAIT state for two...
  • Physical memory overwhelmed PAL analysis - holy grail found!

    I just wrote a very complicated PAL analysis that determines if physical memory is overwhelmed. This analysis takes into consideration the amount of available physical memory and the disk queue length, IO size, and response times of the logical disks...
  • Should the paging file be moved from C: drive?

    Should the paging file be moved from C: drive to another drive? This was the question I received today and thought I’d share my response to this. There is no general answer for all situations, so this question needs more information about the environment...
  • PAL processing, processors, and threads

    I commonly get questioned on what response should be given to the NumberOfProcessors question variable in the PAL tool, so I thought I might try to explain it a bit… PAL is designed to be a stand-alone tool where the analysis of a performance counter...
  • PAL collector script – PalCollector.ps1

    One of the top questions I get with the PAL tool is what data to collect. As many of you know, the PAL tool only analyze existing counter logs. It is up to you to create the counter log. To help with this problem, I created a PowerShell script called...
  • How to create a threshold file for the PAL tool

    The Performance Analysis of Logs (PAL) tool is an open source project at http://pal.codeplex.com that analyzes performance counter logs. It has thresholds for performance counters written by experts in their respective areas spanning nearly all of the...
  • Page Frame Number (PFN) database

    I just finished writing an article on the public, wiki, PFE PerfGuide on the subject of the Page Frame Number database in Microsoft Windows and Windows Server. This little known database is used by the operating system to keep track of the physical memory...
  • Memory combining in Windows 8 and Windows Server 2012

    I’ve spent that last few weeks studying the memory architecture of Windows 8 and Windows Server 2012. Windows and Windows Server has always had sharable memory where portions of DLLs and EXEs will have a single copy in physical memory (synonymous with...
  • Can a process be limited on how much physical memory it uses?

    I've been asked a lot of great questions lately and thought I'd post some of them. As you might know, I am one of the instructors of the popular workshop "Vital Signs" which teaches students Windows architecture and how to identify performance bottlenecks...
  • My IIS7 PowerShell Scripts

    I regularly go onsite with enterprise customers of Microsoft and do Microsoft Internet Information Services (IIS) health checks. Recently, I have been rewriting many of my VBScripts into PowerShell scripts to help make the health check easier. I will...
  • How to Speak SAN-ish

    I recently signed a contract with MCP Magazine to publish articles. This is effectively a syndication of this blog. Check out my first article called, “How to Speak SAN-ish” at http://mcpmag.com/articles/2011/05/12/how-to-speak-san-ish.aspx
  • The Microsoft TechNet Wiki Performance Guide (PerfGuide)

    One of the major reasons why I haven’t been blogging much is because I have spent most of my “free” time working on the Microsoft TechNet Wiki writing what I call the “PerfGuide”. We have a lot of great content up there for Windows performance analysis...
  • The PAL Tool on Memory Leaks

    To prevent a process from crashing due to a System.OutOfMemory condition, the .NET garbage collector (GC) automatically defragments virtual memory. It can only do this for Gen 0 and Gen 1 memory allocations. Any allocations at 64 KB or larger will go...
  • Choose Your Own Adventure: High Deferred Procedure Calls (DPCs) or High Interrupts

    You have arrived here because you have identified a high amount (greater than 50%) of processor time (\Processor(*)\% Processor Time), a high amount (greater than 30%) of privileged time (kernel time) (\Processor(*)\% Privileged Time) and a high amount...
  • My Incredible Week at TechEd 2010

    I attended TechEd 2010 this week and it was great! I met a lot of great people and had a great time. TechEd was *huge* this year. They originally expected about 6,000 attendees, but about 8,000 actually attended. To say the least it was very crowded and...
  • PAL v2.0’s New Counter Generation Feature is Powerful

    So, I’ve been playing with generating counters within PAL to compare ratios of SQL Server Full Scans to Index Searches performance counters. This is an effort to get PAL v2.0 updated and more accurate than PAL v1.x. It works out quite nicely! I feel like...
  • Choose Your Own Adventure: User Mode Versus Privileged Mode Processor Usage

    You have arrived at this point in the adventure because you have identified high processor usage on your Windows computer. If this is not correct, then return to the Start of the Adventure . Threads (the worker bees of a process) can execute in one of...
  • Choose Your Own Adventure: Start Here

    You have arrived here because you suspect a performance problem with your Microsoft Windows computer or server. As a kid, I loved the “Choose your own adventure” books where each choice changed the outcome of the story. Today, I lead a life where my choices...
  • W3C IIS Log Analysis using Log Parser

    I was recently on the PowerScripting Podcast where we talked about the PAL tool and the challenges with developing it in PowerShell v2.0 such as dealing with very large PowerShell scripts. While on the podcast some of listeners asked about analyzing IIS...