Chapter 35: Troubleshooting Windows XP

The Microsoft Management Console (MMC) [mmc]

Like Windows 2000, Windows XP collects lots of system tools into one place--the Microsoft Management Console (MMC). Strangely, the window that displays the MMC is titled Computer Management, but the program that provides the information (what is referred to as a framework) is the MMC, and that's what everyone calls it. The MMC can be the "frame" for a number of other "pictures." The pictures are called snap-ins, and each snap-in adds new capabilities to the MMC. (This is the same model that Web browsers use.)

The vast majority of snap-ins are targeted at systems administrators, information technology professionals, and all-around nerds. Though an integral part of Windows and its general health, you will not commonly find yourself poking around the MMC if you have a choice between that and playing a few rounds of Solitaire.

To display the MMC, choose Start, right-click My Computer, and choose Manage from the menu that appears. The MMC is shown in Figure 35-3.

Figure 35-3: The Microsoft Management Console (MMC)/

Several items in the Computer Management MMC are of interest to troubleshooting. The System Tools section of the Computer Management MMC includes the following tools:

• Event Viewer
• Shared Folders
• Local Users and Groups
• Performance Logs And Alerts

The Event Viewer and Performanace Logs And Alerts are of interest because they provide large amounts of information about your system and its components. The Device Manager is useful for fixing hardware and driver problems.

The Event Viewer

As Windows runs it makes notes of what's going on. The Event Viewer has a venerated history, beginning with Windows NT 3.1 where it was designed to centrally locate all operational data for the person or persons that managed the server. Your Windows computer may not be a server, but this information is no less helpful, especially when diagnosing a problem. In fact, the Event Viewer may know exactly what's wrong.

In the Computer Management MMC, open System Tools and click Event Viewer. Clicking the plus box reveals three items; Application, Security, and System. Each of these items stores recorded operational data from their respective categories:

• Application Logs all events generated by applications and programs. These are not system related events, but they may be generated by components that are used by the operating system.
• Security Logs security-related events, anything from the number of bad logins recorded to when and where objects were added to or taken away from the computers file system.
• System Logs of events that are recorded by the operating system itself. It keeps track of events, errors, and failures that occur in the system's files and functions. It also records errors and failures that occur in the system but are generated by an external application or program.

The information contained in these logs is often helpful in determining the cause of a system instability.

Performance Logs and Alerts

Like Event Viewer, the Performance Logs And Alerts component stores information about the state of the system. It records information about how well Windows performs and what tolerances, if any, it approaches or exceeds during normal operation. The logs are stored (usually in the Perflogs folder on the same disk as Windows) and you can configure Windows to store them in text files that you can import into a spreadsheet program, a database program, or a program designed specifically for analyzing logs. Counter logs record system statistics at regular intervals, trace logs record what was happening at the time of particular events, and alerts send a message or run a program when a counter hits a preset value.

By default, the logging and alert functions are not configured except for one sample Counter log that is installed with Windows. Logging is useful on large networks, where one network administrator is responsible for the functioning of many computers, but individual users rarely use them.

Most people never use the MMC Performance Logs And Alerts' logs, but if you do, follow these steps to create a log:

1. Open the MMC window and open the Performance Logs And Alerts item.
2. Right-click Counter Logs and choose New Log Settings from the menu that appears.
3. In the Name box, type a descriptive name for your new log (for example, type Disk Access if you plan to log what percentage of the time the system is active that the disk is idle). Click OK. You see a Properties dialog box for your new log, like this one:

1. To determine which counter (or counters) to log, click the Add Counters button, which opens the Add Counters dialog box:

2. The Select Counters From Computer item is selected with your computer's name below it. Leave this setting, so that you are logging your own computer's performance. (Network administrators can log the performances of computers throughout the network they manage.)
3. Set the Performance Object box to PhysicalDisk to choose which part of your system you want to see counters about. (You can click the Explain button to get information on the selection option on this and the other lists.)
4. The Select Counters From List list displays counters about the performance object you choose. Set this to % Idle Time (that is, the percentage of the time that the physical hard disk is idle).
5. The Select Instances From List list displays Total (for the total for all the hard disks and partitions on your system) and an item that includes the individual hard disk (ours says "0 C: F: D:" to include the three partitions on our hard disk). Select the latter to see separate statistics for the individual disks and partitions.
6. Click the Add button to add this counter to your log. Click Close. Back in the Disk Access dialog, the Counters list now includes an entry for the counter that you added--something like this:

\\MORTICIA\PhysicalDisk(0 C:)\% Idle Time

7. Logging usually stores a sample every 15 seconds. You can change that interval by changing the value in the Interval box.
8. If you want to store the log file somewhere other than in the Perflogs folder on the same disk on which Windows is installed, click the Log Files tab and change the settings there.
9. If you want to store the log file in a format that you can import into a database or spreadsheet file, click the Log Files tab and change the Log File Type. (Logging defaults to a Binary File type, which can't be imported.)
10. If you want to control when logging starts and stops (rather than just starting now and continuing indefinitely), click the Schedule tab.
11. Click OK to create your log. Now the log appears in the Counter Logs section of the Performance Logs And Alerts item in the MMC Computer Management window.

You can start and stop logging by selecting the log from the list and clicking the Stop The Selected Log button (a black box) on the MMC toolbar. To start it again, click the Start The Selected Log button (the right-pointing "play" arrow).

To view the log file after it has collected some data, you can open the log file, which is usually in C:\Perflogs and has the name you typed when you created the log, with a number at the end (for example C:\Perflogs\Disk Access_000001.blg). Click or double-click it to open the Performance window, a version of the Performance Logs And Alerts MMC snap-in with one additional component, System Monitor. This window is a live viewer into the operations that you have selected in your log.

The Device Manager

Like the Device Manager in previous versions of Windows, the Windows XP Device Manager displays information about all the hardware on your computer. In Windows XP, however, you can display it as an MMC snap-in. You can also display the Device Manager in its own window by choosing Start, right-clicking My Computer, choosing Properties from the menu, clicking the Hardware tab, and clicking the Device Manager button. You can do two important things with the Device Manager: modify drivers for a device and remove a device.

The Windows 2000 and XP versions of the Device Manager have a little-known feature--accessing device-specific Troubleshooters from within the device's Properties dialog box. Locate the device that is giving you trouble, double-click it to open its Properties dialog box, and click the Troubleshooter button. If you look at the General tab of the Properties dialog box, Windows tells you if it thinks the device is misbehaving.