The Case of the Slow Project File Opens

re: The Case of the Slow Project File Opens

GBleezy — Wed, 09 Mar 2011 13:46:51 GMT

Hey really cool article! This is really the first insight of any kind that I've ever had in to what in the world all the programs and features based on 'stacks', 'traces', and 'dumps' are actually used for. Love this read though because not only did I get a hint of who uses that stuff, and how they make it useful for them, but...it just makes it all that much better how it reads as a sort of walk-through of a real world scenario. Also the way it's written up worked real well for me, i think i actually read every word; nothing too drawn out, key points quickly summarized, and of course pretty pictures! It felt like maybe it was written for somebody that's already indulged in these tools, but as someone that (although technologically adept) could only imagine how all of these terms being thrown around ('trace','stack','dump') were supposed to be useful to anybody but Bill Gates...It read very well! It feels like I just experienced the workflow behind these mysterious terms that pop up from time to time during a normal user's computing experience...Previously I had imagined data like this only being utilized by devs of the particular software in question, setting BPs in Softice or something...idk, guess I'm a noob, but I'm super curious now to see if I can learn to have this stuff make even more sense to me! Tomorrow perhaps since it's 5:45am right now and I should rest my brain before trying to teach it more stuff lol...anyways, nice article! Thank you for the read :p

re: The Case of the Slow Project File Opens

Adolfo Soto — Wed, 02 Mar 2011 19:01:37 GMT

I have to deal with performance bottlenecks of complex enterprise applications, sometimes I feel lost before I even begin but these posts "Cases of" are very enlightening and show real-world solutions achieved with tools that are freely available.

Please keep them coming!

re: The Case of the Slow Project File Opens

Michael Simmons — Thu, 16 Dec 2010 17:26:50 GMT

Every post makes me a better troubleshooter. Thanks for sharing this info

re: The Case of the Slow Project File Opens

snoone — Mon, 13 Dec 2010 18:57:55 GMT

@Dennis:

The FltReadFile call at frame 17 is what triggers the read being performed. If you didn't know that API, the name of the routines on the stack indicate a read option (e.g. CcCopyRead, IoPageRead, etc). For some reason the RDBSS symbols aren't resolved in that screen grab, which would provide further clues (e.g. rdbss!RxCommonRead).

The ZwCreateFile call at frame 40 just indicates that the reads are being sent from within the context of a create operaion. In other words, while processing the create operation issued by ZwCreateFile the file system filter driver (SRTSP) called FltReadFile to read from the file on disk.

-scott

http://www.analyze-v.com

re: The Case of the Slow Project File Opens

Fabrice — Sun, 12 Dec 2010 09:57:18 GMT

Tx for this sharing, it lets me discover new tracks to some performance or locking bugs in my every day professional life. An other tool I use too is Fiddler to inspect the network traffic.

re: The Case of the Slow Project File Opens

Keith Dickinson — Fri, 10 Dec 2010 20:44:30 GMT

Dennis -- The ZwCreateFile is used for both creating a new file and opening one.

msdn.microsoft.com/.../ff566424%28v=vs.85%29.aspx

Cheers!!

re: The Case of the Slow Project File Opens

AndrewRichards — Fri, 10 Dec 2010 17:56:56 GMT

Terrance Brennan: If you are having severe issues on your Exchange server, I highly suggest that you raise a Microsoft Support ticket to get some help.

Andrew Richards - Exchange Senior Escalation Engineer.

re: The Case of the Slow Project File Opens

Bernhard Ernst — Fri, 10 Dec 2010 12:39:53 GMT

Wonderful example of how to use this great tool. I had the exact same problem on a heavily used web server where log files, images, cache files, etc. caused the same problem.

re: The Case of the Slow Project File Opens

Rich — Thu, 09 Dec 2010 07:36:09 GMT

Always look forward to these dubug guides. Gives us mere mortals a bit of a clue how to fault find more complex issues.

re: The Case of the Slow Project File Opens

Dimiter "malkia" Stanev — Thu, 09 Dec 2010 02:14:18 GMT

Wonderful. Using procmon I've found that Symantec was slowing down copying files from windows share. Where it would copy 1000 files for 3 minutes originally, later that wen to 10 seconds. As the files did not have extensions, there was no way to change Symantec to not check them (the IT guy told me, it's based on extension filtering). We renamed our system to produce the files with extensions (these were cached version of converted data), and later that extension was skipped by the Antivir.

But we would've got nowhere without procmon!