Posted by William Diaz on August 4, 2011
We recently started seeing a rash of performance issues and various program setup failures on different models of workstations. The problem can be identified as multiple instances of msiexec.exe running along side ccmsetup.exe:
The performance issues I have seen were disk related, while others noted program installation failures. This seems to specific to McAfee HIPS, ccmsetup.exe, permissions and a setting in the BIOS for C-State. C-State throttles the cores on multicore processors based on demand. To workaround, we have been disabling the C-State option under the Performance area in the BIOS.
I believe his TechNet Blog addresses the issue officially: http://blogs.technet.com/b/configurationmgr/archive/2011/10/31/information-regarding-mcafee-access-protection-rule-and-configmgr-2007-ccmexec-exe-behavior.aspx
Posted in Uncategorized | Tagged: Performance | Leave a Comment »
Posted by William Diaz on August 3, 2011
The nature of this problem made it difficult or impossible for the help desk to identify because there was nothing to look at that that would tell the technician what was happening when these calls started coming in. They started as a complaint of general system slowness at random times through out the day and were often being assigned to be looked at overnight, which resulted in zero findings because no one knew what they were looking for and could not experience the issue remotely. And if they did, in fact run across the issue while logged on, they could not do anything anyway because the issue of the stalled workstation appeared as a remote connectivity problem and not necessarily a local hardware issue with the workstation.
As I started to here about these issues, I became interested and kept an ear out for a user or two who was encountering the random hang. Identifying a workstation with the problem actually became rather simple because during the hang, a very specific series of events would kick off after the system resumed from the hung state. Isolating the cause, though, was a lot more involved. That’s because the nature of these issues is often software based, e.g. a system or application process was kicking off, or some low level driver was locking up the system. To assist me in that task of finding the culprit, I used a few tools, starting with the Windows XP Event Viewer, then moving to Process Monitor to collect process trace logs, WinDbg to examine manual crash dumps of the hanging system, Performance Monitor, and finally installing Windows 7 after all else failed to take advantage of its enhanced Event Tracing.
Some background. The workstation hangs for the most part coincided with the then recent deployment of new Dell Optiplex 960 and 980 workstations. The hangs were not “hard hangs”, a type of hang where the system becomes completely unresponsive and needs to be manually rebooted. The hangs being seen could be characterized as “soft” in that the workstation would eventually recover after a certain amount of time, usually between 2-5 minutes. During the hang, the mouse was still active but switching between applications was not possible and all keystrokes or commands became queued during the hang. Once the system recovered, any pending operations were executed immediately afterwards. There was no rhyme or reason to the hangs, they were entirely random and would happen several times a day while any user was logged on.
I connected to the workstations after hours and examined the event logs for anything out of the ordinary. Normally, I am looking for error’s or warnings, and I was specifically focused on the System logs, hoping to see disk warnings indicating there were bad blocks on the hard drive. Not seeing anything there, I turned to the application logs but didn’t see anything that stood out there either. Looking at the other workstation, too, did not reveal anything telling.
With nothing to go on, I turned to the generic Information events and noticed that after each reported instance of hang there were a slew of McLogEvent 257 events:
Read the rest of this entry »
Posted in Troubleshooting | Tagged: Hang, Performance, Process Monitor | Leave a Comment »
Posted by William Diaz on August 1, 2011
In an earlier blog, I covered memory metrics in the Windows XP Performance tab. Here, I’ll be covering this in Windows 7. Read the rest of this entry »
Posted in Inside Windows | Tagged: Performance | Leave a Comment »
Posted by William Diaz on July 1, 2011
Sometimes you want to make sense of memory usage to gauge its impact on system performance or to just get a better understanding how memory is being allocated. For that, we can turn to the Performance tab in the Windows Task Manager. Here is a quick rundown of the memory metrics the Windows XP Task Manager. Read the rest of this entry »
Posted in Inside Windows | Tagged: Performance | 1 Comment »
Posted by William Diaz on August 5, 2010
Upon trying to move an email into our document management system in Outlook, the user reported the following error: “The item could not be deleted, it was either moved or already deleted, or access was denied.” This was odd, because normally this error is seen when items are deleted from shared mailboxes, as this this Microsoft KB article explains. The folder she was trying to move it into was her own document store, which she had full access. Upon trying to move other items, the error was not encountered.
I asked the user to send me the message and at first glance there was nothing special about the email. It was composed of a few short paragraphs with no special formatting beside some text bolding. The user composed these messages on a weekly basis, sent them to herself and then would re-file them into the DMS.
I asked the user to open the message on her system, noticed it was very slow to open, and eventually caused Outlook to become unresponsive. After restarting Outlook and looking at the message in the message pane of the user I noticed it was 1MB in size. This was odd because there was no attachment.
Read the rest of this entry »
Posted in Office, Troubleshooting | Tagged: Hang, Outlook, Performance | 1 Comment »
Posted by William Diaz on July 18, 2010
I have run into this a couple times on different workstation and thought I would share with you how the culprit was identified and resolved. The problem manifested itself as the “My Computer” the window getting hung after opening. The delay would range anywhere from 30 seconds to a couple minutes. The same would also happen for “Printers and Faxes” and “Scanners and Cameras”.
I started by connecting to the workstation Event Viewer remotely and saw a few instances of a WIA error: “The Windows Image Acquisition (WIA) service terminated unexpectedly…” I checked WIA service and saw it was stopped. Since the service does not necessarily need to be running if the devices are not in use, it didn’t really raise any eyebrows. However, an attempt was made to start the service, but it failed. Some quick research pointed to the possibility that the Windows Image Acquisition service was failing due to a driver issue with a connected image device. I eventually came across this Microsoft KB article: Enable Logging of Wiadebug.log in Windows XP.
The information describes a method to enable WIA trace logging. The article points out that this can be used by developers for troubleshooting drivers during development, but I figured why not use it to troubleshoot the WIA service itself. Read the rest of this entry »
Posted in Troubleshooting | Tagged: Hang, Performance | Leave a Comment »