How to use Sysinternals tools to troubleshoot SharePoint/Office Chad Schultz Chad.a@microsoft.com Premier Field Engineer, Microsoft

Sysinternals History Started in 1996 Microsoft acquired Sysinternals in July, 2006 Mark Russinovich working at Microsoft as Technical Fellow on Windows Azure Sysinternals Forum http://forum.sysinternals.com/

Sysinternals Tools Info/Download Sysinternals on the “Net” http://technet.microsoft.com/en-us/sysinternals/default.aspx Download the tools http://live.sysinternals.com/tools Drag and Drop newest tools NET USE S: http://live.sysinternals.com/tools

Sysinternals Tools Continued… Not loaded on Windows operating systems by default Work in Windows 2000 SP4 and up No installer/uninstall for these tools Always right-click and ‘Run as administrator’ on Vista & up The first time the programs are run, the EULA will display, after accepting the EULA the first time, this screen should not reappear Tool command line switches ToolName /? ToolName /AcceptEULA

Sysinternals Tools Process Explorer Process Monitor AccessEnum VMMap

Process Explorer Task Manager on steroids! Monitors running process in real time No historical data Graph data per machine and process Show parent/child processes Can view process DLLs, threads and handles Change default columns

More Process Explorer Lists environment and privileges for each process Shows DEP, ASLR, 32/64 bit and virtualized processes Memory dumps Process Highlighting Load Dbghelp.dll from Debugging Tools for Windows Windows SDK Configure symbols for thread stack information SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols Find window Real-time performance indicators per process

Process Explorer Excel Screenshot of Excel 2010 64-bit without ad-ins or macros Excel is only running native code. No .NET. Excel is running .Net code; Excel Automation, add-in, etc.

Lab 1 Use Process Explorer to troubleshoot blank page error

Process Monitor Collects system event data while running Monitors File, Registry, network and process activity Runs on Windows 2000 SP4, XP SP2, Vista, 2003, 2008 and Windows 7 32 bit and 64 bit Does not capture historical performance data Can save events for later research 3 formats; PML, CSV and XML Backed by page file; 199 million events max Performance impact minimal

More Process Monitor Filters; Menu & right-click Tools->Count Occurrences

Process Monitor Results Primer Error results aren’t necessarily bad: ACCESS DENIED Often the source of problems DELETE PENDING The file or folder is trying to delete, but an open handle may be stopping the delete NOT FOUND, PATH NOT FOUND, NAME NOT FOUND Common in DLL PATH searches, queries for optional functionality or settings BUFFER OVERFLOW, BUFFER TO SMALL Application is asking how much data there is FAST IO DISALLOWED Internal indicator that optimized I/O path is not available END OF FILE Application tried to access beyond the end of a file, normal operation REPARSE Symbolic link traversal For more information on these error codes see; http://msdn.microsoft.com/en-us/library/ms681381.aspx

Lab 2 Use Process Monitor to Troubleshoot “Server Error in ‘/’ Application

AccessEnum Check permissions of a folder structure Good to run after finding “Access Denied” events in Process Monitor Common problem areas ASP.Net temporary file location c:\windows\Microsoft.net\Framework(64)\v2.0.50727\Temorary ASPNET Files %temp% file location

Process Monitor Excel View Name Not Found event while loading Excel with .Net code Demo

VMMap Graphical representation of virtual memory allocations for a process Live output Task Manager and Process Explorer is just one side of checking memory in use

Lab 3 How much total memory does Excel use?

SharePoint Processes to Monitor Windows SharePoint Services Timer (OWSTIMER.EXE)  Internet Information Server application pools (w3wp.exe) Office SharePoint Server Search parent process (mssearch.exe) SharePoint Search crawl process (msdmn.exe)

SharePoint Issues to Monitor Badly performing application pools Security event login failures to local resources Timer job errors Crawling local file system content sources Installation errors

SharePoint Issues not to Monitor Crawling SharePoint Sites or external sources SQL login failures SQL connection issues Performance issues where detailed historical performance information is needed

Labs Lab 1: Application Pool Process Lab 2: Basic usage and SharePoint Installation Error Lab 3: Application Pool Performance Lab 4: SharePoint Server Error

Links/Questions? Most up to date tools: Sysinternals blog: http://live.sysinternals.com Sysinternals blog: http://blogs.technet.com/sysinternals http://forum.sysinternals.com/ Chad’s Blog: http://blogs.technet.com/Chad Mark’s Blog: http://blogs.technet.com/markrussinovich