Processes consuming 100% of a system's CPU time is such a situation everybody has faced at least once (likely much more than once :)), and normally as solution we just "kill the murderer" by stopping the culprit process. But what was really causing that...

This weekend I had the opportunity to work along our security specialists (from PSSSec group) in what we can call the hottest situation involving hundreds of production servers either stopped or severely impacted by a new variation of a worm. As a new...

I've been following the discussions about these options for a long time. When it seems that everybody agrees on something, somebody else comes with a different understanding and the discussion starts all over again... The questions at the beginning of...

Recently we’ve been receiving (by coincidence) some escalations to troubleshoot the same issue. It’s about .Net apps returning the following exception: SocketException::.ctor() 10061:No connection could be made because the target...

This week I'm working on this case related to IIS6 server hosting an Asp.Net application (it's a C# app) whose the performance is poor even when a very low number of users is hitting it. The architecture is the classical web layer accessing the backend...

The System Monitor (Perfmon.exe) reports the data gathered through some of its objects and counters with no formatting and depending on what kind of counters are you looking at, or how tired you are, sometimes this can be confusing and even cause misinterpretation...

Yet another kernel memory dump to be analyzed - The bugcheck this time is the 0xA - IRQL_NOT_LESS_OR_EQUAL. To better understand what this message means we would need a little background on Windows Internals but basically when executing anything at a...

In the post about troubleshooting Asp.Net poor performance I showed you how to identify one possible cause for high response times when processing Asp.Net pages – the cause we explored on that post was a database server taking too long to respond. We...

This is another 100% CPU issue. This time I’m not working on any customer case as the issue is happening on my own Windows XP SP2 machine. So I resolved trying to troubleshoot that just for fun J . First, let me explain the scenario: Random interactive...

This is lab for simulating a real 100% CPU condition being caused by a generic Win32 application when there are no symbols available for such application. Let’s start supposing the situation is currently occurring. So, the first step is to confirm...

Normally the answer for this would be as simple as use the file image execution options (through direct editing the registry or using gflags.exe from Debugging Tools For Windows ) and set the “debugger” option to you preferred debugger tool and this would...

It’s been a long time since my last post, but for some reason lately I’ve been receiving so many nice feedbacks about the blog and the other posts that I feel really motivated again to post a new article. See how important your feedback is for me? J ...

Here is little tip for you that want to practice kernel mode debugging but either don’t have 2 machine machines to play the TARGET and HOST roles or simply don’t want to play with (for any reason) with the old null modem serial cable used to connect the...

I was teaching a workshop in London last week and one of the students brought a very interesting issue he had been working on for some time and based on the dump analysis he was not able to point to anything different from our own code (Microsoft’s modules...

This is a question we hear very often from our customers, in forums or through distribution lists. The reason we keep hearing the same question over the time is very simple: There isn’t a definitive answer for that – At least not for IIS since it’s not...

I’ve just published a post on how to manually identify which classic ASP page is being processed by a specific thread. Following the same idea you can also identify COM calls being made by a thread. As always, first identify the thread doing the COM call...

I’ve been teaching one of our workshops offerings (Workshop Plus: IIS6 Critical Problem Management) and when we go through some debugging samples, one thing I like to demo is how to find which Asp.Net pages are being processed in which threads. Well,...

In previous posts we talked about virtual address space and how virtual memory is managed. I've never posted anything about virtual address translation though, and for the ones interested on the details behing this operation I recommend reading the chapter...

I'm posting this as I couldn't find this solution documented anywhere (including within MSFT through the discussions around logparser). Problem: After I installed the Office 2007, my logparser queries which use the parameter "ChartType" no longer...

Even though this has been a strictly technical channel (I've never posted about anything else other than technical stuff) I know a lot of friends read it and so I decided to open an exception on this post and use it to publish something about me that...