How to use Sysinternals tools to
troubleshoot SharePoint/Office
Chad Schultz
Chad.a@microsoft.com
Premier Field Engineer, Microsoft
Sysinternals History
 Started in 1996
 Microsoft acquired Sysinternals in July, 2006
 Mark Russinovich working at Microsoft as Technical
Fellow on Windows Azure
 Sysinternals Forum
 http://forum.sysinternals.com/
Sysinternals Tools Info/Download
 Sysinternals on the “Net”
 http://technet.microsoft.com/en-us/sysinternals/default.aspx
 Download the tools
 http://live.sysinternals.com/tools
 Drag and Drop newest tools
 NET USE S: http://live.sysinternals.com/tools
Sysinternals Tools Continued…





Not loaded on Windows operating systems by default
Work in Windows 2000 SP4 and up
No installer/uninstall for these tools
Always right-click and ‘Run as administrator’ on Vista & up
The first time the programs are run, the EULA will display,
after accepting the EULA the first time, this screen should
not reappear
 Tool command line switches
 ToolName /?
 ToolName /AcceptEULA
Sysinternals Tools




Process Explorer
Process Monitor
AccessEnum
VMMap
Process Explorer







Task Manager on steroids!
Monitors running process in real time
No historical data
Graph data per machine and process
Show parent/child processes
Can view process DLLs, threads and handles
Change default columns
More Process Explorer





Lists environment and privileges for each process
Shows DEP, ASLR, 32/64 bit and virtualized processes
Memory dumps
Process Highlighting
Load Dbghelp.dll from Debugging Tools for Windows
 Windows SDK
 Configure symbols for thread stack information
 SRV*c:\websymbols*http://msdl.microsoft.com/download/sym
bols
 Find window
 Real-time performance indicators per process
Process Explorer Excel
Screenshot of Excel 2010 64-bit without ad-ins or macros
Excel is only running native code. No .NET.
Excel is running .Net code; Excel Automation, add-in, etc.
Lab 1
 Use Process Explorer to troubleshoot blank page error
Process Monitor
 Collects system event data while running
 Monitors File, Registry, network and process activity
 Runs on Windows 2000 SP4, XP SP2, Vista, 2003, 2008
and Windows 7 32 bit and 64 bit
 Does not capture historical performance data
 Can save events for later research 3 formats; PML, CSV
and XML
 Backed by page file; 199 million events max
 Performance impact minimal
More Process Monitor
 Filters; Menu & right-click
 Tools->Count Occurrences
Process Monitor Results Primer


Error results aren’t necessarily bad:
 ACCESS DENIED
Often the source of problems
 DELETE PENDING
The file or folder is trying to delete, but an open handle may be stopping the delete
 NOT FOUND, PATH NOT FOUND, NAME NOT FOUND
Common in DLL PATH searches, queries for optional functionality or settings
 BUFFER OVERFLOW, BUFFER TO SMALL
Application is asking how much data there is
 FAST IO DISALLOWED
Internal indicator that optimized I/O path is not available
 END OF FILE
Application tried to access beyond the end of a file, normal operation
 REPARSE
Symbolic link traversal
For more information on these error codes see; http://msdn.microsoft.com/en-us/library/ms681381.aspx
Lab 2
 Use Process Monitor to Troubleshoot “Server Error in
‘/’ Application
AccessEnum
 Check permissions of a folder structure
 Good to run after finding “Access Denied” events in
Process Monitor
 Common problem areas
 ASP.Net temporary file location
c:\windows\Microsoft.net\Framework(64)\v2.0.50727\Te
morary ASPNET Files
 %temp% file location
Process Monitor Excel
 View Name Not Found event while loading Excel with
.Net code
Demo
VMMap
 Graphical representation of virtual memory allocations
for a process
 Live output
 Task Manager and Process Explorer is just one side of
checking memory in use
Lab 3
 How much total memory does Excel use?
SharePoint Processes to Monitor
 Windows SharePoint Services Timer (OWSTIMER.EXE)
 Internet Information Server application pools
(w3wp.exe)
 Office SharePoint Server Search parent process
(mssearch.exe)
 SharePoint Search crawl process (msdmn.exe)
SharePoint Issues to Monitor





Badly performing application pools
Security event login failures to local resources
Timer job errors
Crawling local file system content sources
Installation errors
SharePoint Issues not to Monitor




Crawling SharePoint Sites or external sources
SQL login failures
SQL connection issues
Performance issues where detailed historical
performance information is needed
Links/Questions?
 Most up to date tools:
http://live.sysinternals.com
 Sysinternals blog:
http://blogs.technet.com/sysinternals
 Sysinternals blog:
http://forum.sysinternals.com/
 Chad’s Blog:
http://blogs.technet.com/Chad
 Mark’s Blog:
http://blogs.technet.com/markrussinovich