icelava's questions

We have a SPA that runs SockJs both client and server (NodeJs) side. For Windows workstations we have no problems maintaining web socket connections to servers deployed in Windows Azure. But for some colleagues using Mac OS X workstations they are experiencing in recent weeks frequent random disconnections for Web sockets. Happens on both Chrome or Firefox, so it appears to be at a lower OS level thing.

As far as they know there were no updates to OS X that might have affect the network stack. Don't seem to find any issues on SockJs either. Any troubleshooting tips for OS X?

One thing i never understood nor find any easy explanation is how Windows manages changes to system files from differing Windows updates. Take for example

A certain KB release applies patches to A.dll and B.dll, which I may not apply.

A later KB release patches up A.dll only. Which I apply. A.dll should not be carrying the fix in the earlier KB.

When I do choose to apply the former KB fix, what version does A.dll really become? It would seem that Windows Update cannot merely replace files wholesale, but have to intelligently patch the files based on past KBs' hotfixes applied. Correct me if I'm wrong, thanks.

I have a Windows 2008 R2 server that is a Hyper-V host (Dell PowerEdge T300). Today for the first time I encountered an odd situation; i lost connection with one of the guest machines but logging on physically it seems the guest OS is still running but no longer contactable via the network.

I tried to shut down the guest machine (Windows XP) but it would not shut down, getting stuck in a "Not responding" dialog box that cannot be dismissed. I used the Hyper-V management console to reset the machine and it could not get out of resetting state.

I tried to save another Windows 2003 guest machine, and it would be progress with its Saving state (0%). The other running Windows 2003 guest was stuck in the logon dialog.

My first suspicion is perhaps one of the Windows update patches this week (10 Nov 2011) may something to do with it, which was still pending a system restart. Well, since I could not do anything with Hyper-V i proceeded with the Windows Update restart, and now it is stuck half an hour at

"Shutting down hyper-v virtual machine management service"

Prior to restarting I did not observe any hard disk errors reported in the system event log; doubt it is a disk-related condition.

Shall I force a hard reboot?

UPDATE

Ok so i left it hanging over an hour while attending to other matters, and thankfully the host cleanly restarted. I can operate the guest machines fine now. Phew.

Hyper-V must have been crawling for some reason. The VMs have been observed to become slow in the past when the host has been up for a long duration (two weeks to a month), but never this slow. Would love to know what types of performance monitoring items i can observe to give a hint why this can happen.

UPDATE 2012-02-13

In the months ever since, Hyper-V has stalled into this state another two times. It appears so randomly and without any error event logs to hint what is causing it enter this "drunkard" state. Just an Hyper-V management service timeout.

Log Name:      System
Source:        Service Control Manager
Date:          13/2/2012 9:16:48 AM
Event ID:      7043
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      elune
Description:
The Hyper-V Virtual Machine Management service did not shut down properly after receiving a preshutdown control.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="49152">7043</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2012-02-13T01:16:48.882901900Z" />
    <EventRecordID>567844</EventRecordID>
    <Correlation />
    <Execution ProcessID="764" ThreadID="8484" />
    <Channel>System</Channel>
    <Computer>elune</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Hyper-V Virtual Machine Management</Data>
  </EventData>
</Event>

The only means out of it is to restart the system.

UPDATE This problem may never be answered given that I have recently nuked the server and installed Windows Server 2012 R2 afresh.

I upgraded my Windows 2008 Hyper-V host server to Windows 2008 R2 last night. The upgrade went smoothly, but when it settled down as the new version, I found two virtual machines out of seventeen to be missing from the Hyper-V console UI.

From the Hyper-V event log i see

Log Name:      Microsoft-Windows-Hyper-V-VMMS-Admin
Source:        Microsoft-Windows-Hyper-V-VMMS
Date:          6/4/2011 2:31:26 AM
Event ID:      16300
Task Category: None
Level:         Error
Keywords:      
User:          SYSTEM
Computer:      elune
Description:
Cannot load a virtual machine configuration: General access denied error (0x80070005) (Virtual machine ID 5185AC13-4148-4AFE-9024-6E74FE3C9754)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Hyper-V-VMMS" Guid="{6066F867-7CA1-4418-85FD-36E3F9C0600C}" />
    <EventID>16300</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-05T18:31:26.432942100Z" />
    <EventRecordID>641</EventRecordID>
    <Correlation />
    <Execution ProcessID="1964" ThreadID="2064" />
    <Channel>Microsoft-Windows-Hyper-V-VMMS-Admin</Channel>
    <Computer>elune</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <VmlEventLog xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://www.microsoft.com/Windows/Virtualization/Events">
      <VmName>
      </VmName>
      <VmId>5185AC13-4148-4AFE-9024-6E74FE3C9754</VmId>
      <ErrorMessage>%%2147942405</ErrorMessage>
      <ErrorCode>0x80070005</ErrorCode>
    </VmlEventLog>
  </UserData>
</Event>

These "missing" VMs do not have any online snapshots tied to them. Even for those that did I removed and merge the snapshots based on Microsoft's advice, and they've "survived".

There seem to be a lot of "General access denied error (0x80070005)" discussion when it comes to starting virtual machines. But my case is the Hyper-V service being unable to even load the configuration, so Hyper-V knows where those VM config locations but don't have permission to access them?

The three Hyper-V services are launched with LOCAL SYSTEM account, and the "Virtual Machines" folders for those VMs do grant Full Control permissions. What I observe from the other VMs is their folders have additional ACEs for Virtual Machines group and the VM GUID itself?

I tried to duplicate this ACE structure, but Windows cannot locate the GUID principals of those missing VMs. What would be causing this problem?

I am trying to ramp up knowledge on SharePoint deployment and usage (never did before), due to a direction to use SharePoint 2010 as a repository platform (wiki format) for our customer's infrastructure documentation.

In my test virtual server, a new site of Enterprise wiki template was setup. Went into Site Actions > Manage Site Features to activate Wiki Page Home Page. The default sub-web then went from /Pages to /SitePages and looks like the default Team template. The odd thing is the Site Actions is missing the New Page option. My colleague does not understand why this is the case, as it ought to be there. The original /Pages sub-web does have the option.

What conditions are in play that influences the appearance of that option?

UPDATE

Another phenomenon observed is in the Site Actions > View All Site Content view, the wiki document libraries listed in the grid will have their hyperlink (e.g. "Site Pages") lead straight to the direct default page. It would not show its own table listing of pages under that document library, unlike the original Pages document library, which expectedly show up as a listing. I wonder if this hints to any problems.

During typical capacity planning processes i see a perhaps simplistic consideration for estimating only the page or data sizes that are expected to pass through the network pipes. That means like in regular application development the average HTTP page response size is 30KB, or the XML web service data size averages 100KB, such figures are taken raw and multiplied by the forecasted volume to get the expected bandwidth requirements.

It seems application developers and architects tend to forget, or are totally unaware of, the fact that application data are encapsulated into lower-layer transport layers for delivery. So they seldom consider the bandwidth eaten up by header overheads in TCP/IP packets and Ethernet frames.

I feel these overhead should be considered during bandwidth planning, but do not know how to accurately calculate these. Is there an basic formula or process that factors these overhead percentages? So far I have not seen any article that discusses this matter.

For some reason after upgrading the SSH Tectia client from v6.0 to 6.1 on my Windows XP workstation, VisualSVN 2.0.7 is unable to start up its Apache service after reboot.

Event Type: Information
Event Source:   VisualSVN Server 2.0
Event Category: Apache 
Event ID:   1000
Date:       9/30/2009
Time:       3:37:48 PM
User:       N/A
Computer:   4-J25A
Description:
Disabled use of AcceptEx() WinSock2 API


Event Type: Error
Event Source:   VisualSVN Server 2.0
Event Category: Apache 
Event ID:   1002
Date:       9/30/2009
Time:       3:37:48 PM
User:       N/A
Computer:   4-J25A
Description:
alloc_listener: failed to get a socket for (null)
(OS 10106) The requested service provider could not be loaded or initialized.  


Event Type: Error
Event Source:   VisualSVN Server 2.0
Event Category: Apache 
Event ID:   1000
Date:       9/30/2009
Time:       3:37:48 PM
User:       N/A
Computer:   4-J25A
Description:
Syntax error on line 25 of C:/Program Files/VisualSVN Server/conf/httpd.conf:


Event Type: Error
Event Source:   VisualSVN Server 2.0
Event Category: Apache 
Event ID:   1000
Date:       9/30/2009
Time:       3:37:48 PM
User:       N/A
Computer:   4-J25A
Description:
Listen setup failed

If i directly launch the VisualSVNServer.exe apache process it can work and accept requests, but the VisualSVN management console still thinks the service is stopped. I am not familiar enough with the Windows version of Apache to understand what is prevent it from securing its stated port of 8443 (or can be any other port number for the matter)?

Despite my colleague and myself being application developers by nature, our current contract engagement has placed us into the infrastructure operations branch of our customer. While we are still largely responsible for the framework and architecture levels of .NET code base, we are also involved in capacity planning – reviewing the requirements and volume from proposed projects, the general solution/approach, and map them to the existing infrastructure and network topology. There we have to calculate which existing resources can handle the load, where new servers and bandwidth need to be allocated, etc. These projects apply to a great area of their systems and topology.

The thing is: the customer themselves do not have a standard practice. There is no set methodology to evaluate these, no template documents to document and calculate these figures in a consistent manner. How they managed all the past developments of such scale is a mystery presently. I would like to ask if there are any capacity planning guides and advice we can refer to point us in the right direction towards more accurate calculations?

The default appearance settings of Windows irritate me with its dumbing down of the interface and I always modify Windows Explorer with

• launch by default to My Computer %SystemRoot%\explorer.exe /e,::{20D04FE0-3AEA-1069-A2D8-08002B30309D}
• Always show icons, never thumbnails
• Show hidden files and folders
• Display the full path in the title bar
• uncheck Hide extensions for known file types
• uncheck Hide protected operating system files
• uncheck Remember each folder's view settings
• uncheck Use sharing wizard

I also customise the Start menu

• System administrative tools - Display on the All Programs and the Start menu
• Control Panel - Display as a menu
• Number of recent programs to display = 12 - 24

Even multiple settings in Task Manager

• Processes with PID (and Command Line) columns; columns rearranged
• uncheck Always on Top
• Hide on minimize
• Minimize on Use
• Networking show Bytes sent per interval, Bytes Received per interval
• View graph as Bytes Sent and Bytes Received, but not Bytes Total

That is just a subset of alterations I make to every Windows system i bring up. I was wondering if there is a scriptable manner to this. Does anybody know where WE and Start settings are stored and edited?

Our customer has some Windows 2003 servers running batch jobs activated by Task Scheduler. The actual programs performing the work are custom .exe processes, and they are aggregated into .cmd scripts so that they get launched together by Task Scheduler when the scheduled interval comes by. The lines within the cmd scripts may or may not use the Call command to launch the separate .exe programs.

In this setup, Task Scheduler is effectively monitoring cmd.exe, and when using Process Explorer, one can observe that the child .exe processes are parked under the cmd.exe process tree. However, when Task Scheduler kills cmd.exe due to exceeding the permissible time limit, the child .exe processes may not be killed along with their parent and become orphaned. Those processes remain stalled indefinitely. Due to the state of the process threads shown in Process Explorer, i suspect those processes end up in error and popped up a .NET debugger dialog box (these are .NET applications) which cannot be seen since the batch job user is a separate user account.

Initially when i was investigating this behaviour on my Windows XP workstation, I observed that child .exe processes launch from my test .cmd script do get killed together with the cmd.exe when Task Scheduler decides time is up. There was no way I could orphan the child processes.

Based on a hunch, i eventually moved over to a Windows 2003 machine to test this. Similarly, the child processes to get terminated like those in my workstation. My second step was then to use another user account to run the scheduled task. This time round, cmd.exe gets killed after the time limit is exceeded, but the child processes remain standing, just like what my customer observed in their production servers.

If i preemptively logon that batch user account (which just so happened to be another admin account) to claim a desktop session, any error or info pop-ups from my test .exe programs would be routed and rendered on that desktop, allowing me to see the actual user output. If i only logon after the scheduled task had been invoked, the desktop session will not "reclaim" the existing processes' windows; they stay hidden forever.

My question is, what condition(s) am I missing here that can cause Task Scheduler not to wipe out the child processes under a cmd.exe? What is special about using another account that would induce this behaviour, but not when using my current administrator account to run the schedued task?

I have a couple of workstations (Windows Vista, 7) used to host virtual machines using Virtual Server 2005, Virtual PC 2007, or Virtual PC for Windows 7. If i want to sleep or hibernate the physical hosts, I tend to get paranoid and save the states of the virtual machines before doing so.

What I would like to know is there any adverse effects if I choose not to care and just immediately sleep the host?

I have a number of virtual machines that have not been switched on for over a month, and some others which have been rolled back to an older state. They are members of a domain, and have expired their machine secrets; thus unable to authenticate with the domain any longer.

Event Type:             Warning
Event Source:          LSASRV
Event Category:      SPNEGO (Negotiator) 
Event ID:  40960
Date:                       14/05/2009
Time:                       10:24:54 AM
User:                        N/A
Computer:              TFS2008WDATA
Description:
The Security System detected an authentication error for the server ldap/iceland.icelava.home.
The failure code from authentication protocol Kerberos was "The attempted logon is invalid.
This is either due to a bad username or authentication information.

 (0xc000006d)".

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: c000006d  


Event Type:             Warning
Event Source:          LSASRV
Event Category:      SPNEGO (Negotiator) 
Event ID:  40960
Date:                       14/05/2009
Time:                       10:24:54 AM
User:                        N/A
Computer:              TFS2008WDATA
Description:
The Security System detected an authentication error for the server cifs/iceland.icelava.home.
The failure code from authentication protocol Kerberos was "The attempted logon is invalid.
This is either due to a bad username or authentication information.

 (0xc000006d)".

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: c000006d


Event Type:             Error
Event Source:          NETLOGON
Event Category:      None
Event ID:  3210
Date:                       14/05/2009
Time:                       10:24:54 AM
User:                        N/A
Computer:              TFS2008WDATA
Description:
This computer could not authenticate with \\iceland.icelava.home,
a Windows domain controller for domain ICELAVA, and therefore this computer might deny logon requests. This inability to authenticate
might be caused by another computer on the same network using the same name or the password for this computer account is not recognized.
If this message appears again, contact your system administrator.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: c0000022

So I try to use netdom to re-register the machine back to the domain

C:\Documents and Settings\Administrator>netdom reset tfs2008wdata
/domain:icelava /UserO:enterpriseadmin /PasswordO:mypassword
Logon Failure: The target account name is incorrect.

The command failed to complete successfully.

But have not been successful. I wonder what else needs to be done?

So i use real server hardware at home, but since I am not rich, I can largely just afford one and hope to upgrade the disks and memory on just this single unit. Now comes a challenge that I do not have enough experience to figure how to properly implement:

At present, i have a virtualised AD domain in this server. While the server physically comes with two network ports, both are connected to the same switch; I only have one network in my entire home. And naturally only one broadband router out to the Internet. One network port is dedicated to the host machine/parent partition, while the other is for Hyper-V guests. All nodes physical or virtual use 192.168.1.0/24.

Now, I have interest to simulate a multi-site domain. If I am to set up another domain controller, I'd like to place it in a subnet 192.168.2.0/24. And this is where I am unsure how to proceed.

I could just assign the second domain controller network adapter to 192.168.2.0/24 but how can I properly route this, as the default gateway of machines in 192.168.1.0/24 is 192.168.1.1 - the broadband router. So requests for 192.168.2.0/24 are just going to shoot out into the Internet with no return. My Linksys router only works as a single subnet. Secondly, machines in the 192.168.2.0/24 subnet ought to have Internet access just like the original 192.168.1.0/24 nodes.

It seems I may need an "authoritative" router device that controls both (or more) internal networks, before routing Internet-bound packets to the actual broadband router?