2D03 Detecting & Troubleshooting Memoryleaks Decus 2003 Agenda
Contents
1. sap ray bay 9 19 2003 14 5 19 2003 Losung vergr Bern RegelmaBiger Reboot Restart Restart von Services at net stop Wenn Treiberupdate Applikation Hotfix Update 5 Servicepack 64 bit Crashdump Auswertung CrashOnCtrlScroll 0244139 Windows Feature Allows a Memory dmp File to Be Generated KB Artikel Q150934 How to Create a Performance Monitor Log for NT Troubleshooting Q177415 How to Use Poolmon to Troubleshoot Kernel Mode Memory Leaks Q286350 HOWTO Use Autodump to Troubleshoot Hangs and Crashes Q251233 Considerations When Using Driver Verifier on Production Servers Q268343 Umdhtools exe How to Use Umdh exe to Find Memory Leaks Q192486 INFO Introduction to Windows NT Kernel Special Pool Q126402 PagedPoolSize and NonPagedPoolSize Values in Windows NT Q229902 Driver Verifier Always Performs Certain Kernel Mode Driver Tests Q229903 Partial List of Possible Error Codes with Driver Verifier Q244617 Using Driver Verifier to Troubleshoot Drivers in Win 2K and XP Q243318 How to Use Dh exe to Troubleshoot User Mode Memory Leaks Q290620 HOWTO Create an Alert to Automatically Generate a Dump Heap Log 0253706 HOWTO Isolate and Identify the Source Inetinfo or Other Process Memory Leak2. oan Logger Rees Tat a a a ba TEA ice erfordert FE a OB tects E Hea Fool Tag End Tre eure Tools VaDump vadump 1668 vadump Total Private Shareable Shared Pages KBytes KBytes Page Table Pages 18 72 V2 0 Other System 3 12 12 Code StaticData 64 256 48 16 64 64 1 4 4 Teb 1 4 4 Mapped Data 21 84 0 Other Data 6 24 20 Total Modules 64 250 48 Total Dynamic Data 45 180 92 Total System 21 84 84 Grand Total Working 130 520 Module Working Set Contributions pages Total Private Shareable Shared Module 3 2 0 1 NOTEPAD EXE 12 2 0 10 8 1 0 7 92 7 2 0 5 132 1 Tools VaDump Monitor modus vadump W 1576 2 6 23107 RtIFillMemoryUlong 10 2302 RtlSizeHeap 5c9 7 RtlSizeHeap e03 4 DefWindowProcW c6 4 SetBkColor 38 2 memmove db 2 SelectObject 4a 2 RtlAllocateHeap 35 2 CallNextHookEx 7b 1 RtlGetCallersAddress 2d8 1 RtlGetCallersAddress 1
3. a Rs ae 5 Active Connections pe eae th 0 pee erode pee gr ond EP HH FLA F 3 Re Ea 0 pe CEE BEE Letts ee ee be Le 1 FEE FEIT 3 ActivePort netstat owner 10 5 19 2003 Treiber Tools LEE lo 22 8 Paging File Ferree peewwaa RT Usage Usage Peak pear rsa Pool Nonpaged
4. a AGP 192 12230 ra Te 0 2 ane ee Ho we 1 Sat im 44 13 Tools Infos How to Use Poolmon to Troubleshoot Kernel Mode Memory Leaks How to Allow Poolmon exe to Run by Setting GlobalFlag Value Debugging Tools for Windows triage pooltag txt Dib framebuf video driver Dfs Distributed File System jzvxl484 video driver Dick deadlock verifier part of driver verifier structures DPrf Disk performance filter driver diskperf c findstr sys gt drivers ipsec sys Tools Driver Veritier verifier exe ar Berl ee Fucking
5. new 10240 new malloc char pResult GlobalAlloc HeapAlloc CoTaskMemAlloc Copylnfo pBuffer pResult CreateFileMapping return FALSE MEMORY LEAK U V M delete pBuffer Bool return TRUE MEMORY LEAK free pResult 5 19 2003 Wie machen sich Leaks Usermode Performanceverlust Phys Mem und Det of Virtual Tout oo Vitel Ta mare Wide 3 Pile dee evil Popups lt a Kernel Mode Hanger bis wieder Resourcen frei werden aber Free amp Allocs im Wettstreit Eventlog server was unable to allocate the nonpaged pool from the system because the pool was empty Generelle Performance Problem ausschliessen Disk I O CPU Netzwerk Infos uber das System im Normalzustand Threads Pagedpool Nonpaged Pool Pagefile Usage Geduld Geduld Geduld Prozess Ids PagedPool Statistics NonPagedPool Statistics Pagefile Info Pool Tags Socket Port Infos Treiberinfo amp services 9 19 2003 5 19 2003
6. 4 ee en ie 1 oo 5 ET FF eee Ee 1 a 1 ThE rs 5 Hem 1 BE 1 Tools memsnap log Process ID 00000000 00000008 000000 000000 8 000000 0 000000 00000108 00000168 000001 000001 0 0000020 0000021 0000023 00000258 00000288 00000220 00000380 00000380 Proc Name Wrkng Set 11 SE E SMSS CSRSS WINLOGON SERVICES SASS E SWCEMOSIE o defwatch Tools De 0 8 svchost CLV SCE 5 regsvc mstask WinMgmt o SYSTEM Picocess System EXE EXE EXE EXE EXE EXE exe exe exe exe Pagefile 16384 0 0 229376 0 24576 327680 1200 147456 1085440 6560 1413120 2002944 55664 5959080 6205440 336804 2805760 5955584 37144 2756608 3854336 14120 2023424 3817472 24840 1544192 4395008 710412 2813952 1826816 2188 507904 5902336 42656 2281472 2179072 12396 745472 10829824 11668 8425472 7905268 9548 245760 3141632 15724 10280
7. ModuleName Load Addr LinkDate kare oles 804D2000 442368 97216 775488 1 80675000 25952 6048 16544 EC410000 5664 2464 0 ACEI 8000 92096 9024 43520 WMILIB 5 8000 512 0 1152 ELE 000000 12864 1556 31456 5 19 2003 12 5 19 2003 Page _ core POG FOOL Diewe Cache Coat Cin 54852 8085 60076 3058 193 99 640 313 14545 51 402 54344 2085 6079 3058 193 98 640 313 14545 402 52805 8005 5079 3058 195 98 640 313 14545 51 402 Bytes Bytes Logn Witm Revd Sent POOL POOL Pile Siccla Miers 0 0 11549 2444323 1 0 0 0 0 0 0 11549 2444323 il 0 0 0 0 Paged Paged Paged Non Non Non Page Commit Commit 11 Freed Aval Pages Pages Pages Limit Free 21 70 40549 28 28 30090 7154 7805 2338 45997 120725 43064 24 36 40537 22 22 36030 1150 1509 2338 43997 120725 43064 1213 1630 40120 156 142 36044 7348 1929 23549 44008 120725 43064 10 10 40120 34 35 36043 73539 1929 2548 44008 120725 43064 Read Write Other Read Write Other File File I Os i1 0s Xfer Xfer Xfer Objects Handles 2 0 24 24 0 0 0 44 7 6 34 364 0 316 0 360 phen 2027020 Beadl 1 4 2 Infan Rem 1995954 Lindt 78732 5781921 Pood Tag Alles Dari Bytes sme 1
8. Bytes Pool Paged Bytes Process Page File Bytes Pool Bytes LOGS Paged Bytes Private Bytes Thread Count Counter Script send Msg t How to Create a Performance Monitor Log for NT Troubleshooting Q150934 How to Monitor a Remote Computer Without Logging On to It Q246758 11 CEN cheiwers ModuleName LinkDate ME OS ER 442368 775488 139264 1 25952 16544 10272 VID 5664 0 320 92096 43520 4448 WMILIB 512 1152 192 12864 31456 4640 isapnp 14368 22944 2272 compbatt 2496 2880 1216 800 3008 704 672 0 128 PCIIDEX 4544 10944 1532 intelide 1984 0 128 pemcia 32960 23904 5212 4640 95072 2392 Diskperf 1726 2016 1088 dmio 105568 0 2752 PartMgr 576 6656 1576 Tools 2927525 11 197006 1735515 5 164415 19541 3 56 1991565 1358045 979736 Peaks 57019 Pool 115122325 User Time Kernel Time Wacl Nein 90832 2414656 File Cache 200500 5419210 607 16 1 0 1 0 Idle Process 5 0 0 200 00 0 205232726393 212 10006 241 160 42 8 System 8 00 2 00 010 9 010 5 030 821 408 594 1096 11 6 5 172 SMSS 5005241 66 0 99 641 175607 1532 13 464 11 200 CSRSS
9. 37 Tools dh 1 2 Tlist Prozess ID 3 C UMDHTOOLS gt dh 66 SetThreadPriority failed 6 DH Writing dump output to C RtlCreateQueryDebugBuffer RtpQueryProcessDebugInform Processld 664 ProcessFlags 0 010000 Loading symbols for 0x77f8000 0 3700 Loading symbols for 0x77d400 4200 Loading symbols for 0x75e600 0 060500 Getting symbols for Stack Back C UMDHTOOLS gt Start leaking 4 dh 664 f C UMDHTOOL 5 dhcmpgui sort by size 1 ae LJ HH ee Bl 5 amp Sat ee Ek ee i D iris ea 8 73 5 19 2003 5 19 2003 Tools D Program Files Resource Kit leakapp exe 222 1 ened Drop a s on 42 1 Bas
10. 5 19 2003 2003 Detecting amp 5 2003 Juergen Krautner hp com HP Services von Memory leaks User mode Kernel Modes mele ts Services Drivers Demos 5 19 2003 System Mouse Capslock Server Service Events schlechte Responsezeiten ABER ping geht immer kernelmode stack Problem Zu spat Seien Sie vorbereitet Es passiert wieder Leaks sind eine Plage Windows 2000 mehr als 400 Leaks geschlossen Dutzende KB Artikel Server Service RPC service RAS Performance Monitor LMRepl ASP Backup Software Virenscanner etc 5 19 2003 Layered Memory Management Wind2 pli alin ri Local Global Memory Al every Q126402 PagedPoolSize NonPagedPoolSize Values in Windows Wie entstehen Memory Leaks Resource Allocation ohne zugehoriges Release von Heap Virtual memory Handles Semaphore Mutexes e Functions char
11. 96 450560 17316 3158016 1269760 10588 385024 5 t Commit 0 24576 147456 1413120 5959680 2805760 2756608 2023424 1544192 2813952 507904 2281472 745472 8425472 245760 3198016 385024 EEE 5 19 2003 5 55 521008 WINLOGON EXE SERVICES EXE NetDDE Agent Alerter Browser Dhcp dmserver Dnscache Event log lanmanserver lanmanworkstation LmHosts Messenger PlugPlay ProtectedStorage seclogon TrkWks Wmi LSASS EXE termsrv exe PolicyAgent SamSs TermService svchost exe 5 0658 etlisrv exe ELIService svchost exe EventSystem Netman NtmsSvc RasMan SENS rtvscan exe Norton AntiVirus Server explorer exe Program Manager notepad exe decusideas txt Notepad notepad exe WINWORD EXE notepad exe Cluster MME wer taskmgr exe Windows Task Manager inetinfo exe IISADMIN MSFTPSVC SMTPSVC W3SVC 5 19 2003 Tools Gflags exe renga Liner r boot settings ra ere Loca Sree debug Sees Dee ee Cece irk kernel current i r
12. s Q286568 Use Application Verifier to Troubleshoot Programs in Windows XP wek reskit Chapter 6 Evaluating Memory and Cache Usage Investigating memory shortages gt perfmon counters screenshots Investigating user mode memory leaks Investigating kernel mode memory leaks Resolving memory and cache bottlenecks 15 5 19 2003 Tools Windows 2000 Resourcekit http www microsoft com windows2000 techinfo reskit tools default asp W2000 Support Tools 2000 5 2000 Debugging Tools for Windows http www microsoft com ddk debugging installx86beta asp 5 http download microsoft com download win2000srv Utility 3 0 NT45 EN US OemSsr2 zip 5 http download microsoft com download win2000platform utility 1 NT5 EN US umdhtools exe 16 5 19 2003 17
Download Pdf Manuals
Related Search