Blog du Tristank : Troubleshooting

Old MPSReports

tristank — Tue, 12 May 2009 05:14:21 GMT

There’s a new MPS Reports version in town, with new features : new 64-bit friendliness, various forms of wizard-driven hotness for all the products the individual old tools used to support, etc, etc.

Call me old school if you want, but I typically prefer the convenience of “run this and send me the CAB file”, rather than “grab this, install the prerequisites, and choose the following options in the wizard, then send me the CAB file”. For newer OSs, that’s a non-issue as the pre-reqs (.Net 2.0 and Powershell) are built in; for older OSes, not so much.

A colleague sent me a set of direct download links to the old set, so I’m going to publish them here.

MPSRPT_Alliance.exe	MPSRPT_Alliance_Readme.txt
MPSRPT_Cluster.exe	MPSRPT_Cluster_Readme.txt
MPSRPT_DirSvc.exe	MPSRPT_DirSvc_Readme.txt
MPSRPT_Network.exe	MPSRPT_Network_Readme.txt
MPSRPT_SETUPPerf.exe	MPSRPT_SetupPerf_Readme.txt
MPSRPT_SUS.exe	MPSRPT_SUS_Readme.txt

For whatever reason, the download pages to these editions were removed when the new version was published; personally, I’d have suggested that the new was added alongside the old – the old, for all their limitations, are well-understood and widely used.

But the files are still there, at least for the time being.

Update: Looks like the PFE edition is still available in a not-through-the-back-door way (thanks, PFE, you rock! Hey, *I* work for that organization! Yay!), and it’s the core old-school goodness you’ve come to know and love from MPS Reporting.

http://www.microsoft.com/downloads/details.aspx?familyid=00AD0EAC-720F-4441-9EF6-EA9F657B5C2F&displaylang=en

On the ISA Server Security Update

tristank — Wed, 15 Apr 2009 03:57:59 GMT

Rambling my way to a point

One of my most favourite “Favorites” (read: “he snarled”) in recent weeks has been the ISA Server Product Team’s Build Numbers post.

They helpfully list the version numbers of each ISA Server, um, version, along with a link to the most recent hotfix for that version. That’s so helpful.

But: In most cases, you had to use the self-service hotfix feature to get that hotfix. Which is better than calling someone, but still not quite one-click conweenyence.

And there was some useful stuff fixed in each – you can do the research (hint: research is typically along the lines of “isa server hotfix site:support.microsoft.com” in whatever search engine you use).

Back to the security update: if you look at the file list for the security updates, they look a lot like the file lists for the recent hotfixes.

(Aside from a little while ago: nice that we’re again using KB articles for file information and not just “you should read the bulletin” placeholders. Makes it easier to reliably find file version information in the one place. No idea who changed it in the first place, but my blunt message to you: that was suboptimal.)

I know you love short versions, Glenda

So, long story short, by applying the security update, you’re getting the most recent build of those binaries for your ISA Server.

Just one caveat: remember that with this patch, you’ll need to reapply it if you make any significant installation-level changes to ISA later (see the bulletin for that).

Antivirus software on ISA Server

tristank — Thu, 09 Apr 2009 02:44:00 GMT

There are two major classes of Anti Virus software (yes, I know I used one word above, it’s called SEO, okay?) that can be used on an ISA Server computer:

ISA-integrated antivirus scanning products
Regular desktop/server antivirus products

The first category is the cooler of the two, and typically involves a Web Filter and/or an Application Filter. It’s been designed to work with ISA Server, and will likely scan HTTP streams while ISA is processing them.

The second category is more common – a desktop or server antivirus product is installed on the ISA Server. That’s probably a good idea from a Defense In Depth perspective.

But if you’re using the second category (or it’s just part of your server build), did you know that there are a set of exclusions we recommend you should use?

The ISA Server product team did some great work in pulling together a set of recommendations for when Antivirus is used on ISA Server. Have a read, have a think, and then check whether yours is implemented correctly. If it isn’t, outages, poor performance and other issues might arise.

And (sorta getting into the ramble here) have you ever noticed that Support people tend to make uncomfortable noises about Antivirus products when you mention they’re installed (if not outright suggesting that you disable and/or uninstall them straight-off)? Well, that’s because when they’re not configured in a way that doesn’t interfere with the operation of other software, they really have, statistically, experientially, and commonly, been known to cause problems.

It’s almost a cliche to be asked to remove AV software while troubleshooting a problem – but the cliche came from somewhere to begin with. Configuring the AV as recommended is an excellent way of minimizing that risk.

.HDMP and .MDMP files

tristank — Tue, 23 Sep 2008 11:12:27 GMT

Just a quickie – the rule is blog what you know, but I figure my speculation might be good enough here.

A friend gave me an HDMP file and asked what I could make of it. After the usual “I could make a hat! Or a brooch! Or a dinosaur!” type stuff, I realized it wouldn’t open anyway.

In my experience, most .HDMPs come with matching .MDMP files. I think of these as Minidumps (in the “real” mini sense – just information about threads and thread stacks), and Heap dumps (everything else the process knew or cared about in User mode).

This HDMP wasn’t openable in the debugger directly, but if its corresponding MDMP was present in the same folder at the same time, I reckon it woulda.

The feared WER-wolf produces these files in pairs (that’s Windows Error Reporting, kids, don’t be too scared, except that it invalidates everything we used to know about AEDebug registry keys and similar, but that’s another story for another time), and that’s how I’ve analyzed them in the past. I remember hearing of some sort of merge operation that needed to happen between M and H dumps, but I’m reasonably certain I haven’t bothered with that (I assume I’m lazy by default), so I think the debugger just does it for ya.

Now I’ve written that, I’m going to go look for references to support my assertions!

949180 How to create a user-mode process dump file in Windows Server 2008
http://support.microsoft.com/default.aspx?scid=kb;EN-US;949180

(At the bottom – mini and heap dumps - yay me!). Think that’s enough for today. Hugs!

What does it mean when there's no "broken page" icon in IE8?

tristank — Wed, 10 Sep 2008 10:59:09 GMT

I was just catching up on some of my RSS feeds, and noticed that one of the pages I was at didn't have a broken page icon, but wasn't working quite right (some broken javascript in the photos area, I'm guessing... I'll investigate that next).

I wondered what that meant, so fired up Fiddler2 to have a look.

The Headers collection didn't include the compatibility header (X-UA-Compatible: IE=EmulateIE7 or similar):

HTTP/1.1 200 OK
Proxy-Connection: Keep-Alive
Connection: Keep-Alive
Content-Length: 77144
Via: 1.1 MYPROXY
Date: Wed, 10 Sep 2008 07:42:24 GMT
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-AspNet-Version: 2.0.50727
Cache-Control: private

But the META tag was present (link):

<!doctype html public "-//w3c//dtd xhtml 1.0 transitional//en"
"http://www.w3.org/tr/xhtml1/dtd/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><meta http-equiv="X-UA-Compatible" content="IE=7" /><title>
Spied: New Mazda3

So: the page is being told to render in IE7 Standards Mode (forced, as opposed to IE=EmulateIE7, which would behave as IE7 did). This makes the toggle compatibility mode button moot, because the site has chosen their mode explicitly.

Wonder if that's the problem... Time to investigate with the developer toolbar, I think...

(Update: nup, document mode didn't fix it - Script Debugging needed to be un-disabled in IE, and then the debugger showed me it was happening in motiongallery.js. I've lost interest now :) )

That Memory Leak Revisited

tristank — Wed, 25 Jun 2008 08:59:22 GMT

While searching for memory leaking troubleshooting techniques that could be applied to 64-bit Windows (for the DHCP Server memory leak I found I had the other day), I stumbled across the answer to my problem in an internal tool (weird that I missed it from a web search the first time, but c'est la vie).

A Windows Server 2008-based DHCP server that is configured in a workgroup environment may consume too much memory

http://support.microsoft.com/default.aspx/kb/949530

And that's my problem! One REG command (and one restart of the DHCPServer service) later, I'm waiting to see how it went, but it all looks promising, based on that article. Neat-o.

Generic Troubleshooting: "Is it still a problem?"

tristank — Mon, 28 Apr 2008 09:38:05 GMT

I've been doing this support thing for a while now.

Frequently, the basics are what get overlooked when troubleshooting an issue, particularly an issue that seems complex on the surface.

Often, though, you'll find that the detailed techniques lead you back to a fairly basic set of rules, the most basic of which is:

Everything's either a file issue, or a settings issue, or just how the software works (by bug or by design).

If something seems unlikely to be a file (corrupted or incorrect file) or settings issue, it could easily be a bug (that is, given the same conditions, you'll be able to reach the same outcome). But if you think you might have hit a bug, what's the most efficient way of addressing it?

Obviously, to find someone else has addressed it already!

So, the Temporal rule of Troubleshooting: try it with the most recent version available.

(this doesn't necessarily mean "try Word 2007 if 2003 doesn't work", I mean "within the same major version").

Today, for example, I was looking at a memory dump (which you usually tend to do at the pointy end of a troubleshooting process, and I'm not going to show working or why these two are relevant), and found these *cough* classics:

0:000> lmvmurlmon
    Loaded symbol image file: urlmon.dll
    Image path: C:\WINNT\system32\urlmon.dll
    Image name: urlmon.dll
    Timestamp:        Wed Aug 04 17:56:37 2004 (411096B5)
    File version:     6.0.2900.2180
    Product version: 6.0.2900.2180
...
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     UrlMon.dll
    OriginalFilename: UrlMon.dll
    ProductVersion:   6.00.2900.2180
    FileVersion:      6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
    FileDescription: OLE32 Extensions for Win32
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

0:000> lmvmmsxml3
start    end        module name
    Loaded symbol image file: msxml3.dll
    Image path: C:\WINNT\system32\msxml3.dll
    Image name: msxml3.dll
    Timestamp:        Wed Aug 04 17:59:24 2004 (4110975C)
    CheckSum:         00138815
    ImageSize:        00130000
    File version:     8.50.2162.0
    Product version: 8.50.2162.0
...
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft(R) MSXML 3.0 SP 5
    InternalName:     MSXML3.dll
    OriginalFilename: MSXML3.dll
    ProductVersion:   8.50.2162.0
    FileVersion:      8.50.2162.0
    FileDescription: MSXML 3.0 SP 5
    LegalCopyright:   Copyright (C) Microsoft Corporation. 1981-2003

What does that tell me? Well, lots! Like: this particular machine isn't up to date on IE and XML security patches. Internet Explorer security patches are cumulative, so installing one tends to refresh the majority of the browser software (side bonus: this can also resolve file-level issues, like a corrupted or incorrect DLL).

From that, you can infer that it's probably not up to date on a bunch of stuff. We make it pretty easy to apply security updates these days, and if the security patches aren't up to date, chances are there are non-security patches missing too, and so on.

So: My standard response to any binary implicated in a reproducible problem is to look for and then apply the latest version available (from memory, urlmon was updated this month, and msxml3 sometime since mid-2007).

Once we've applied the latest updates, we'll know whether we actually have more work to do, or whether we're just covering old ground.

So, short version: Try the latest version first.

See the big potential time saving there?