Blog

Back in 1982 Digital Research released DR PalmDOS which ran on Palm personal digital assistants.  When you used a PCMCIA card for storage, instead of adding a drive letter, it added a drive number - 0:, 1:, 2:. Today, even with Windows 7, non-alphabetic characters can be used, including  $ [ ] ` { } etc.  But some characters are just too special and cannot be used: % & ^ = | \ " ; , /..

The subst command is the only way I could find for using these, though.  This could be handy for a system where you are connecting removable media and you would have trouble knowing which drive letters would be available.  For example: [more]

subst 1: "C:\Documents and Settings\username\My Documents"

subst *: "C:\Documents and Settings\username\My Documents"

Unfortunately, the regular Explorer windows cannot handle these "special" drive designations, but they can be used from the command line.

During troubleshooting it is often necessary to see what traffic is being passed between two networks or two hosts. The ASA software now features a built-in packet capture tool.

Below are the steps you need to take:

For the sake of this tutorial, let’s assume that we are troubleshooting traffic between a host with the address of 192.168.1.1 and a host with the address of 10.10.10.1.

Step 1. Define the traffic that you are interested in seeing via an ACL named “cap”: [more]

ASA(config)#access-list cap extended permit ip host 192.168.1.1 host 10.10.10.1
ASA(config)#access-list cap extended permit ip host 10.10.10.1 host 192.168.1.1
ASA(config)#access-list cap extended permit icmp host 192.168.1.1 host 10.10.10.1
ASA(config)#access-list cap extended permit icmp host 10.10.10.1 host 192.168.1.1

Step 2. Create and start the packet capture process named “capin”:

ASA(config)#capture capin access-list cap

Step 3. Generate some traffic between the two hosts.

Since our ACL in this case is set to detect all IP and ICMP traffic between the host we can just start a simple ping betweent the hosts.

From the host 192.168.1.1:
ping 10.10.10.1
From the host 10.10.10.1
ping 192.168.1.1

Step 4. Analyze the packet capture.

ASA#show capture capin
*This will output all of the traffic that it captured.

Step 5. Turn off the packet capture and remove the ACL:

ASA(config)#no capture capin
ASA(config)#clear configure access-list cap

Miscellaneous notes/commands:

You can clear the capture log by using this command:
ASA#clear capture capin

You can also use the pipe functionality when viewing the capture output:
ASA#show capture capin | inc 192.168.1.1

This can also be done via the ASDM, but what fun is that?

Vista/Windows7/Windows Server 2008 introduce a new format for the administrative templates for group policies.  Instead of replicating proprietary ADM files with the group policies, you now create a “central repository” for the ADMX (xml format) administrative templates.  Stored with the ADML files are language specific ADML files (in a subdirectory).  The trick here, is that once you create the central repository then Windows 2008 group policy editors cannot see the old ADM files, so if you have settings you wish to edit you have to create a complimentary ADMX template.  Further, older OS versions cannot read the ADMX files, so you have to be careful to perform a cutover.  Either use ADM files, or use ADMX files and edit the group policies only on newer OS versions. [more]

ADMX step-by-step guide:  http://technet.microsoft.com/en-us/library/cc709647%28WS.10%29.aspx

“New Windows Vista–based or Windows Server 2008–based policy settings can be managed only from Windows Vista–based or Windows Server 2008–based administrative machines running Group Policy Object Editor or Group Policy Management Console.”

“Group Policy Object Editor on Windows Server 2003, Windows XP, or Windows 2000 machines will not display new Windows Vista Administrative Template policy settings that may be enabled or disabled within a GPO.”

Inside ADM and ADMX Templates for Group Policy

Win Server 2008 Directory Services, Group Policy Templates

New Windows 7 hotkeys

Ease of Access keyboard shortcuts

The following table contains keyboard shortcuts that can help make your computer easier to use.  [more]

General keyboard shortcuts

The following table contains general keyboard shortcuts.

Dialog box keyboard shortcuts

The following table contains keyboard shortcuts for use in dialog boxes.

The following table contains keyboard shortcuts that use the Windows logo key .

Windows Explorer keyboard shortcuts

The following table contains keyboard shortcuts for working with Windows Explorer windows or folders.

Taskbar keyboard shortcuts

The following table contains keyboard shortcuts for working with items on the taskbar.

Magnifier keyboard shortcuts

The following table contains keyboard shortcuts for working with Magnifier.

Remote Desktop Connection keyboard shortcuts

The following table contains keyboard shortcuts for working with Remote Desktop Connection.

When I logged onto a customer’s terminal server/dc, the c: was completely out of space.  I loaded Space Monger and saw that most of the files taking up room were in c:\program files\sav in .xdb files.  I ran disk cleanup and compressed old files which freed up about 5 GB.

I then started researching what was downloading the xdb files.  I saw that they were dating back to almost 60 days ago and every day since.  Each file was approximately 100 MB. 

I looked at all of the Symantec products on their system and talked with the person who had updated Symantec Antivirus (SAV) to Symantec Endpoint Protection (SEP).  He asked me to check the scheduled tasks, and I discovered that there was a scheduled task that ran to download definitions to the old SAV program before they were upgraded to SEP.  I disabled the scheduled task and deleted the xdb files to finish cleaning up an additional 4 GB space.

We have noticed some problems when SQL grabs all the memory on a machine and leaves no memory for other processes. This is especially true if you are running multiple instances (named instances) of SQL Server on the same box. There is an MSDN article that describes the issue and the steps to remedy the problem (http://msdn.microsoft.com/en-us/library/ms178067.aspx). Here is a blurb from that article: [more]

Running Multiple Instances of SQL Server

When you are running multiple instances of the Database Engine, there are three approaches you can use to manage memory:

• Use max server memory to control memory usage. Establish maximum settings for each instance, being careful that the total allowance is not more than the total physical memory on your machine. You might want to give each instance memory proportional to its expected workload or database size. This approach has the advantage that when new processes or instances start up, free memory will be available to them immediately. The drawback is that if you are not running all of the instances, none of the running instances will be able to utilize the remaining free memory.
• Use min server memory to control memory usage. Establish minimum settings for each instance, so that the sum of these minimums is 1-2 GB less than the total physical memory on your machine. Again, you may establish these minimums proportionately to the expected load of that instance. This approach has the advantage that if not all instances are running at the same time, the ones that are running can use the remaining free memory. This approach is also useful when there is another memory-intensive process on the computer, since it would insure that SQL Server would at least get a reasonable amount of memory. The drawback is that when a new instance (or any other process) starts, it may take some time for the running instances to release memory, especially if they must write modified pages back to their databases to do so. You may also need to increase the size of your paging file significantly.
• Do nothing (not recommended). The first instances presented with a workload will tend to allocate all of memory. Idle instances or instances started later may end up running with only a minimal amount of memory available. SQL Server makes no attempt to balance memory usage across instances. All instances will, however, respond to Windows Memory Notification signals to adjust the size of their buffer pools. As of Windows Server 2003 SP1, Windows does not balance memory across applications with the Memory Notification API. It merely provides global feedback as to the availability of memory on the system.

You can change these settings without restarting the instances, so you can easily experiment to find the best settings for your usage pattern.

I recently upgraded my laptop to Windows 7 with Office 2010. After getting everything setup I was experiencing a problem with Outlook not reopening after I had previously had closed it. I would check the task manager and it would show to instances of Outloo.exe running. I would kill the one with the highest memory usage and Outlook would open. I began disabling and enabling Outlook add-ins until I found that the problem was caused by “OutlookChangeNotifier” which is installed with iTunes. Once that was disabled Outlook opened and closed without any problems.

One of our new customers using VMware has not been happy with the performance of some of their virtual machines that had been setup before they were our client. Specifically, a couple of their Citrix VMs and a SQL Server 2005 VM have been “sluggish since they were built” according to the IT staff. I did some basic diagnostics on the SQL Server VM and it did seem to have some performance problems. However, since they had already bought a new physical server and started moving the databases to the new install we didn’t spend much time trying to make the VM run well. We decided to upgrade to VMware vSphere v4.1 upgrade before attempting to address any of the performance issues, since less than stellar performance on virtual terminal servers was normal on VMware v3.5.

During the upgrade, I needed to vMotion some of the VMs around to take down one of the ESX hosts. I kept getting a very generic error on several of the VMs and the migration would fail. I lmust have ooked at every setting a dozen times until I finally just shut the VM down and opened up the VMX file to see what might be causing the issue. The problem was that the person who had built the VMs originally had included processor affinity settings in the VMX file. This binds a VM to a specific subset of the physical processors/cores on the ESX hosts. For example, on the SQL Server VM, it was bound to cores 0 & 1. With this setting, ESX was forced to schedule core 0 & core 1 for all operations even though the server had 8 cores. Additionally, on ESX, the service console has processor affinity on cores 0 & 1, but it holds the highest priority. So basically the SQL Server VM (and the other VM I found that was co-scheduled on cores 0 & 1) were fighting with the service console for processor cycles. After removing the processor affinity, the CPU wait time counter in vCenter for that VM dropped 6x. I ended up finding 10-12 VMs with processor affinity set, so that explained why the performance was terrible. 

The moral of this story is to not manually schedule the processors when you configure ESX or Virtual Machines.  Chances are the ESX schedule will be much better than any manual configuration you could put together.

If you have ever stayed at a Hampton Inn, you are probably very familiar with the Internet intercept website they use to ask for the Internet access code.  That intercept page also includes a checkbox asking if you are an advanced VPN user.  I have alternated between checking and not checking this box without any noticeable effects on the performance of the CoNetrix VPNs.  Without doing much research into it, I made the assumption that it was probably opening VPN-related ports.  However, on my last audit, I was working with a virtual system on my laptop that we use often at banks, but I had never needed to turn on at a hotel.  I had some IP address problems with the virtual machine and, during the troubleshooting process, discovered my laptop had been given a public IP address by the hotel’s wireless Internet connection. 

After some tests, I verified that it was a real public IP address that was directly accessible by anyone on the Internet.  A coworker was on the audit with me, so we checked his IP config, but he had a private IP address.  Checking the “advanced VPN user” option on the hotel’s website had assigned me a public IP address, presumably to avoid any NAT issues that might foul up a VPN connection. [more]

The experience was a good reminder to me to make sure my laptop security is up to date whenever I use a public network.  We don’t always know how public connections are configured or who else is connected.  At any hotel, our laptops and network traffic are exposed to any system connected to the hotel’s local LAN.  However, at least in this one case, my laptop was also directly exposed to the entire Internet.  In either case, a strong firewall policy (block all inbound connections, make sure the network connection is designated as “Public” and not “Private” or “Domain”) and a fully patched system are very important.