How to get ONLY w3wp instances when specifying performance counters for Perfmon/LogMan on Windows? - windows

Hopefully this question has a simple answer i'm overlooking! I have an IIS webserver with multiple sites on it. In Perfmon, they show up as w3wp#1, w3wp#2, etc... I'm writing a Logman script that will collect performance counter data using the counters/instances that I specify and I want to ONLY collect any w3wp worker processes.
I've tried a couple ways, but no luck:
\.NET CLR Memory(*w3wp*)\
\.NET CLR Memory(w3wp#*)\
\.NET CLR Memory(w3wp*)\
I've looked at the documentation here, and it seems like it claims to support wildcards, but not partial matches. I'm not sure what to make of that. Is there any way accomplish what I want? Hope I explained this well enough. Let me know if more details are needed.
Thanks!

There is a way to display the instance by appending Process Id to it. Since ProcessId do not change it helps determining the correct instance. This post describes the method - Perfmon: Identifying processes by PID instead of instance.
Relevant part from the link:
Making below registry change will display processes in the format of **ProcessName_PID** instead of **ProcessName#1**.
Click Start, click Run, type regedit, and then click OK.
Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfProc\Performance
On the Edit menu, click New, and then click DWORD Value.
Right-click New Value #1, click Rename, and then type ProcessNameFormat to name the new value.
Right-click ProcessNameFormat, and then click Modify.
In the Data value box, type one of the following values, and then click OK:
1: Disables PID data. This value is the default value.
2: Enables PID data.
Exit Registry Editor.
Warning: Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.
Important: If you enable this feature, you may be unable to monitor process-specific information by using third-party utilities or custom-made programs, and this functionality may change at any time in the future without notice.
Hope it helps someone.

I came up with a custom batch script that find the application pool ID, PID, and associates it with the IIS worker process in question. From there, I can manually FIND and REPLACE a generic placeholder in my perfmon configuration file to start collecting for the specific site(s). I can supply some details if there is interest.

Related

How to generate windows memory dump when application crashes.?

Is there an easy way of generating the memory dump for the crashed application?
I have a situation in which the customer received the code which is generating the crash, as the code itself has no signal handlers for the backtrace generation on abort I was wondering if there is an easy way of telling windows to generate the memory dump of the crashing application.
Ideal solution wouldn't involve the installation of the debug tools (or the code modification) but if this is not possible, it would be really helpful to know.
One simple way to dump memory when application crashes is by using windows taskmanager.
When ever an exception or an application error occurs windows pops up an memory dialog and shows the address location which was causing a crash.Before you click ok on the message box open Task Manger and right click on the crashed application and select Create Dump file.Take a look at the screen shot below.
Select the file
2)Another way of generating user mode dumps is by adding the following registry key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting >\LocalDumps\application.exe
application.exe should be replaced by the application name which is under scanner.
under this key following values can be added
DumpFolder
The path where the dump files are to be stored. If you do not use the default path, then make sure that the folder contains ACLs that allow the crashing process to write data to the folder.
For service crashes, the dump is written to service specific profile folders depending on the service account used. For example, the profile folder for System services is %WINDIR%\System32\Config\SystemProfile. For Network and Local Services, the folder is %WINDIR%\ServiceProfiles.
DumpCount
The maximum number of dump files in the folder. When the maximum value is exceeded, the oldest dump file in the folder will be replaced with the new dump file.
DumpType
Specify one of the following dump types:
0: Custom dump
1: Mini dump
2: Full dump
CustomDumpFlags
The custom dump options to be used. This value is used only when DumpType is set to 0.
The options are a bitwise combination of the MINIDUMP_TYPE enumeration values.
I have found the answer myself, the msdn specifies the debug registery in the following location:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error\LocalDumps
The following values need to be set:
DumpFolder
DumpCount
DumpType
CustomDumpFlags
The extensive documentation is available here.
If the registers do not exist it is possible to create them manually and windows will pick it up.
Also this is possible without directly modifying the registry with following steps:
Click Start, and then click Control Panel.
Double-click System, and then click Advanced system settings.
Click the Advanced tab, and then click Settings under Startup and Recovery.
In the Write debugging information list, click Small memory dump (64k).

Using Google Chrome Frame as a "closed container" with HandleTopLevelRequests

Can anyone explain what using GCF as a "closed container" actually means?
I understand from this link that you enable this mode of operation using the HandleTopLevelRequests registry key.
I actually stumbled onto this setting as a way to prevent the Developer Tools window from automatically closing upon postbacks/redirects. That default behavior really makes the Network tab almost useless. :(
By setting the HandleTopLevelRequests registry key as described in the link above, the Developer Tools window remains open like I want.
I just don't know if this is a setting I should leave in place because I don't really understand what it's doing.
Or I suppose another way to ask it is, why wouldn't you want the HandleTopLevelRequests setting in place?
**Another registry key named UseChromeNetworking seems to often be used in conjunction with HandleTopLevelRequests. Bonus points for any details on it as well. :)
Any info at all would be appreciated-

Excel Range.Find and maintaining user selected find options

When automating excel using the Excel Interop API, I can easily do a range search using the method Range.Find. I am passing through the LookIn, LookAt, SearchOrder, SearchDirection, and MatchCase options for the Find. This as noted by the MSDN documentation, persists the values passed into this method into the user settings, so the next time that the user opens the find form, the options will be selected which I used in the Range.Find method.
I need to persist the values of the find options before and after I do the programmatic find. So I want to capture the current find options, then do the Range.Find, and then set the find options back to the options that were set before my search. However, I do not see that the find options are publicly accessible. Any ideas on how to get these?
I'm basically looking to retrieve current find option values for LookIn, LookAt, SearchOrder, SearchDirection, and MatchCase.
Update
The most interesting thing I could find so far is that you can access the Excel Application dialogs - Dialogs Interface. So here, I can get access to the FormulaFind dialog, which is slightly different than the Find and Replace dialog, though may lead to some of the properties I'm looking for. I haven't had any luck, but perhaps there's a way to access the properties through this form using reflection. I'll keep trying something with this.
// xlDialogFormulaFind, xlDialogFormulaReplace
Excel.Dialog dialog = this.Application.Dialogs.Item[Excel.XlBuiltInDialog.xlDialogFormulaFind];
Well, I am not sure if you'd consider this approach, but I'll give a shot here in case it might be helpful.
What I would do is, I'd create a registry key holding the values you wanted to persist. I could then call RegistryKey.GetValue(valuename) to retrieve values, provided that there's no exceptions thrown.
As long as that registry key stays there, unchanged, and you have enough privilege to access registry key, you should be able to always get the same values.
Wish we could really use application settings here, which would make it easier, but, well, as you might have known, vsto add-in doesn't like it, according to this article.
You cannot use application settings in an unmanaged application that
hosts the .NET Framework. Settings will not work in such environments
as Visual Studio add-ins, C++ for Microsoft Office, control hosting in
Internet Explorer, or Microsoft Outlook add-ins and projects.
Hope this helps.

How to refresh registry value

I am uninstalling some application and reading the software installation enumeration value from registry.
The problem is after uninstallation it is not changing the registry value untill unless the screen or regedit is not refreshed. after refreshing only i am getting the correct value.
Could some one help me out to refresh the regedit in python codes.
Regards,
upendra
I assume that by "refreshing" the "screen," you mean restarting the computer? Regardless, you can be sure that whatever registry keys you've modified will be correctly updated after the system is restarted. The registry is updated with lazy flush and writer threads, so my guess is that the changes you're making aren't flushed back to the registry immediately, but your question doesn't provide enough information about how you're modifying these registry values for me to be able to propose an alternative solution.
Perhaps more importantly, what are you trying to do here? Are you trying to get your uninstaller to verify that your application has been uninstalled? Why is this necessary? I feel like there has to be a better way than expecting registry edits to be committed and then read back out immediately.
I have kind the same problem. I "install" a python tool and environment and create some system variables in the registry. To refresh the registry I do the following:
def RefreshEnv():
HWND_BROADCAST = 0xFFFF
WM_SETTINGCHANGE = 0x1A
SMTO_ABORTIFHUNG = 0x0002
result = ctypes.c_long()
SendMessageTimeoutW = ctypes.windll.user32.SendMessageTimeoutW
SendMessageTimeoutW(HWND_BROADCAST, WM_SETTINGCHANGE, 0, u'Environment',
SMTO_ABORTIFHUNG, 5000, ctypes.byref(result))
This method is not refreshing the registry like I expected. I still have to open the window to edit the system variables in Windows and just click OK to refresh them. Otherwise my installed tools are crashing with an KeyError while trying to catch the environment variables.
I don't know if the Refresh function abovee will help you (I guess not), but at least it's a try.
You can use either of:
Just restart windows explorer with SysInternal's Process Explorer, or
If you have chocolatey installed, you can just type refreshenv in a PowerShell.
I am modifying the registry key and want to read that values without restarting the system.
I am able to read manually if I refresh the screen (F5 Button), but could you let me know how to capture this through python.

How to start/stop/pause the windows search indexer

I'd like to determine how to programatically start/stop/pause the indexer from Microsoft Search.
I know it is possible because I've seen it done in programs like this one: http://brandontools.com/files/folders/sidebar_gadgets/entry511.aspx
However, I cannot find any docs on MSDN or anywhere.
There is a "Windows Search" service which can be controlled with traditional service control methods. However, starting/stopping this service also changes the availability of search itself. I want to control just the indexer.
Does anyone know where docs may be found that describe how to interact with the indexer? My search skills have failed me.
There isn't a way to simply disable the indexing part. It's an all or nothing service. The description of the WSearch service states:
"Provides content indexing and property caching for file, email and other content (via extensibility APIs). The service responds to file and email notifications to index modified content. If the service is stopped or disabled, the Explorer will not be able to display virtual folder views of items, and search in the Explorer will fall back to item-by-item slow search."
However, you might be able to control it through drive/folder properties ... from Explorer, you can switch it of for an individual drive (see the properties of a drive; there's an option "allow indexing service..."), or for a folder (folder properties -> advanced -> "For fast searching, allow indexing service...").
EDIT ... a bit of googling, and the above properties are available - if you look at the MSDN page for System.IO.FileAttributes, there's a property NotContentIndexed with the description The file will not be indexed by the operating system's content indexing service. I would assume that you should be able to set this on individual folders. I don't know if this works if set at the drive level (without a recursive run through the drive), but hopefully it'll give you a head-start on whatever you're ultimately trying to achieve.
According the Microsoft there isn't an official way of doing so.
Here is a great tutorial on programmatically interacting with Windows Search: article at JoyOfCode.
The Windows Search 3.x SDK provides a .NET API that works against Windows Search 3 or 4.
Unfortunately, it doesn't expose pause/resume. All of the index control samples I have found use WMI to stop the search service. That will stop indexing, obviously, but at the expense of search itself not being available.
It's an old thread, but I ran across it. Someone else might as well.
Use an AutoIT script to open the Indexing Options and click the Pause button in the dialog box.
Something like this:
ServiceController service = new ServiceController("WSearch");
service.Start();
or
service.Stop();
Open the "Run" Dialog (Start | Run), type(or copy)
%SystemRoot%\system32\compmgmt.msc /s
and unfold the last one

Resources