How to track down that leaky app using Performance Monitor!

Did you ever open up winstation administration and have it start to show your servers only for one to get stuck on that %@#! yellow ? question mark? This means that server has got a rogue app running. Wouldn't it be great to find out what was causing that so you could possibly fix it? Well here is the way I tracked down our leaky app for your benefit.

Open up a new performance monitor session on a different server...and click on edit->add to chart. Under the computer line enter in the Computer name or IP of the computer in the form of \\Computername that you want to monitor. On the object line in the drop down menu choose user. Under counter %processor time should be highlighted...leave it highligted. Under the instance field choose all of the users except for Idle and System.

Click on add button and then the done button and your chart will come up. Use your up and down arrow keys to cycle through each user and as you do take a look at the 2nd value under the graph called average.

Do this for a minute or two and find the one that has the highest average. This is your culprit. Do a qprocess * /SERVER:Nameof server where nameofserver is the bad server. Take a look and see what processess are running for that user. From your perfmon chart click on the username and go to edit and remove it from the chart before you go to the next step. If you disconnect a user while monitoring them perfmon tends to lock up.

If you can connect to the server and shadow that user do so....the easiest and quickest way to do this is to go directly to the command prompt because winstation admin will cause too much overhead and type in: shadow username Where username is the workstation you were monitoring. To get out of a dos shadow you use ctrl *

You now should know exactly what the user is doing that is eating up your CPU time.... send them a msg that you are resetting them: msg username "Your system is being reset because your session is causing system problems please save your data now. " Or better yet call them if you can. After a few seconds do a reset on them via the cmd prompt. reset winsta winstationname. If you now open up Winstation Admin your question mark will be gone!

Now you can go back through the users directory and check their ini and program files for that user and reinstall them if necessary.

One application I found to be particurlarly pesky is the plugin Acrobat Reader 3.0. For some reason when it runs it comes up in the backround behind the browser....cant figure out why. Users click on the acrobat file again and again and then have 3 or 4 copies of it running. Haven't quite figured out a way around this yet.

The other thing I have found that is really interesting that causes problems with very high CPU usage are unanswered error message popups like out of paper or the like. They popup...users click elsewhere on the desktop and poof they are forever gone to the backround and sit there unanswered. This is why Dr. Watson causes so many problems also...oftem times he will remain unanswered and the CPU will just max out. The print dialogue box is another beauty....put it up and leave it there for a while. Pull the paper out of an HP printer and click on print and leave the pop up out of paper message on the screen...watch what happens to your CPU time.

UPDATE 7/19/99

Microsoft has finally published a KB article on just this issue! They state it will be fixed in SP5 for TSE. Here is the workaround until it comes out:

• Start Registry Editor (Regedt32.exe).

• Go to the following key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Windows\ErrorMode

  Change the default value of 0 to 2. The following table defines the three possible values for ErrorMode:

  Value	Result
  0	Errors are serialized and wait for a response.
  1	If the error does not come from the system, the system continues in normal operating mode. If the error comes from the system, the error is written to the system log; no user intervention is required and dialog boxes are not displayed.
  2	The error is written to the system log; the dialog box is not displayed.