Where Did My Disk I/O Go?

Hello, Mr. Ninja back again.  I recently discovered that although my team often tracks I/O from the file system through to the disk controller, we have never publicly documented the steps required to do this.  This seems like a great opportunity for a blog because most of the structures are known, and they are even…

4

Determining The Interrupt Line For A Particular PCI-E Slot

Hi debuggers, this is Graham McIntyre again. These days I’m working more closely with hardware so I thought I’d share some hardware related debugging tips.  I recently debugged an issue where a PCI-E storage device failed to work after hot swapping it from one slot to another slot on the system without rebooting.  We determined…

5

Interpreting a WHEA error for a MCA fault

Howdy fellow debuggers! This is Graham McIntyre, I am an Escalation Engineer in Platforms Global Escalation Services.  We get questions from time to time from customers who experience a WHEA bugcheck 0x124, or system event, for help in interpreting the error record. The information applies to Windows Server 2008 / Vista SP1 and Windows 2008…

3

Debug Sleuth at Work: Hung Server…..Mystery of the unprocessed SMB work item.

Hello folks, Pushkar here. I recently worked on a case where the server was hung at “Applying User Settings” during the logon phase. You might ask what’s going to be new in this post, NTDebugging has bunch of posts covering such debug scenarios J. In my defense, this case was particularly interesting because it defied…

5

Microsoft Windows Dynamic Cache Service

Excessive cached read I/O is a growing problem.  For over one year we have been working on this problem with several companies.  You can read more about it in the original blog post: http://blogs.msdn.com/ntdebugging/archive/2007/11/27/too-much-cache.aspx On 32 bit systems, the kernel could address at most 2GB of virtual memory.  This address range is shared and divided…

15

Understanding NTFS Compression

As our group’s file systems expert, I see most of the common problems associated with the use/misuse of NTFS compression.  Before you check the “Compress contents to save disk space” checkbox, it might be good to understand how this affects the happy little bits, bytes, & nibbles running around on the disk. Often backup applications…

5

Work Queues and Dispatcher Headers

  Introduction Hi everyone, Bob here again with a description of Work Queues and Dispatcher Headers.  For those of you that look at dumps, you may have noticed that there are always threads waiting at KeRemoveQueue.  You may have wondered what this function does.  Well, I’m glad you asked… J     What are those…

1

The default interactive desktop heap size has been increased on 32-bit Vista SP1

  This is going to be a short blog post, but considering the amount of feedback we’ve received on the our two previous desktop heap posts, I think this is worth blogging about.  32-bit Vista SP1 and 32-bit Windows Server 2008 both have a new value for the default size of interactive desktop heaps.  Previously,…

5

How to Find the Owner of a Named Pipe

This is a follow-up on the LPC hang blog. The same hang troubleshooting techniques apply to this, but when a named pipe is involved you’ll have to use a slightly different method to following the chain from a client application to the server application. For the purpose of this exercise I’ll use the named pipe…

1

Too Much Cache?

Cache is used to reduce the performance impact when accessing data that resides on slower storage media.  Without it your PC would crawl along and become nearly unusable.  If data or code pages for a file reside on the hard disk, it can take the system 10 milliseconds to access the page.  If that same…

31