Habib Heydarian's Blog @ Microsoft : Team System 2010

Create your own Code Analysis rule set using Visual Studio Team System 2010

habibh — Wed, 12 Aug 2009 10:09:00 GMT

In a previous post, I explained how to use Code Analysis in Visual Studio 2010 to detect dead code. In that post, I described the following five Code Analysis rules in detail and how these set of rules form the basis for detecting dead code:

Private methods that are not called from any other code (CA1811)
Unused local variables (CA1804)
Unused private fields (CA1823)
Unused parameters (CA1801)
Internal classes that are not instantiated from any other code (CA1812)

To take this one step further, it would make sense to be able to treat this set of rules as one entity so I can manage all the rules for dead code detection as a single entity. In Visual Studio 2010, we have introduced the notion of a rule set that allows you to do exactly that.

What is a "rule set"?

Think of a rule set as a container or collection of rules. A rule set allows you to bundle one or more Code Analysis rules into an arbitrary category for easier management of those rules. For example, in Team System 2010, we are providing a number of rule sets out of the box:

Microsoft Security Rules
Microsoft Basic Correctness Rules
Microsoft Globalization Rules
etc.

How to create a rule set

For our walkthrough, we want to create a rule set called Dead Code Detection Rules that contains the five dead code detection rules mentioned above. The first step in creating a rule set is to create a new rule set file (*.ruleset). You can create a new rule set file via File –> New –> File. In this example, I've given the rule set the name DeadCodeDetectionRules.ruleset, as shown below.

After creating the rule set, set the name and description of the rule set using the Properties window, as shown in the following screen shot.

Since the rule set doesn't contain any rules yet, the rule set editor shows none of the rules as being checked. The rule set editor (shown below) is a new window in Visual Studio Team System 2010 that allows you manage rules and rule sets.

To start adding rules to the DeadCodeDetectionRules rule set, you can search for a rule using either the rule number or its name, as shown below. You can also simply expand the rule categories and select the rules that you are interested in.

After adding all five dead code detection rules, the rule set editor should look something like this:

Applying a rule set to a project

Once the rule set has been created, the next step is to apply the rule set to a project. This can be done via the Project Properties window. On the Code Analysis tab, click the dropdown next to the [Open] button and select "Browse..." to browse to the location of the rule set file. After selecting the rule set, the name and description of the rule set are shown in the summary page.

So now, all the dead code detection rules are part of a single rule set which make it much easier to manage, modify and apply the rules at both the project level as well as TFS policy level.

Habib Heydarian.

Visualize project dependencies with the Team System 2010 Architecture Explorer

habibh — Thu, 06 Aug 2009 10:56:00 GMT

As early as Visual Studio 2002, Visual Studio has supported the ability to see the dependencies between projects in a solution. However, the experience is somewhat clunky in that you can only see the dependencies one project at a time.

In the example below, you can see the project dependencies for the Patient Monitoring project. However, as I mentioned above, the major drawback to this approach is that you can only see the dependencies one project at a time and don't get to see a "global view" of your solution. There is also another scenario that today's solution doesn't solve. The problem is that the only way to find out why a dependency exists is to look at the code or use some other tool. In the screenshot below, the Project Dependencies dialog doesn't tell you why the Patient Monitoring project is dependent on the Chart project.

Architecture Explorer in Team System 2010 not only allows you to see the project dependencies for the entire solution but it also allows you to see the reason why each dependency exists. Each arrow in the screenshot below represents a dependency. Furthermore, the thickness of an arrow indicates the size of the dependency. Notice that there are no arrows going in or out of the ChartVisuals project. Using the Architecture Explorer, I discovered that this project is not being used anywhere!

To investigate a dependency further, you can expand the chevron (double arrows) on each node. This will not only display the classes within a project but it will also draw arrows from the classes that have dependencies on other projects. You can even dig one level deeper to see the methods in those classes that are calling into the dependencies. This is shown via the blue arrows below.

In a future blog post, I'll walk through how to use the Architecture Explorer to analyze circular references and class coupling.

Habib Heydarian.

PDC 2009: Developing Quality Software using Visual Studio Team System 2010

habibh — Wed, 05 Aug 2009 10:11:00 GMT

Software quality is a subject that is near and dear to my heart. At PDC 2009 this year, there is full day workshop on how to use Visual Studio Team System 2010 to develop high quality software. I'm really excited about this workshop since it covers a lot of the features that my team works on including the debugger, profiler, code analysis, Historical Debugger, code coverage, etc.

By the way, if you are heading down to PDC09, feel free to drop by the Visual Studio Team System booth for a chat. Who knows, I might also be giving a talk or two on the new developer features in Team System 2010.

Habib Heydarian.

Catch string formatting bugs with Visual Studio Team System 2010

habibh — Tue, 04 Aug 2009 03:43:36 GMT

Formatting strings is a very common task in .NET development. Examples include formatting dates and currencies, composing a HTML response, creating error messages, etc. One of the downsides of string formatting is that if done incorrectly, you can end up with subtle bugs that won't be detected until runtime at which point, the application usually crashes with an exception.

Take the following code sample which comes from a real world application. It compiles fine and most of the time, it also runs without any problems However, once in a while, there is a customer complaint that the application crashes. It turns out that the if part of the code is rarely executed and because it isn't a common scenario, it wasn't tested.

So, what is the problem? If you look closely at line 6 below where the string body is formatted, the second format item which is supposed to be the user's name is missing. As I mentioned above, there is no compiler warning or error to tell the developer about this problem. It's usually found during testing or worse case, in production.

        1: protected void btnSubmit_Click(object sender, EventArgs e)

       2: {

       3:     if (isEditingPost)

       4:     {

       5:         string body = txtBody.Value;

       6:         body += string.Format("<p>-- {0}: post edited by {1}.</p>",

       7:            DateTime.Now.ToString());

       8:         // edit an existing post

       9:         Post.UpdatePost(postID, txtTitle.Text, body);

      10:         panInput.Visible = false;

      11:         panFeedback.Visible = true;

      12:     }

      13:     else

      14:     {

      15:         // Rest of code not shown

In Team System 2010, we have added a new rule to Code Analysis that detects this exact problem. When I run Code Analysis over the code above, it clearly warns me that I'm missing a format item:

warning: CA2241 : Microsoft.Usage : Method 'AddEditPost.btnSubmit_Click(object, EventArgs)' calls 'string.Format(string, object)' and does not provide an argument for format item "{1}". The provided format string is: '"<p>-- {0}: post edited by {1}.</p>"'

This feature is available in Visual Studio Team System 2010 Beta 1. Feel free to download the beta and if you have any feedback on this feature, please leave me a comment.

Habib Heydarian.

Use UML Sequence Diagrams in Team System 2010 to reverse engineer your code

habibh — Wed, 29 Jul 2009 10:04:00 GMT

One of the new features that we have added in Visual Studio Team System 2010 is the ability to create a new UML Sequence Diagram as well as generate one from existing code. I'm not going to go into too much detail on what a UML sequence diagram is since there is a plethora of information about the subject on Wikipedia. Instead, I'm going to walk you through an example on how to generate a sequence diagram for an existing application using Team System 2010.

For this example, I'm going to use the BeerHouse sample application. BeerHouse contains a method (AddShoppingCartItem) which adds a product to the user's shopping code. The AddShoppingCartItem method is shown below.

public ActionResult AddShoppingCartItem(int productId, int? quantity)
{
    TheBeerHouseDataContext dc = new TheBeerHouseDataContext();
    ProfileBase profileBase = HttpContext.Profile as ProfileBase;
    ShoppingCart shoppingCart = (ShoppingCart)profileBase.GetPropertyValue("ShoppingCart");

    if (shoppingCart == null)
    {
        shoppingCart = new ShoppingCart();

        // get the cheapest shipping method for our user
        var cheapestShippingMethod = dc.ShippingMethods.GetShippingMethods().Cheapest();
        shoppingCart.ShippingMethod = cheapestShippingMethod;

        profileBase.SetPropertyValue("ShoppingCart", shoppingCart);
    }

    Product product = dc.Products.GetProduct(productId);

    // throw a 404 Not Found if the requested forum is not in the database
    if (product == null)
        throw new HttpException(404, "The product could not be found.");

    ShoppingCartItem item = new ShoppingCartItem(product) {
        Quantity = quantity ?? 1
    };

    shoppingCart.Add(item);

    return RedirectToAction("ViewShoppingCart");
}

You can certainly read through the code above to try and understand what it does. Alternatively, using a UML sequence diagram, you can visually see the sequence of calls within this method. To generate a sequence diagram, right-click anywhere inside the method (in this case AddShoppingCartItem) and select the "Generate Sequence Diagram" method, as shown below.

After selecting the Generate Sequence Diagram command, the "Generate a Sequence Diagram" dialog appears, as shown below. The purpose of this dialog is to allow you to control the amount of information that is displayed on the diagram. There are essentially three knobs to control the amount of information that is generated on the diagram: call depth, scope, namespace.

After clicking the [OK] button, the sequence diagram below is generated. It should be immediately clear how much easier it is to understand the sequence of method calls using the diagram instead of reading through the code.

In the diagram below, you can see that there are five objects involved and how the objects interact with each other. Also, there is a section marked Opt which stands for "optional" meaning that the sequence of calls within the Opt section are dependent on some condition being true (in this case when shoppingCart == null).

Tips

Here are a few tips for using sequence diagrams.

Changing the default name of a sequence diagram

By default, the name of the sequence diagram that is generated is cryptic and not very friendly. You cannot change the name on the diagram itself. Instead, you have to use the Properties window to change the Name property, as shown below.

Adding a comment to a sequence diagram

It's often helpful to annotate sequence diagrams by adding comments. To add a comment, right-click on the sequence diagram and select Add –> Comment.

As a last note, the ability to generate a UML sequence diagram is only supported for C# and VB.NET.

Habib Heydarian.

Walkthrough: Measure the performance of your JScript code with Team System 2010

habibh — Fri, 24 Jul 2009 22:41:02 GMT

In Visual Studio Team System 2010, one of the new features that we have added to the Profiler is the ability to measure the performance of JScript code that runs in the browser. This means that if you have a web application that contains ASP.NET AJAX or plain old JScript, you can now measure how long it takes to execute the JScript portion of the application. The main restriction with this feature is that it is only supported for Internet Explorer 8.

In this walkthrough, I'm using the BeerHouse sample application. Specifically, I want to measure the performance of the UpdateProgress() JScript function by figuring out how many times it is called. This function visually displays the current progress when a newsletter is sent to the list of subscribers. The body of UpdateProgress() is shown below.

        1: function UpdateProgress(result, context) 

       2: {

       3:    // result is a semicolon-separated list of values, so split it

       4:    var params = result.split(";");

       5:    var percentage = params[0];

       6:    var sentMails = params[1];

       7:    var totalMails = params[2];

       8:    

       9:    if (totalMails < 0)

      10:       totalMails = '???';

      11:    

      12:    // update progressbar's width and description text

      13:    var progBar = window.document.getElementById('progressbar');

      14:    progBar.style.width = percentage + '%';

      15:    var descr = window.document.getElementById('progressdescription');

      16:    descr.innerHTML = '<b>' + percentage + '% completed</b> - ' +

      17:       sentMails + ' out of ' + totalMails + ' e-mails have been sent.';

      18:    

      19:    // if the current percentage is less than 100%, 

      20:    // recall the server callback method in 2 seconds

      21:    if (percentage == '100')

      22:       window.document.getElementById('panelcomplete').style.display = '';

      23:    else

      24:       setTimeout('CallUpdateProgress()', 2000);

      25: }

And here is what the progress bar feature looks like.

To start collecting performance information about your application, select the "Launch Performance Wizard..." command from the Analyze menu, as shown here.

Once the Performance Wizard comes up, select the Instrumentation option and click [Next].

On the second page of the Performance Wizard, you can select which application you want to profile. Since I am profiling the BeerHouse application and it's already open in Visual Studio, the Profiler will automatically select the project for me, as shown below.

This next step is important! On the last page of the wizard, the checkbox to "Launch profiling after the wizard finishes" is checked. Uncheck it and click the [Finish] button.

After clicking the [Finish] button, Visual Studio will open the "Performance Explorer" window. In this window, under the "Targets" node, you can see the target application to be profiled . Right-click the target (in this case TBH_Web) and select Properties, as shown below.

In the Properties dialog, select the "Instrumentation" tab and check the "Profile JavaScript" option. Press [OK] to dismiss the dialog.

Next, in the Performance Explorer window, click the "Launch with Profiling" toolbar button to start collecting performance data about your application. See below for a screenshot.

This will launch the BeerHouse application and start collecting performance data. In order to capture information about the UpdateProgress() function, I need to exercise the feature by creating a newsletter and sending it to the subscribers of the BeerHouse web site. After completing the scenario, exit the application which will cause the profiler to stop collecting additional information about the application.

In the screenshot below, I've selected the "Call Tree" view to highlight information about the UpdateProgress() JScript function. As you can see from the screenshot, this function was called 12 times from the SendNewsletter.aspx page. The profiler not only shows how many times this function was called but also how long it took. Using this information, I can now make a decision as to whether to investigate this feature further or determine the performance is fine.

The steps shown in this walkthrough are applicable any time that you want to measure the performance of JScript code running in Internet Explorer 8. The JScript profiler feature is available as part of Visual Studio Team System 2010 Beta 1 which you can download from here.

Habib Heydarian.

Use Code Analysis to measure the quality of sample code

habibh — Tue, 21 Jul 2009 15:08:52 GMT

Sample code is great because it allows you to quickly get up to speed with a new technology or learn how an API works and sometimes, you might even use some of the code in your own application. The major downside of reusing sample code is that most often, the code wasn't written with production quality in mind, so things like error handling, performance, security, etc. are omitted from the code.

Here is an example. The BeerHouse E-commerce sample application that is available from http://www.asp.net contains the UpdateOrder method which unsurprisingly updates a customer order. By looking at the code, you might decide that it looks ok and therefore decide to reuse it in your own application.

        1: /// <summary>

       2: /// Updates an existing order

       3: /// </summary>

       4: public override bool UpdateOrder(OrderDetails order)

       5: {

       6:    using (SqlConnection cn = new SqlConnection(this.ConnectionString))

       7:    {

       8:       object shippedDate = order.ShippedDate;

       9:       if (order.ShippedDate == DateTime.MinValue)

      10:          shippedDate = DBNull.Value;

      11:  

      12:       SqlCommand cmd = new SqlCommand("tbh_Store_UpdateOrder", cn);

      13:       cmd.CommandType = CommandType.StoredProcedure;

      14:       cmd.Parameters.Add("@OrderID", SqlDbType.Int).Value = order.ID;            

      15:       cmd.Parameters.Add("@StatusID", SqlDbType.Int).Value = order.StatusID;

      16:       cmd.Parameters.Add("@ShippedDate", SqlDbType.DateTime).Value = shippedDate;

      17:       cmd.Parameters.Add("@TransactionID", SqlDbType.NVarChar).Value = order.TransactionID;

      18:       cmd.Parameters.Add("@TrackingID", SqlDbType.NVarChar).Value = order.TrackingID;

      19:       cn.Open();

      20:       int ret = ExecuteNonQuery(cmd);

      21:       return (ret == 1);

      22:    }

      23: }

However, if you look closer at the parameter order and follow its usage throughout the method, you will notice that it's not validated before being used. That, combined with the fact that the method is declared public means that the UpdateOrder method is a ticking time bomb that could blow up at any time. All it takes is to call the method and pass in null for the parameter order. The following screenshot shows the extent of the problem where the usage of the parameter order is highlighted.

In Visual Studio Team System 2010, Code Analysis provides the ability to detect this exact problem. Code Analysis can detect if a parameter of a public method is validated and if not, it will warn you about it. When I ran Code Analysis on this application, Code Analysis displayed the following warning in the Error List (among other errors):

c:\Users\Administrator\Desktop\TheBeerHouse\TBH_Web\App_Code\DAL\SqlClient\SqlStoreProvider.cs(610) : warning: CA1062 : Microsoft.Design : In externally visible method 'SqlStoreProvider.UpdateOrder(OrderDetails)', validate parameter 'order' before using it.

The fix for this bug is as simple as adding an assert and checking for the null condition.

       1: /// <summary>

       2: /// Updates an existing order

       3: /// </summary>

       4: public override bool UpdateOrder(OrderDetails order)

       5: {

       6:     Debug.Assert(order != null);

       7:  

       8:     if (order == null)

       9:         return false;

      10:  

      11:    using (SqlConnection cn = new SqlConnection(this.ConnectionString))

      12:    {

The first time that I ran Code Analysis on a sample application I was amazed at the number of bugs in the code, including performance and severe security bugs. Nowadays, I've gotten into the habit of running Code Analysis first to see the overall health of the sample code before using it.

Habib Heydarian.

Visual Studio Team System 2010 Profiler and Virtual Machines: Error VSP1454 is no more!

habibh — Thu, 09 Jul 2009 07:07:00 GMT

Prior to Team System 2010, if you try to profile an application on a virtual machine (e.g. Virtual PC, Hyper-V, VMWare) using sampling mode, this is the error that you will see:

Unfortunately, if you want to use sampling mode, you're pretty much stuck! The only "workaround" is to profile your application using instrumentation mode instead of sampling mode.

I'm glad to report that in Team System 2010, we now support profiling applications in sampling mode! Our support extends to Virtual PC 2007, Hyper-V and VMWare. The reason why this is important is because increasingly, we are noticing that developers are using virtual machines as their main development environment.

Habib Heydarian.

Troubleshooting Team Foundation Server 2010 Beta 1 error TF255275

habibh — Mon, 06 Jul 2009 15:10:36 GMT

When installing Team Foundation Server 2010 Beta 1, you might run across the following error during the readiness check:

Error [ Reporting ] TF255275: The following Web service for SQL Server Reporting Services could not be accessed: http://<machine_name>/ReportServer/ReportService2005.asmx.
Warning [ Project Collection ] TF255331: The existence of the following folder on the report server could not be verified: The report server cannot open a connection to the report server database. A connection to the database is required for all requests and processing.. A network problem might have prevented communication, the report server might be offline, or your account might not have permissions on the report server. The team project collection could not be created. To complete this wizard, you must specify the option not to create a collection. As an alternative, you can close this wizard, correct the problem, and then restart the wizard.

What's interesting is that if you copy the URL above into a browser, the browser *can* find the the web service (ReportService2005.asmx) just fine. So, what's the issue? Typically, this problem happens if the machine name was changed since SQL Server Reporting Services was installed on that machine. When you try to install TFS 2010, it tries to contact the SQL Server Reporting Services via the old name of the machine which no longer exists. The workaround is to delete the databases for the Reporting Services and recreate them using the Reporting Services Configuration Manager.

First, open the SQL Server Management Studio and under the Database node, delete both the ReportServer and ReportServerTempDB databases, as shown below.

Next, start the Reporting Services Configuration Manager from the Start menu, shown here.

In the Reporting Services Configuration Manager, select the Database tab. On the Database tab, click the [Change Database] button, only here were are going to create the databases, instead of changing them.

On the Change Database page, make sure the "Create a new report server database" option is selected. Click the [Next] button.

After clicking the [Next] button, enter the name of the computer where SQL Server is running, as shown below.

On the subsequent steps in the wizard, keep the default options and continue clicking the [Next] button. When finished, click the [Exit] button on the Reporting Services Configuration Manager dialog. Re-run the Team Foundation Administration Console and the error should no longer appear.

Habib Heydarian.

Preventing SQL Injection Attacks with Visual Studio Team System 2010

habibh — Thu, 02 Jul 2009 16:46:09 GMT

There are numerous articles on the web that describe the perils of SQL Injection attacks and warn developers about the fact that "All Input is Evil!". If you are interested in reading more about what a SQL Injection attack is, Wikipedia has a pretty good introduction to the subject. There are a number of recommendations on how to prevent SQL Injection attacks including sanitizing all user input, securing the database, etc. However, the onus is still on the developer to find out if his application is susceptible to SQL Injection attacks.

With Visual Studio Team System 2010, we've introduced a new Code Analysis feature that detects and warns developers about SQL Injection attacks, thus relieving the developer from some of the burden. But more importantly, this feature helps developers write more secure code to begin with.

A SQL Injection example

For this example, I’m going to use the good old Northwind sample database and some ASP.NET code to walk through the scenario. In the method below, the SQL string strSQL is dynamically constructed to retrieve products from the Northwind database. Furthermore, the user can filter out products by typing in some text that is used as a filter (txtFilter). The reason why this method is susceptible to a SQL Injection attack is because strSQL is created by using values directly entered by the user which are not sanitized in any way.

private DataView CreateDataView()
{
    string connString = ConfigurationManager.ConnectionStrings[0].ConnectionString;
    string strSQL = "SELECT ProductId, ProductName, QuantityPerUnit, UnitPrice FROM Products";
    
    if (txtFilter.Text.Length > 0) 
    {
        strSQL += " WHERE ProductName LIKE '" + txtFilter.Text + "'";
    }

    SqlConnection connection  = new SqlConnection(connString);
    SqlDataAdapter adapter = new SqlDataAdapter(strSQL, connection);
    DataTable dtProducts = new DataTable();

    adapter.Fill(dtProducts);

    return dtProducts.DefaultView;
}

Because SQL Server allows you to concatenate several SQL statements using a semicolon or space, I can append my own SQL statement to the query above by simply entering my statement in the txtFilter textbox, as shown below:

'; UPDATE Products SET UnitPrice = 0.01 WHERE ProductId = 1--

Using the attack above, I can set the UnitPrice for the product with ProductID = 1 to $0.01, purchase a few units of the product without anyone finding out (not for a while anyway). There are many other vectors of attack here but this example is a simple demonstration of how devastating a SQL Injection attack can be.

Luckily, with Team System 2010, you can prevent such attacks by using the Code Analysis security rules. In order to take advantage of this fetaure, the first step is to configure Code Analysis to check for SQL Injection vulnerabilities in your application. To do that, select the "Configure Code Analysis for <project>" command from the Analyze menu, as shown here.

Once you've selected the Configure command, the Project Properties window opens with the "Code Analysis" tab selected. Using the Rule Set drop down, select the Microsoft Security Rules. This will tell Visual Studio to run Code Analysis on your application, checking for security vulnerabilities. To see which vulnerabilities Code Analysis is checking for, click the [Open] button.

After clicking the [Open] button, the Rule Set editor is opened. Other than security vulnerabilities, you can configure Code Analysis to detect many other issues in your application such as performance, correctness, reliability, etc. In the Rule Set editor window, expand the Microsoft.Security section and look for the rule where the ID is CA2100. This is the rule that Code Analysis uses to detect potential SQL Injection attacks in your code. What's also nice is that when you select the rule, the lower pane of the window shows you additional help on the rule, including sample code and some guidance.

The next step, after configuring Code Analysis, is to run it. From the Analyze menu, select the "Run Code Analysis on <project>" command. This command will run all the rules that have been enabled for your application and report any issues in the Error List.

In the Error List, you can see that Code Analysis has detected the SQL Injection vulnerability in our code. Furthermore, you can double click the error to navigate to the section of your code which contains this vulnerability.

If you have any feedback on this feature, I would love to hear about it. In a future post, I will delve into how Code Analysis detects these types of vulnerabilities.

Habib Heydarian.

Walkthrough: Using the Tier Interaction Profiler in Visual Studio Team System 2010

habibh — Wed, 01 Jul 2009 05:24:55 GMT

In Visual Studio Team System 2010, we've made a huge number of improvements to the Profiler. In case you didn't know that Visual Studio Team System has a Profiler, see the documentation on MSDN. One of the major improvements that we have made to the Profiler is the ability to measure how long the interaction between the application layer and the database layer takes.

Let's say that you have a typical multi-tier application, made up of a presentation layer, an application server and a database at the backend. Let's further assume that you are seeing several reports form customers that some transactions are timing out or are taking too long to complete. How do you go about finding out the root cause of the problem?

Before Visual Studio Team System 2010, you could use the Profiler to diagnose if the failure occurred in either the presentation or middle tier. However, if the performance bottleneck is between the middle tier and the database layer, you are out of luck. In this walkthrough, I'm going to demonstrate how to use the new "Tier Interaction" feature of the Profiler to diagnose failures between the application and data tier.

For this demo, I'm going to use the BeerHouse sample application. To start, select the "Launch Performance Wizard..." from the Analyze menu as shown below.

Next, you should see the "Performance Wizard". On this dialog, select the "CPU Sampling" option and click Next.

You should now land on the second page of the Performance Wizard. If the solution that you are planning to profile is already open, the wizard will automatically select it for you. Click the Next button to continue.

The next step is important! On the last page of the wizard, the checkbox to "Launch profiling after the wizard finishes" is checked. Uncheck it and click the Finish button.

After clicking the Finish button, Visual Studio will open the "Performance Explorer" window and displays the target application to be profiled under the "Targets" node. Right-click the target (in this case TBH_Web) and select Properties, as shown below.

In the Properties dialog, select the "Tier Interactions" tab and check the "Enable tier interaction profiling" checkbox. Press the OK button to dismiss the dialog.

Next, click the "Launch with Profiling" toolbar button in the Performance Explorer window shown below to start the Profiler.

The application will now start. At this point, to reproduce the customer problem, walk through the scenario that the customer or tester reported. While you are going through your scenario, the Profiler is collecting performance data about the application. Once done, close the application. At this point, Visual Studio will display a summary of the performance data that was collected as you were using the application.

In order to see the interaction between the application and the database, select the "Interactions" view from the "Current View" drop down.

And finally, here is the Tier Interactions view. There is a ton of very useful information on this page, including:

Which ASP.NET pages were requested, how many times and how long did it take to execute each page
For each ASP.NET request, which SQL Server stored procedures were called, how many times and how long did the calls take

The Tier Interaction Profiler is available in Visual Studio Team System Beta 1 right now. Feel free to download it and give it a try. If you have any feedback, send it my way.

Habib Heydarian.

What’s new in Visual Studio Team System 2010: Episode 2

habibh — Wed, 01 Oct 2008 20:03:44 GMT

Feature: Historical Debugger

In my previous post, I mentioned that one of the key scenarios that my team is working on is eliminating the "No Repro" scenario. Let’s take a look at what this actually means. Let’s say that you’re a developer and you are trying to reproduce a bug in your code. This is often a time consuming task and if you’re unlucky, you won’t even be able to reproduce the issue. At Microsoft, when a bug or issue is not reproducible, we mark it as "Not Repro". Alas, a “No Repro” bug is both unproductive and frustrating.

In Visual Studio Team System 2010, we’ve introduced a feature that for now we are calling the Historical Debugger (this name will most likely change by the time we release the RTM version of VSTS 2010). The goal of this new feature is to significantly cut down the time it takes to debug an issue by recording what the application does and be able to replay the recording (or log) in Visual Studio. By recording what the application does as it is running, our goal is cut down the number of "No Repro" bugs.

Here is a short demo of the Historical Debugger. The usual caveat applies: This is only an early glimpse of the functionality and we still have a lot of work left before the release.

Habib Heydarian.