How to use Sysinternals tools to troubleshoot SharePoint/Office

Chad SchultzChad.a@microsoft.comPremier Field Engineer, Microsoft

Started in 1996 Microsoft acquired Sysinternals in July, 2006 Mark Russinovich working at Microsoft as Technical

Fellow on Windows Azure Sysinternals Forum

http://forum.sysinternals.com/

Sysinternals History

Sysinternals on the “Net” http://technet.microsoft.com/en-us/sysinternals/default.aspx

Download the tools http://live.sysinternals.com/tools

Drag and Drop newest tools NET USE S: http://live.sysinternals.com/tools

Sysinternals Tools Info/Download

Not loaded on Windows operating systems by default Work in Windows 2000 SP4 and up No installer/uninstall for these tools Always right-click and ‘Run as administrator’ on Vista & up The first time the programs are run, the EULA will display,

after accepting the EULA the first time, this screen should not reappear

Tool command line switches ToolName /? ToolName /AcceptEULA

Sysinternals Tools Continued…

Process Explorer Process Monitor AccessEnum VMMap

Sysinternals Tools

Task Manager on steroids! Monitors running process in real time No historical data Graph data per machine and process Show parent/child processes Can view process DLLs, threads and handles Change default columns

Process Explorer

Lists environment and privileges for each process Shows DEP, ASLR, 32/64 bit and virtualized processes Memory dumps Process Highlighting Load Dbghelp.dll from Debugging Tools for Windows

Windows SDK Configure symbols for thread stack information

SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols

Find window Real-time performance indicators per process

More Process Explorer

Screenshot of Excel 2010 64-bit without ad-ins or macros

Excel is only running native code. No .NET.

Excel is running .Net code; Excel Automation, add-in, etc.

Process Explorer Excel

Use Process Explorer to troubleshoot blank page error

Lab 1

Collects system event data while running Monitors File, Registry, network and process activity Runs on Windows 2000 SP4, XP SP2, Vista, 2003, 2008

and Windows 7 32 bit and 64 bit Does not capture historical performance data Can save events for later research 3 formats; PML, CSV

and XML Backed by page file; 199 million events max Performance impact minimal

Process Monitor

Filters; Menu & right-click Tools->Count Occurrences

More Process Monitor

Error results aren’t necessarily bad: ACCESS DENIED

Often the source of problems DELETE PENDING

The file or folder is trying to delete, but an open handle may be stopping the delete NOT FOUND, PATH NOT FOUND, NAME NOT FOUND

Common in DLL PATH searches, queries for optional functionality or settings BUFFER OVERFLOW, BUFFER TO SMALL

Application is asking how much data there is FAST IO DISALLOWED

Internal indicator that optimized I/O path is not available END OF FILE

Application tried to access beyond the end of a file, normal operation REPARSE

Symbolic link traversal For more information on these error codes see; http://msdn.microsoft.com/en-us/library/ms681381.aspx

Process Monitor Results Primer

Use Process Monitor to Troubleshoot “Server Error in ‘/’ Application

Lab 2

Check permissions of a folder structure Good to run after finding “Access Denied” events in

Process Monitor Common problem areas

ASP.Net temporary file location c:\windows\Microsoft.net\Framework(64)\v2.0.50727\Temorary ASPNET Files

%temp% file location

AccessEnum

View Name Not Found event while loading Excel with .Net code

Process Monitor Excel

Demo

Graphical representation of virtual memory allocations for a process

Live output Task Manager and Process Explorer is just one side of

checking memory in use

VMMap

How much total memory does Excel use?

Lab 3

Windows SharePoint Services Timer (OWSTIMER.EXE) Internet Information Server application pools

(w3wp.exe) Office SharePoint Server Search parent process

(mssearch.exe) SharePoint Search crawl process (msdmn.exe)

SharePoint Processes to Monitor

Badly performing application pools Security event login failures to local resources Timer job errors Crawling local file system content sources Installation errors

SharePoint Issues to Monitor

Crawling SharePoint Sites or external sources SQL login failures SQL connection issues Performance issues where detailed historical

performance information is needed

SharePoint Issues not to Monitor

Most up to date tools:http://live.sysinternals.com

Sysinternals blog:http://blogs.technet.com/sysinternals

Sysinternals blog:http://forum.sysinternals.com/

Chad’s Blog:http://blogs.technet.com/Chad

Mark’s Blog:http://blogs.technet.com/markrussinovich

Links/Questions?