Windows Explored

Everyday Windows Desktop Support, Advanced Troubleshooting & Other OS Tidbits

Posts Tagged ‘Hang’

Is This What a Defective Hard Drive Behaves Like? (The Case Of The Random Workstation Hangs)

Posted by William Diaz on August 3, 2011


The nature of this problem made it difficult or impossible for the help desk to identify because there was nothing to look at that that would tell the technician what was happening when these calls started coming in. They started as a complaint of general system slowness at random times through out the day and were often being assigned to be looked at overnight, which resulted in zero findings because no one knew what they were looking for and could not experience the issue remotely. And if they did, in fact run across the issue while logged on, they could not do anything anyway because the issue of the stalled workstation appeared as a remote connectivity problem and not necessarily a local hardware issue with the workstation.

As I started to here about these issues, I became interested and kept an ear out for a user or two who was encountering the random hang. Identifying a workstation with the problem actually became rather simple because during the hang, a very specific series of events would kick off after the system resumed from the hung state. Isolating the cause, though, was a lot more involved. That’s because the nature of these issues is often software based, e.g. a system or application process was kicking off, or some low level driver was locking up the system. To assist me in that task of finding the culprit, I used a few tools, starting with the Windows XP Event Viewer, then moving to Process Monitor to collect process trace logs, WinDbg to examine manual crash dumps of the hanging system, Performance Monitor, and finally installing Windows 7 after all else failed to take advantage of its enhanced Event Tracing.

Some background. The workstation hangs for the most part coincided with the then recent deployment of new Dell Optiplex 960 and 980 workstations. The hangs were not “hard hangs”, a type of hang where the system becomes completely unresponsive and needs to be manually rebooted. The hangs being seen could be characterized as “soft” in that the workstation would eventually recover after a certain amount of time, usually between 2-5 minutes. During the hang, the mouse was still active but switching between applications was not possible and all keystrokes or commands became queued during the hang. Once the system recovered, any pending operations were executed immediately afterwards. There was no rhyme or reason to the hangs, they were entirely random and would happen several times a day while any user was logged on.

I connected to the workstations after hours and examined the event logs for anything out of the ordinary. Normally, I am looking for error’s or warnings, and I was specifically focused on the System logs, hoping to see disk warnings indicating there were bad blocks on the hard drive. Not seeing anything there, I turned to the application logs but didn’t see anything that stood out there either. Looking at the other workstation, too, did not reveal anything telling.

With nothing to go on, I turned to the generic Information events and noticed that after each reported instance of hang there were a slew of McLogEvent 257 events:

Read the rest of this entry »

Posted in Troubleshooting | Tagged: , , | Leave a Comment »

Troubleshooting and Resolving a Hang in 90 Seconds

Posted by William Diaz on June 3, 2011


I’m a stickler when it comes to performance issues on my workstation. So it bothered me when I noticed a small delay when right clicking on my desktop. By small, I mean literally 2 seconds. I opened SysInternals Process Explorer to quickly see if the CPU was spiking:
image_thumb_1_028E6399
I looked at the all the processes to see which process was the offender but the 45-60% CPU time was the total of several processes. After the menu opened and a few seconds later the CPU% would drop down to a normal 0-1%.

30 Seconds… Read the rest of this entry »

Posted in Troubleshooting | Tagged: , , | Leave a Comment »

Know the Stack (or More Hang Analysis Using Process Explorer)

Posted by William Diaz on April 28, 2011


A few moments after opening Outlook, the user complains of unresponsiveness. We start by running Process Explorer. Process Explorer is “self-contained”, so there is no installation required. You can run it directly from SysInternals Live: http://live.sysinternals.com/. I also have it on our lab so I ran it from there:
Read the rest of this entry »

Posted in Troubleshooting | Tagged: , , | 1 Comment »

The Case of the Print to PDF Hangs

Posted by William Diaz on April 4, 2011


One morning I started hearing a few reports of cases where users were not able to print to the BullZip PDF software printing device. After a wait of 5 minutes, the BullZip printer would return the following error: “An error occurred. Error 1008: Ghostscript timed out – Make PDF

Read the rest of this entry »

Posted in Troubleshooting | Tagged: , , , | Leave a Comment »

The Case of the Email Reply & Forward Hangs

Posted by William Diaz on March 16, 2011


This is another example of where you can use Process Explorer for application hang analysis. In the case here, when replying to a specific email or forwarding it, Outlook 2003 would become unresponsive. To get an idea of what was happening we ran Process Explorer on the user’s workstation and opened the Outlook.exe process properties. From here, we went to the Threads tab, selected the main OUTLOOK .EXE thread and then took a look at the stack: Read the rest of this entry »

Posted in Troubleshooting | Tagged: , | Leave a Comment »

The Case of the Word Open Document Delays

Posted by William Diaz on February 4, 2011


After a certain amount of time troubleshooting Word issues (not document issues) in a large enterprise environment that uses several templates, macros, and other add-ins, one develops a troubleshooting drill. This normally involves isolating a problem to a startup template or add-in. We have a lot of them and they are always increasing. For Office Word 2003, you can find most of these in C:\Program Files\Microsoft Office\OFFICE11\STARTUP:
Read the rest of this entry »

Posted in Office | Tagged: , | Leave a Comment »

The Case of the Outlook Send Email Hangs

Posted by William Diaz on February 3, 2011


Process Explorer can often times give you clues to hung processes. Simply open the hung process and go to the Threads tab. Take this case here where Outlook was hanging and showing significant CPU usage while trying to send an email. I started by identifying the hung thread. In this case, CPU time and CSwitch Delta columns make this obvious. Select the thread and double-click it or click the Stack button to see the state of the stack. The stack reads from bottom to top. Look at the most recent frames for clues to the problem. In this case, mshtml.dll stands out:
Read the rest of this entry »

Posted in Troubleshooting | Tagged: , , | 2 Comments »

54 68 65 20 43 61 73 65 20 6f 66 20 74 68 65 20 4d 79 73 74 65 72 69 6f 75 73 20 53 79 73 74 65 6d 20 44 65 6c 61 79 73

Posted by William Diaz on November 14, 2010


The complaint: Excel would hang while opening. When it finally did come to life, it would keep getting hung doing almost any task. Often, these issues are troubleshot in a predictable manner: Repair Office, Uninstall Office, Reinstall Office, and, finally, take a shotgun to the user’s Windows profile and blow it away. Personally, I frown on these approaches; they only serve to make the user start from scratch while doing nothing in revealing the problem. Another downside to this approach is you may be dealing with something impacting several users/workstations, each being handled independently of an identical issue by the tech in the next cubicle. And, being that the problem was related to the user profile, specifically in HKCU, it is likely each one would have resulted in a Windows Profile recreation. If you have had to recreate a profile, these can be timely since not all setting’s in today’s large enterprise environments are copied into the roaming profile (think folder exemptions, for example). Read the rest of this entry »

Posted in Troubleshooting | Tagged: , , , | Leave a Comment »

The Case of the Sluggish Email Message (Outlook HTML Gone Crazy)

Posted by William Diaz on August 5, 2010


Upon trying to move an email into our document management system in Outlook, the user reported the following error: The item could not be deleted, it was either moved or already deleted, or access was denied.” This was odd, because normally this error is seen when items are deleted from shared mailboxes, as this this Microsoft KB article explains. The folder she was trying to move it into was her own document store, which she had full access. Upon trying to move other items, the error was not encountered.

I asked the user to send me the message and at first glance there was nothing special about the email. It was composed of a few short paragraphs with no special formatting beside some text bolding. The user composed these messages on a weekly basis, sent them to herself and then would re-file them into the DMS.

I asked the user to open the message on her system, noticed it was very slow to open, and eventually caused Outlook to become unresponsive. After restarting Outlook and looking at the message in the message pane of the user I noticed it was 1MB in size. This was odd because there was no attachment.
image Read the rest of this entry »

Posted in Office, Troubleshooting | Tagged: , , | 1 Comment »

Forcing a System Crash on a Unresponsive PC

Posted by William Diaz on July 20, 2010


This one comes in handy when a Windows based PC experiences a so-called “hard hang” and you need to force it to bug check and produce a dump for debug purposes. From the Windows registry:

  • For USB keyboards go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\kbdhid\Parameters, create a DWORD value named CrashOnCtrlScroll equal to 11
  • For PS/2 keyboards go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\i8042prt\Parameters, create a DWORD value named CrashOnCtrlScroll equal to 1

You will need to reboot afterwards. A crash can now be initiated by holding down the right CTRL key and pressing the Scroll Lock key twice. Read the rest of this entry »

Posted in Troubleshooting | Tagged: , , | 1 Comment »