183 Is solid state up to an ESE challenge?

BrettSh — Mon, 05 Mar 2007 19:07:00 GMT

~Eric and I were at Fry's the other day, when we stopped by flash drives ... we were debating how long until we see ESE (well Exchange specifically, though I'm more concered about laptops) on such drives. With the advent of larger and large capacity SSDs, and even commercial level drives like these, becoming ever more imminent, such a possibility looms nearer and nearer. And with a few ESE consumers on the client O.S. I expect we will be seeing our databases on SSDs on laptops within the year (maybe two).

We were discussing the various rumors about how fast they are at read vs. write, how low latency are the reads/writes, +how reliable+ (if you remember there was always this issue with earlier drives, SSD can only be written to so many times), how good at random IO, and other properties that would make them useful as Exchange storage, or at least whether they will be causing us problems on laptops. So curious was I, that of my own accord (and with my own money I'll note) I went ahead and bought about $100 worth of flash drives for running through our little JET engine, see if they survive ...

Here is a list of the drives I acquired (except the last one, being a control of sorts that I already owned):

Manufacturer	Model	Cap (GB)	Cost[1]	Warranty	MBs/$
SanDisk	Cruzer Micro Drive	1.00	$20	2 years	50.0
Kingston	DataTraveler	1.00	$20	5 years	50.0
Sony	MicroVault	0.25[2]	$18	1 year	13.8
PQI	U320 / Traveling Disk	0.50	$15	unknown[3]	33.3
Patriot	XPorter	4.00	$24[4]	5 years	166.7
AComdata	USB Hard Drive	320.00	$300	?3-5 years?	1066.7

[1] For all units, the cost was rounded up by 1 cent to non-retardo-consumer values. Tax was not added, but it applies here in Washington, 8-something% or so.
[2] I really wanted a larger Sony, but the 2 GB was $70 (too much), and I couldn't find a 512 MB or 1 GB unit anywhere on the shelf. Sigh. :P
[3] Documentation claimed it was on web site (www.pqimemory.com), but couldn't find it in a generous 40 seconds of searching.
[4] This one was an incredible value, it was actually $70 in the store, but until 3/5/2007(so only today, yeah sorry for the late notice) you get a $45 rebate if you buy it at Fry's.

All such drives claim USB 2.0 compliance on the packaging, except perhaps the USB Hard Drive, not sure about that one.

I don't want to rate these drives based on arbitrary tests[5], such as whether it comes with a wrist strap, retractable USB plug, etc ... we want our analysis to be on serious benchmarks that tell us if these have the capability to back a real ESE database load / support Exchange, and so we start our tests ...

Test 0; Part A: Getting the packaging off...

I've definately no love of the ridiculously tough plastic modlded packaging that these things come in ... and so I decided as the preliminary test in our evaluation we would test the difficulty of removing the packaging and installing the drive.

(lower is better)
4.0    Drive A (SanDisk Cruzer) had unusually tough to cut plastic, and an asymetrical shape as well (making getting the scissors to purchase hard) as very large borders making the entire thing very tough to cut open.
2.0    Drive B (Kingston DataTraveler) had somewhat better packaging, thin-ish borders, and slightly easier to cut, but 4 sided seals
2.8    Drive C (Sony MicroVault) Pretty easy to cut, reasonable sized shoulder, and only sealed on 3 sides (e.g. where the plastic is like heat fused).
3.4    Drive D (PQI U230) hardish to cut, but only sealed on 3 sides, last side is bent over, so easy to open after 3 sides.
4.4    Drive E (Patriot XPorter) had very tough packaging, the fused seal of plastic was right up against the part where the plastic turns vertical, so there was very little "shoulder" to cut along.
1.5    Drive F (AComdata USB Hard Drive) this was (IIRC) "saran wrapped" cardboard box, which is the ultimate in usable packaging.

Now, you might say this ranks up there with the wrist straps, and claim that my testing is not enough... no, no, if you have got to build an Exchange drive off 10s or 100s of these, you're going to start to care how hard it is to get them out of thier plastic, this would be a serious TCO issue.

Part B: Installing the drive ...
Installing the drive consisted of plugging in the drive, change to the drive ("g:" or "h:" usually),"mkdir \SSDBashData", "cd SSDBashData", and running my test script (I'll publish this soon) to make sure everything is working and it can at least store a results file (no verification that the file written is the file stored). Sort of a pre-race inspection.

3.0    SanDisk gets a base 2.5 for automatically installing (or maybe just running) software. And another .5 doc'd because of how it brought up both a E:\ (CD-ROM RO drive) and an H:\ (USB Mass Storage RW drive), that's just weird.
1.0    Kingston gets as good a score as I will give in this test, it came up promptly, didn't install any software, AND didn't even have any "cool programs" on the root of the drive. Kingston understands its just producing a stick of storage, and I appreciate that.
1.5    Sony gets .5 for having data in the root, but it didn't install / run anything by default that I can tell so that's all they get.
1.0    PQI like Kingston gets the a plain storage device. Good job.
2.0    Patriot gets a .5 for bringing up two drives like the SanDisk. And .5 because one of the drives had software in it. Interestingly both were RW, but the drive with software was only 24 MBs big, the other was 4 GBs.
1.0    AComdata didn't install anything, came right up, removed properly.

I wanted to complete this step also to verify I could use the drives w/o accepting any EULAs and checking the documentation that it didn't have any DeWitt clauses (the term for the clause in EULAs of products like SQL Server, Oracle, etc that say you can't publish benchmark / performance numbers of the product). I do not believe ESE has any such limitation by the way (but one would have to read the Windows OS or Exchange EULAs to be sure).

And as a plus to make sure that terrible spyware they are all bound to install is going to be universally installed when I get to performance tests, surprisingly only one seemed to (not that I looked very hard).

Conclusion:

Total Scores (lower is better):
SanDisk = 7.0
Kingston = 3.0
Sony       = 4.3
PQI   = 4.4
Patriot = 6.4
HD      = 2.5

Since the rest of the tests are likely to be based off metrics, copy times, IOPS, etc, these subjective and arbitrary test results will be used to break any ties, to allow the vendor feels maximally cheated in its ratings. ;) Next test up serial copy performance ...

Cheers,
BrettSh

[5] Yes I do. Seriously, the varying sizes of the drives may throw some of the tests way off, or be difficult to make any claims of scale ... if I were doing real testing, I would be making Microsoft pay for the hardware, getting those larger 32, 64, and 160 GB models mentioned in some of the above articles, and probably wouldn't be blogging about it. ;-) Sooo ... I don't actually intend to answer the question posed in the title, just sort of a check in to see where these cheap flash drives are ... and they all[3] have warranties so I can always recoup my investment if ESE makes them catch on fire.

Massive power outage == Adventure Friday (posthumously blogged 12/16 when my server is back up) ...

BrettSh — Sat, 16 Dec 2006 21:28:00 GMT

As we woke up Friday morning, our bedrooms had that certain briskness in the air that indicates only one thing ... power outage. Nika (a friend/roommate) and his kid went to school to see if there is any school, power out there too. We got a hold of another friend, Mary & Tony (Tony also works at Microsoft), power out at thier house and Microsoft. As we were listening to the news and driving around we got to get the idea that pretty much everything was down, and it turned from "huh, I wonder if work is going to come up" day into Adventure Day lets see where power is, and find a warm place for Nika and Mary and the kids ...

Some data:

As of Friday morning, reportedly 1.3 M customers (is that homes/businesses or people I could never tell) were without power.

We heard there were multiple hospitals without grid power, and at this point you realize how far your work (even if it is Microsoft) is like down the priority list.
News also said 80% of Bellevue was without power.
PSE specifically had 700k down (the area that services my house) of ~1M customers.

Some 90 of 150 substations were down.
And 80 transmission line (over 1/2 of such lines) were damaged.

Apparently they've flown/flying in 100+ repair crews from other states.

We saw literally dozens of fallen trees close to our house ...

some of the streets were practically green with blown off tree branches.
We ended up driving over the tops of 4 or so trees fallen across the road.
A house about 6 doors down, had a tree through its roof.
Along one road going by Microsoft we saw 7 down trees within a few blocks (I'm sure there is a [un]fair joke there at Microsoft's expense ... ;-)

Gusts to 60 - 80 mph in the general area during the wind storm on Thur night / Fri AM.

I love stats, but I don't think any of these put it in as much perspective as the traffic flow maps (which I figured out were a GREAT way to figure out if an area likely has power!), here is the seattle area map @~noon today. Yesterday however was an even more severe story:

Since you can differentiate from No Equipment and No Data, we guessed No Data meant, No Power. Nearly everything was out for I dunno, maybe 50 miles (including all of Microsoft's main campus that we heard about) of solid residential setting. We drove for about 20 miles (which took 1.5 hours) without seeing a single spot of power that morning as we maneuvered North around the lake to get to friends w/ power/heat. That's how massive it was ...

The funniest stories of the day ...

Eric went for a walk, came by my house (ironically while we were knocking on his door to see if he wanted to go North to heat with us :P) and Tony's house. Anyway, while he was at Tony's house he saw a crew clearing a tree from the road. Now Tony's house was fine, but clearly one of the wires to his house was slack and low hanging over the road, pulled down by I believe some blown off branch in the middle of the night. After the tree was cleared from the road, Eric saw a Comcast Cable truck try to sneak under it, and caught it on their ladder or roof rack, and nearly rip it off the pole. The two guys got out of the van, looked up at the pole / wire, and this was the approximate gist of the conversation:
Guy 1: "Awww crap ... its cable."
Guy 2: "We should probably fix that."
Tony later came home and found them fixing his cable ... my they can be expedient ... of course they couldn't check it worked, no power.

The other funny story, was a news story (I tried to find it at the KiroTV.com web site, but couldn't, their site sucks for finding stuff you know you read there), about a guy who had _ten_ trees hit his house! My friends and I agreed this must clearly be an evil man. If God[1] throws 10 trees at your house, he is sending you a message, STOP that bad thing we all know you are doing, and mend your ways, or you will get smote.

We later got to validate that indeed the traffic maps were the best foreteller of power, because we heard on the news that Bellevue Square Mall was out, but Lincoln Center across the street had power ... however according to the downtown Bellevue traffic flow map, power was out at Lincoln Center and came back 1 block to the East ... later we went there to see a movie, and indeed Lincoln Center had only some sort of emergency lighting on, but not real power, such as to see a movie, but enough for Nika to play thier Grand Piano, which then security got VERY PISSY about, I think he thought we were young holigans or something, but Nika actually knows how to play pleasant Nordstrom style / elevator back ground music ... luckily the Galleria (which is coincidentally one block to the East ;) had power, so we were not thwarted in our movie quest! We saw, "Bobby", it was a bit slow but ok.

It was rumored (though don't know it was actually true) said there were only like 3 working gas stations in downtown Bellevue (that's the green near the yellow camera and bellevue sign in the map), and we heard police had to be deployed to keep order at one point, and direct traffic ... they at one point had sectioned off the street for several blocks to the south, just to create a line into the gas station, and the wait was apparently ridiculous. This wasn't a problem for us because we decided to wait until after our movie (@ midnight Sat) before visiting, so we ended up waiting maybe 10 minutes.

The # of customers (or people?) dropped to 900k without power by the end of Friday, according to the news. Lastly when we came home that night, we checked our mailbox, and indeed some US Postal mail was there, hows the motto go, "neither rain, nor sleet, nor snow..." ... well they should add wind if it isn't there already. Apparently our Govenor declared a state of emergency, I think today / saturday.

Cheers,

BrettSh (msft)

[1] Not that I do or don't believe in God, I'm just saying ...TEN TREES!?

Update: MartinC showed me that wsdot has historical data, so I replaced my own previously doctored version with the actual map at 11:20 AM on Friday, it is even more effective at showing what it looks like to have 1.3 M customers without power.

I decided to check out the size of Eric's DIT ...

BrettSh — Mon, 12 Jun 2006 19:49:00 GMT

... take some time, measuring the exact dimensions of Eric's DIT ... and I must say, I've seen a fair amount of DITs in my time, and I can say with a fair amount of certainty, Eric's DIT is the biggest I've ever seen! I can't believe what a massively huge a DIT Eric has.

Note: while this is about an Active Directory database, Exchange is based on the same database technology, so it would (and does) have similar space hierarchy.

Table of ESE Space usage:

The black in this table is just the output from 3 of the columns of esentutl /ms adamntds.dit (original report), the blue are columns/rows I've added to break out the space usage in a clearer way:

Name	Friendly name	Owned	Available	Owned(GB)	Avail(GB)	b-tree lvls	% of DB	% of Total Idxs
	<calc: DB real>	268179344	6088	0.000	0.046
F:\DNT\adamntds.dit		268179344	218	2046.046	0.002

	<calc: datatable real>	268178751	5689	2046.041	0.043
datatable		268178751	2260	2046.041	0.017
	<calc: Row Data>	186707905	2260	1424.468	0.017	5	69.62%
<Long Values>		42	18	0.000	0.000	2	0.00%
	<sum: Idx Totals>	81470804	3411	621.573	0.026	0	30.38%	100.00%
PDNT_index	Int: PDNT + Name	11482791	7	87.607	0.000	5	4.28%	14.09%
nc_guid_Index	Int: NC + objGuid	10870892	5	82.938	0.000	4	4.05%	13.34%
INDEX_00090002	Att: objectGuid	10791866	3	82.335	0.000	4	4.02%	13.25%
INDEX_00000003	Att: cn	9658638	51	73.690	0.000	4	3.60%	11.86%
INDEX_00090001	Att: name	8999729	83	68.662	0.001	4	3.36%	11.05%
Ancestors_index	Int: Ancestry	7917036	10	60.402	0.000	4	2.95%	9.72%
DRA_USN_index	Int: Repl USN	7083583	251	54.043	0.002	4	2.64%	8.69%
INDEX_0009030E	Att: objectCategory	5274627	21	40.242	0.000	4	1.97%	6.47%
DRA_USN_CREATED_index	Int: Repl Created USN	4479144	34	34.173	0.000	4	1.67%	5.50%
INDEX_00020078	Att: uSNChanged	4279711	0	32.652	0.000	4	1.60%	5.25%
deltime_index	Int: deltime	371267	15	2.833	0.000	4	0.14%	0.46%
INDEX_00020030	Att: isDeleted	261493	2929	1.995	0.022	4	0.10%	0.32%

... deleted about a dozen small indices ...

I'll discuss the permutations I performed on the esentutl /ms output, in the hopes it will be clear ...

First I sum up the owned space for all indices in the datatable, this comes out to 81470804. Note the #'s above may not add up exactly because I deleted a dozen or so super small indices. I summed up all the indices because it makes the next calculation easier, and also so we can get the "% of Total Idxs" column as well.

So first understand that ESE's "owned" space is hierarchical, so the "datatable" owns all the space owned by each of the indices and the LV B-Tree in the datatable. But the primary B-Tree for the datatable also contains (and thus owns) the normal row data. So the real data that is in the regular row data for the datatable is 268178751 (datatable) - 42 (datatable's LV B-Tree owned) - 81470804 (owned by sum of all datatable indices) = 186707905 (i.e. the "<calc: Row Data>" line).

I then created a couple columns to turn this page counts into a usable unit (GBs), i.e. <# of pages> * 8 / 1024 / 1024.

Finally I added a friendly name column, so you'd know roughly what the index was indexing.

Some analysis:

From the above table we can easily see the row data 1,424 GBs and all the indices combined is 621 GBs. This breaks out like so:

Based on the table above this is showing us a full 30% of this database is indices!!! That's a huge amount. This isn't a common space breakdown for most AD objects, as the objects making up Eric's DIT are very very small / light weight. He was just creating containers w/ minimal attributes (see Eric's initial post), and so just the base set of indices on a basic object lead up to a significant portion of the objects overall "footprint" in the DB.

As for the breakup of the individual index usages, it looks something like this:

Of the secondary indices on the datatable, 10 are always updated! And another 2 (the very slender ones) are only updated on delete. Since there are over 2 billion objects in this database, that means we inserted about 22 billion B-Tree entries, kind of neat.

One last, somewhat technical thing that I think a few of you might find interesting, is that even the largest 1,424 GB primary B-Tree is only 5 levels deep. This means that to locate a specific row (by DNT) will only take 5 disk seeks in the worst case (cold cache). B-Trees have this very nice high fan out, that keeps disk seeks minimal.

Interestingly, I dumped the root page, and it only has 3 nodes (TAG 0 doesn't count), what this means is that we could add about 100x more data to this b-tree and there would be no increase in the # of disk seeks to fetch a row from this table.

Anyway that seems like enough for now ...

Writing a Unicode file via perl ...

BrettSh — Wed, 07 Jun 2006 20:25:00 GMT

Several months ago someone filed bugs across Windows Vista to make sure all performance monitoring .ini files were Unicode, so the files could be properly localized ("translated") to various languages (so we could have Korean, or Hindi descriptions). A noble goal to be sure.

For most people this was as easy as checking out the file for editing, opening it in notepad, doing a "save as", picking Unicode. ESE however has ALOT of perf counters (esp. when you Squeaky Lobster a machine - more on that later) so we use a perl script to generate several parts of the performance monitoring files, the .ini, the .hxx, and some fairly repatitive .cxx code that gets compiled into ESE binaries ... I know some of you are saying, "You can use perl on Windows?" ...

Anyway, I looked all over the internet, and couldn't even find help when I scoped to Mr. Unicode's blog ... then I posted to an internal alias on perl at Microsoft, and someone came to my rescue, since he said he didn't mind and I couldn't find it on the internet (at least at the time), I'd figured I'd post his comments ...

His comments, I wholesale included in our perl code (I had to read it twice to really grok how the ":raw" type parts were like piping through converting text commands, but in reverse so you read them right to left):

#
# Some notes from someone smarter than me about Perl and Unicode ...
# ----
#
# Which encoding do you want to use? UTF16-LE is the standard on Windows (nearly
# all characters are encoded as 2 bytes), UTF8 is the standard everywhere else 
# (characters are variable length and all ASCII characters are a single byte).
#
# Here's what I've figured out after lots of experimentation. To get UTF16-LE 
# output you need to play a few games with perl...
#
#   open my $FH, ">:raw:encoding(UTF16-LE):crlf:utf8", "e:\\test.txt";
#   print $FH "\x{FEFF}";
#   print $FH "hello unicode world!\nThis is a test.\n";
#   close $FH;
# Reading the IO layers from right to left (the order that they will be applied 
# as they pass from perl to the file) ...
#
# Apply the :utf8 layer first. This doesn't do much except tell perl that we're 
# going to pass "characters" to this file handle instead of bytes so that it 
# doesn't give us "Wide character in print ..." warnings.
#
# Next, apply the :crlf layer as text goes from perl out to the file. This 
# transforms \n (0x0A) into \r\n (0x0D 0x0A) giving you DOS line endings. Perl 
# normally applies this by default on Windows but it would do it at the wrong 
# stage of the pipeline so we removed it (see below), this is where it ought to 
# be.
#
# Next apply the UTF16-LE (little endian) encoding. This takes the characters 
# and transforms them to that encoding. So 0x0A turns into 0x0A 0x00. Note that 
# if you just say 'UTF16' the default endianness is big endian which is 
# backwards from how Windows likes it. However, because we're explicitly 
# specifiying the endianness perl will not write a BOM (byte order mark) at the 
# beginning of the file. We have to make up for that later.
#
# Finally, the :raw psuedo layer just removes the default (on Windows) :crlf 
# layer that transforms \n into \r\n for DOS style line endings. This is 
# necessary because otherwise it would be applied at the wrong place in the 
# pipeline. Without this the encoding layer would turn 0x0A into 0x0A 0x00 and 
# then the crlf layer would turn that into 0x0D 0x0A 0x0A and that's just goofy.
#
# Now that we've got the file opened with the right IO layers in place we can 
# almost write to it. First we need to manually write the BOM that will tell 
# readers of this file what endianness it is in. That's what the 
# print $FH "\x{FEFF}" does.
#
# Finally we can just print text out.
#
# If you want UTF8, I'm pretty sure it's a lot easier. Also, this is also a lot 
# easier on unix, the CRLF ordering problem is definitely a bug but the default 
# to big endian (and ensuing games to get the BOM to output without a warning) 
# are by design. I'm pretty sure that none of the core perl maintainers use perl 
# on Windows (even though at least one keeps perl on VMS working...).
#

#
# Until Exchange decides it wants a Unicode eseperf.ini, we're going to generate
# the old ASCII one.  Also if Exchange wants one, it will have to update it's
# version of Perl to understand the open modes we're using below.  Currently we
# get this error:
#	1>Unknown open() mode '>:raw:encoding(UTF16-LE):crlf:utf8' at .\perfdata.pl line 325,  line 6189.
#


if ( $ESENT ){ #ifdef ESENT 

	open( INIFILE, ">:raw:encoding(UTF16-LE):crlf:utf8", "$INIFILE" ) || die "Cannot open $INIFILE: ";
	print INIFILE "\x{FEFF}";  # print BOM (Byte Order Mark) for the unicode file

} else { #else

	open( INIFILE, ">$INIFILE" ) || die "Cannot open $INIFILE: ";

} #endif

The code worked like a charm, yeah Unicode esentprf.ini. Well, until I sync'd the code to Exchange then it broke, that is the source of the "if ( $ESENT )" which is only defined when we build the ESE sources for Windows. I should mention in closing that I know this code works for perl 5.8.7, and I know it does not work for perl 5.6.1. I've heard the perl support got much better in 5.8 or so...

Oh I guess that's code, so I'm required to say something like:
Use of included script samples are subject to the terms specified at http://www.microsoft.com/info/cpyright.htm (I'm having a hard time imagining how such a small snipit could be subject to that, but whatever).

Oh here is what the BOM is, and more on the BOM.

Update 2006/08/20: Turned out Exchange wanted a Unicode eseperf.ini after all, and has updated thier version of perl, so good news the NT - Ex code bases grow that much more similar.

Ready to feel old ... USSR was soooo last century ...

BrettSh — Wed, 22 Mar 2006 21:07:00 GMT

From one of my more educated buddies at Microsoft...

My mom teaches high school physics.
She said that most of her students haven't even heard of the Soviet Union. (The exceptions are the ones who happened to take history.)

I realize that school education is far from balanced, but I'm a bit surprised that popular culture doesn't mention it more (e.g. movies like Hunt for Red October).

-martin

Note, Martin's mom is in Nova Scotia ... so these are not even ignorant-of-world-matters-Americans who don't know this. (BTW, for the Americans reading Nova Scotia is in Canada)!

Given now that the existence of and the dissolution of the Soviet Union is last century pop culture, made me think, it's probably to make up a test with pop culture questions from over time that statistically (based on what people usually know given formative years during that time ... e.g. What is the Soviet Union? Britney Spears' bra size? Before? After? etc) could determine someone's age.

Madonna has a few songs on the billboard charts right now, esp. the club play list charts ... imagine telling parents in 1983 that Madonna's fame will outlast knowledge of the Soviet Union. That would've made them laugh.

(still in thread degraded mode but about to reboot...)

thread degraded mode ... the sequel.

BrettSh — Sun, 19 Mar 2006 12:08:00 GMT

I've run in thread degraded mode for 2 or 3 weeks without a hitch before, this time I wasn't so lucky. After about 6 hours explorer spun up taking 50% CPU (given it's a HT machine, that usually means 1 thread spinning endlessly). Heuve! That just won't do. But we can merely degrade this thread too ... once we find it ...

So I ctrl-C in the debugger window that got started from part 1 ...

Alternatively: If you don't have debugger attached up to the process yet, you can do so, by going to the C:\debuggers directory (expained in part 1), typing "tlist" to find the Process ID (PID) of the explorer.exe process, and then run "ntsd -p <PID>".

At the debug prompt we type "!runaway", which gives you something like this:
    0:076> !runaway
     User Mode Time
    Thread       Time
    73:1acc      0 days 6:36:51.328
       1:ec0       0 days 1:39:27.203
    15:1ac       0 days 0:06:01.640
    12:f94       0 days 0:05:44.281
    ... deleted the other ~80 threads ...
The time column is cumulative CPU time the thread has used.

At this point you 'g' the debugger, wait for a short timed interval, then hit ctrl-C again to re-break into the debugger. I waited 30 seconds myself, and then re-run the !runaway command ...
    0:082> !runaway
     User Mode Time
    Thread       Time
    73:1acc      0 days 6:37:21.359
       1:ec0       0 days 1:39:28.406
    15:1ac       0 days 0:06:01.671
    12:f94       0 days 0:05:44.281
    ...
You can see from the blue that thread 73 is our culprit, as it's cumulative CPU time went up by nearly exactly 30 seconds. Note the culprit thread isn't guaranteed to be the top thread, but it was in my case.

So the "~f" command from the first blog affects the "current" thread in the debugger, which you can see above is thread 82, not exactly, well ... not at all what is desired. We want thread 73 to be frozen though, so here is how you freeze a specific thread:
    0:082> ~73f
    0:082> g
Now I'm back to normal, CPU settles down, go back to work.

Sometime later the next thing is I AV'd when I typed a search in the MSN Desktop Search box on the task bar see the bottom of my start bar ... since MSN DS was the source of the original issue, not sure why I'd have expected that to work (I can be really stupid sometimes, I'll blog more about that), one more thread to freeze and then 'g' the process.

The last thing that AV'd is <window>-E. Don't know why that AV'd, but don't care I can live without file explorer.

Though I am not sure I can live without desktop search ... I sense a reboot is in my future ...

Try explorer's thread degraded mode ...

BrettSh — Fri, 17 Mar 2006 04:29:00 GMT

On any given day that is past say 7 days of uptime, I have 100 - 300 windows open, not kidding, here is a shot of my current task bar ... there shouldn't be anything msft confidential there, at least that you'd actually be able to read more than 4 or 5 letters of ... I know by heart I have 41 rows, so that's 204 windows open there ... I turn off that "group similar taskbar buttons" "feature", and the buttons show up in order, so a given "job" usually has task buttons around each other (in fact the last 6 buttons there are for this blog post) ... so what does this have to do with explorer ...

The basic upshot of this computing lifestyle choice is that my heart skips a beat and then visceral pain sets in whenever explorer AVs (Access Violation) ... explorer is what controls the start bar, and when it restarts the task buttons will be in a random order ... for the *nix types, this is like your window manager core dumping ... it's awefulness.

Right so getting to thread degraded mode ... my own term, for when you simply freeze the AV'd thread in a process, and allow the process to continue on its merry way. You can do this because maybe the thread may not be doing something particularly useful, ergo it is "not a very serious AV", or maybe call it a "slight AV". The process often (sometimes?) continues to function.

How to use thread degraded mode:

First, you will have to prepare your machine for initiating thread degraded mode ...

You will need to get a user mode debugger (there may already be a ntsd.exe in your system32, which should work, but no one uses that anchient one) go get a good version, which for an x86 box installs from this exe (i think). Install it to C:\debuggers, everyone else around here seems to.

Navigate to this registry key (read more about it):
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug"
Create registry string (REG_SZ) value with a name of "Debugger" and value of
"C:\debuggers\ntsd -p %ld -g -G -e %ld"
If it already has a value you may want to save it.

You only have to do those steps once, and now you are ready to run in thread degraded mode, if the need should arise.

The next time explorer (or any application) crashes / AVs on you, you will get an option to debug the process ... select "Debug" or "Yes" or whatever ... this will open a debugger attached to explorer ( you'll probably have to alt-tab to find this new debugger window, because the task bar will be frozen/unresponsive while you debug it ;).

The debugger will open with the AV'ing thread as the current thread, so use "~f<enter>" (that is a tilde), to freeze this thread. Then "g<enter>" will let the task bar come back to you (maybe). At this point you should be praying that the thread you froze isn't holding any crucial critical sections or locks, and that things will return to "normal" ... your mileage may vary ... greatly.

It will look like this:
    0:008> ~f
    0:008> g

After you 'g' it, it will start printing this kind of thing in the debugger ...
    System 0: 1 of 84 threads are frozen
    System 0: 1 of 84 threads were frozen
    System 0: 1 of 84 threads are frozen
That's just explorer letting you know it loves you for not letting go, and putting it on life support.

Oh the crash was in MSN Desktop Search, but I don't fault (intended ;) them because I'm running the first beta of the software released in Dec 2004, I've heard they've had an update since then.

Anyway, as of approximately 8:20 AM (PST) yesterday (wed) morning, I've been running in thread degraded mode ... as I finish this post I've got 4 frozen threads ... there were a few more threads with "issues" but I don't have time to blog about them right yet ...

Show me the backups (win2k3 sp1)...

BrettSh — Thu, 09 Feb 2006 14:50:00 GMT

It recently came to my attention that repadmin + showbackup had no google hits! Well I'd like to fix that.

First a little back story ... around I guess 2003 there had been a growing trend (of PSS whining, er I mean noticing that) customers are not taking any backups, and many customers didn't quite understand how application Naming Contexts (NCs) are not replicated to every Domain Controller (thus the old adage of "backup one DC from every domain" was stale) ... and so people would be missing critical data at restore time ... with restore time being like the 3rd worst time to be missing critical data, but the most likely time to call PSS, PSS asked if we could help, and we / AD dev (were drunk when they asked, had time on our hands, tired of feeling guilty about our in-box monitoring tools story, felt like "putting the feature back in service pack", maybe we were bored... whoa is this my outside voice?) happily said what can we do to help...

So to address this issue, for Win2k3 SP1 we hashed out adding the ability for DCs to log an event (Event ID 2089) if a Naming Context is not being backed up regularly within a certain latency. The default latency is 1/2 the tombstone lifetime (too long IMNHO) ... oh and there is a reason this event won't be logged for an NC, but whatever ... this is not a post about that mechanism / event (more on it someday), besides we're not even sure most admins are capable of reading the event logs (is that too insulting ...where is the line? I can never tell?) ...

OK, event logs are fine, but you want to know now! When I added the 2089 event to AD, I added the /showbackup command to repadmin. This basically can show when backups were taken of various writable NCs the DC hosts. (this block may make the post wide, probably mess stuff up, but anyway here is the output of the command):

C:\bin\rel\win2k3\sp1\x86fre>repadmin.exe /showbackup mycorp-dc-02

Loc.USN                          Originating DC   Org.USN  Org.Time/Date          Ver Attribute
=======                          =============== ========= =============          === =========
DC=DomainDnsZones,DC=MyCorp,DC=com
329205835     084f51ed-d53e-4bad-83db-28694870fdb9 127958011 2006-02-08 02:51:22  197 dSASignature
DC=ForestDnsZones,DC=MyCorp,DC=com
329258203     084f51ed-d53e-4bad-83db-28694870fdb9 127958010 2006-02-08 02:51:22  202 dSASignature
CN=Schema,CN=Configuration,DC=MyCorp,DC=com
330447680     e0cc9580-1546-4da9-af2b-0929c37a378a  68598018 2006-02-09 02:14:56  897 dSASignature
CN=Configuration,DC=MyCorp,DC=com
330447359     e0cc9580-1546-4da9-af2b-0929c37a378a  68598017 2006-02-09 02:14:56  898 dSASignature
DC=MyCorp,DC=com
329205750     084f51ed-d53e-4bad-83db-28694870fdb9 127958006 2006-02-08 02:51:20  205 dSASignature
DC=UnLovedOlderChild,DC=MyCorp,DC=com
DC=UnLovedYoungerChild,DC=MyCorp,DC=com

Obviously the green is showing you can basically see when the DomainDnsZones was last backup. You can probably guess from this output how we are tracking the last backup too. Note: This tracking can only be done if a DC you're taking backups on is upgraded to Win2k3 SP1.

And of course "repadmin /showbackup *" should work if you want to capture the last backup time across all NCs (which means hitting all DCs, thus the *). Don't assume your backup software is smart enough to understand where the NCs are instantiated / replicated to.

It's funny (or embarressing, depending on who you are) 2 years after coding something, you review it, and immediately see everything you screwed up...

The above command should've resolved the Orig DC invocation IDs into DC names, so you could know where that backup was taken. That's just fricken sloppy, sorry about that. I really piss me off sometimes.
In retrospect it would have been better to add another partition test to dcdiag. That would've been way sweeter, fails if over timestamp latency, and /v would print out how old the last backup is, and what DC it was taken on.
Would've been cool to add to ntdsutil the ability to control the backup latency event's sensitity on a per partition basis. The feature has this ability today it is just not exposed, instead you've got to use a reg key (which I don't recommend).
This was actually from a corp DC, but I changed the names ... but it makes me wonder if that's right our child domains aren't being backed up, or there is a bug in the tool / mechanism? Those are partial replicas though, it might not being working on partial replicas ... that's an excercise for the reader ... let me know.

So there you have it repadmin /showbackup, as any self respecting admin, I suggest you move "Try a test restore of our backups" to the bottom of your TODO list, and play with this repadmin command instead. No, no don't worry the restore will just work if you need it, play with this instead.

Well, that is IMNHO only about 1/2 a post ... I didn't even get to the Backup FSMO role (some other time hopefully) ... but tis all I have time for now, sorry.

OK, they CAN NOT be serious, I only have a single sans-serif font to choose from!? Oh, and that font (Arial) even has a sertif on lower case-t. Verdana has serifs on upper case I, but it is mostly serifless. Guh, I'm not sure I can actually live with blogging in this medium, alright Verdana it is, god I miss my Mac ...

Oh and if you're wondering it was Mr "Grillenmeier, Guido" that was the unintentional catalyst to my first post, not the more derisive elements of my life.

Cheers,
BrettSh [msft]
Building #7 Garage Door Operator

P.S. - I still am not quite happy with my categories yet, and I still don't have my Orange theme back, (remorseful voice) it was a really good theme. But at least I can complain now as I'm blogging^H^H^H^Hed.