If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below. |
|
|
Thread Tools | Display Modes |
#1
|
|||
|
|||
Escaping system lockups by using Process Explorer
Once in awhile an errant app can lock up the system, and I've at least found
one way out of this predicament (short of unplugging the computer), by using "Process Explorer". (I'm talking about cases where "End Task" fails to do anything, and ditto on using Ctrl-Alt-Del). You can select "services.exe" in Procees Explorer, and then use "Kill Process". This forces a reboot in 60 seconds ("system will shutdown in 60 seconds...". (Sometimes selecting "svchost.exe" instead will do it, but it seems killing "services.exe" is better, since it seems to be the main root of the tree (encompassing the various instances of svchost). Is there any other way (or some even simpler app) others have used to get out of a system lockup (short of pulling the plug)? It would be nice having a simpler way for those rare cases of system freezes due to some errant program. Again, this is for those extreme cases where Task Manager is unable to do it (by selecting End Task or Reboot or whatever in there). |
Ads |
#2
|
|||
|
|||
Escaping system lockups by using Process Explorer
On Dec 25, 5:14*pm, "Bill in Co"
wrote: Once in awhile an errant app can lock up the system, and I've at least found one way out of this predicament (short of unplugging the computer), by using "Process Explorer". * (I'm talking about cases where "End Task" fails to do anything, and ditto on using Ctrl-Alt-Del). You can select "services.exe" in Procees Explorer, and then use "Kill Process". * This forces a reboot in 60 seconds ("system will shutdown in 60 seconds...". * (Sometimes selecting "svchost.exe" instead will do it, but it seems killing "services.exe" is better, since it seems to be the main root of the tree (encompassing the various instances of svchost). Is there any other way (or some even simpler app) others have used to get out of a system lockup (short of pulling the plug)? * It would be nice having a simpler way for those rare cases of system freezes due to some errant program. *Again, this is for those extreme cases where Task Manager is unable to do it (by selecting End Task or Reboot or whatever in there).. I condensed one small piece of a Mark Russinovich webinar on troubleshooting performance issues and system lockups into the following process. Since Mark is one of (or maybe the sole) MS developers of such things as Process Explorer, this gives him some credibility regarding how to effectively troubleshoot malfunctioning Windows based systems. Here are my standard copy/paste instructions for how do figure out what is going on when a system hangs or stops responding: If your system stops responding, hangs or freezes and you can't figure out why, you can force a Blue Screen of Death (BSOD) which will create a crash dump file that you can analyze and see what is running at the point of the freeze and get some ideas that do not involve guesswork. While it may seem odd to think about purposely causing a Blue Screen Of Death (BSOD), Microsoft includes such a provision in Windows XP. The feature is built in to XP specifically to diagnose the problem when a system hangs, freezes or stops responding. This will eliminate trying things or guessing about what might be happening maybe. You will know what is happening. When the system hangs, there will often not be any indication or clues in the Event Viewer logs, but feel free to look and see if there are any significant event around the time of the failure. Here's how to force your system to create a BSOD: First make sure your system is not set to automatically restart on a system failure and is set up to create a crash dump file when a Blue Screen of Death (BSOD) occurs. Right click My Computer, Properties, Advanced, Startup and Recovery, Settings. In the System failure section: Put a check mark in the "Write an event to the system log" box Put a check mark in the "Send an administrative alert" box Uncheck the "Automatically restart" box In the Write debugging information section, choose: Small memory dump (64 KB) Set the Small dump directory to: %SystemRoot%\Minidump Click OK twice to save the settings. Now enable the XP feature to generate a crash dump on demand. Before making registry changes, backup your registry with this popular free and easy to use tool: http://www.snapfiles.com/get/erunt.html For PS/2 keyboards, launch the Registry Editor (Start, Run, regedit.exe) and navigate to: HKLM\System\CurrentControlSet\Services\i8042prt\Pa rameters For USB keyboards, launch the registry editor (Start, Run, regedit.exe) and navigate to: HKLM\System\CurrentControlSet\Services\kbdhid\Para meters Click Edit, select New DWORD Value and name the new value: CrashOnCtrlScroll Double-click the CrashOnCtrlScroll DWORD Value, type 1 in the Value Data text box to enable the feature, and click OK. Close the Registry Editor and restart Windows XP for the changes to take effect. When you want to cause a BSOD (when your system has stopped responding), press and hold down the [Ctrl] key on the right side of your keyboard, and then tap the [ScrollLock] key twice. Now you should see the BSOD and you will have a crash dump file to analyze. You may not see the information about your problem on the BSOD screen, but you will find the answer in the crash dump file. You may need help interpreting your crash dump file if you have never seen one before. You can read about the feature he http://msdn.microsoft.com/en-us/library/ff545499.aspx There is no harm in leaving the feature enabled (mine is always on), but if you are compelled to remove it, just undo the change you made in the registry. Launch the Registry Editor (Start, Run, regedit.exe) and navigate to: HKLM\System\CurrentControlSet\Services\i8042prt\Pa rameters or HKLM\System\CurrentControlSet\Services\kbdhid\Para meters Select the CrashOnCtrlScroll value, click the Edit menu, and select the Delete command. Close the Registry Editor and restart Windows XP. Go ahead and test the new manual crash dump on demand feature to be sure it works as expected, then wait for the system to hang again. When you have some crash dump files accumulated, you can learn how to figure out what is going on with the system when it is hung or not responding and then you can decide what needs to be done to fix it. |
#3
|
|||
|
|||
Escaping system lockups by using Process Explorer
Jose wrote:
On Dec 25, 5:14 pm, "Bill in Co" wrote: Once in awhile an errant app can lock up the system, and I've at least found one way out of this predicament (short of unplugging the computer), by using "Process Explorer". (I'm talking about cases where "End Task" fails to do anything, and ditto on using Ctrl-Alt-Del). You can select "services.exe" in Procees Explorer, and then use "Kill Process". This forces a reboot in 60 seconds ("system will shutdown in 60 seconds...". (Sometimes selecting "svchost.exe" instead will do it, but it seems killing "services.exe" is better, since it seems to be the main root of the tree (encompassing the various instances of svchost). Is there any other way (or some even simpler app) others have used to get out of a system lockup (short of pulling the plug)? It would be nice having a simpler way for those rare cases of system freezes due to some errant program. Again, this is for those extreme cases where Task Manager is unable to do it (by selecting End Task or Reboot or whatever in there). I condensed one small piece of a Mark Russinovich webinar on troubleshooting performance issues and system lockups into the following process. Since Mark is one of (or maybe the sole) MS developers of such things as Process Explorer, this gives him some credibility regarding how to effectively troubleshoot malfunctioning Windows based systems. Here are my standard copy/paste instructions for how do figure out what is going on when a system hangs or stops responding: If your system stops responding, hangs or freezes and you can't figure out why, you can force a Blue Screen of Death (BSOD) which will create a crash dump file that you can analyze and see what is running at the point of the freeze and get some ideas that do not involve guesswork. While it may seem odd to think about purposely causing a Blue Screen Of Death (BSOD), Microsoft includes such a provision in Windows XP. The feature is built in to XP specifically to diagnose the problem when a system hangs, freezes or stops responding. This will eliminate trying things or guessing about what might be happening maybe. You will know what is happening. When the system hangs, there will often not be any indication or clues in the Event Viewer logs, but feel free to look and see if there are any significant event around the time of the failure. Here's how to force your system to create a BSOD: First make sure your system is not set to automatically restart on a system failure and is set up to create a crash dump file when a Blue Screen of Death (BSOD) occurs. Right click My Computer, Properties, Advanced, Startup and Recovery, Settings. In the System failure section: Put a check mark in the "Write an event to the system log" box Put a check mark in the "Send an administrative alert" box Uncheck the "Automatically restart" box In the Write debugging information section, choose: Small memory dump (64 KB) Set the Small dump directory to: %SystemRoot%\Minidump Click OK twice to save the settings. Now enable the XP feature to generate a crash dump on demand. Before making registry changes, backup your registry with this popular free and easy to use tool: http://www.snapfiles.com/get/erunt.html For PS/2 keyboards, launch the Registry Editor (Start, Run, regedit.exe) and navigate to: HKLM\System\CurrentControlSet\Services\i8042prt\Pa rameters For USB keyboards, launch the registry editor (Start, Run, regedit.exe) and navigate to: HKLM\System\CurrentControlSet\Services\kbdhid\Para meters Click Edit, select New DWORD Value and name the new value: CrashOnCtrlScroll Double-click the CrashOnCtrlScroll DWORD Value, type 1 in the Value Data text box to enable the feature, and click OK. Close the Registry Editor and restart Windows XP for the changes to take effect. When you want to cause a BSOD (when your system has stopped responding), press and hold down the [Ctrl] key on the right side of your keyboard, and then tap the [ScrollLock] key twice. Now you should see the BSOD and you will have a crash dump file to analyze. You may not see the information about your problem on the BSOD screen, but you will find the answer in the crash dump file. You may need help interpreting your crash dump file if you have never seen one before. You can read about the feature he http://msdn.microsoft.com/en-us/library/ff545499.aspx There is no harm in leaving the feature enabled (mine is always on), but if you are compelled to remove it, just undo the change you made in the registry. Launch the Registry Editor (Start, Run, regedit.exe) and navigate to: HKLM\System\CurrentControlSet\Services\i8042prt\Pa rameters or HKLM\System\CurrentControlSet\Services\kbdhid\Para meters Select the CrashOnCtrlScroll value, click the Edit menu, and select the Delete command. Close the Registry Editor and restart Windows XP. Go ahead and test the new manual crash dump on demand feature to be sure it works as expected, then wait for the system to hang again. When you have some crash dump files accumulated, you can learn how to figure out what is going on with the system when it is hung or not responding and then you can decide what needs to be done to fix it. Thanks for the info, Jose. I've looked before at some of the crash dumps in the past (for another problem), and it wasn't all that easy to debug, to put it mildly. But in this particular case, I'm not so much interested in the why's as much as having an easy way out. Process Explorer and killing "services.exe" works in these rare cases, but I was just thinking there might be even a simpler app that's just dedicated to getting the same end result. You know, like someone could have made an app (analogous to End Task) that could actually work when Task Manager can't. (It must be possible, since killing "services.exe" in Process Explorer DOES work in these rare cases, and bringing up Process Explorer seems a bit overkill for just doing that). |
#4
|
|||
|
|||
Escaping system lockups by using Process Explorer
"Bill in Co" wrote in message
... Once in awhile an errant app can lock up the system, and I've at least found one way out of this predicament (short of unplugging the computer), by using "Process Explorer". (I'm talking about cases where "End Task" fails to do anything, and ditto on using Ctrl-Alt-Del). You can select "services.exe" in Procees Explorer, and then use "Kill Process". This forces a reboot in 60 seconds ("system will shutdown in 60 seconds...". (Sometimes selecting "svchost.exe" instead will do it, but it seems killing "services.exe" is better, since it seems to be the main root of the tree (encompassing the various instances of svchost). Is there any other way (or some even simpler app) others have used to get out of a system lockup (short of pulling the plug)? It would be nice having a simpler way for those rare cases of system freezes due to some errant program. Again, this is for those extreme cases where Task Manager is unable to do it (by selecting End Task or Reboot or whatever in there). Bill, Maybe the following would work to your satisfaction. It requires the ability to start Task Manager when your system is "locked". You can start Task Manager by right-clicking on the taskbar or pressing Ctrl-Shift-Esc . From the 'Processes' tab in Task Manager, select 'explorer.exe' -- End Process. Your desktop will disappear when you do this but Task Manager should still be present. Then (still in Task Manager), click File -- New Task (Run) and type "explorer.exe" (without the quotes) -- OK. If you happen to lose Task Manager after ending explorer.exe, then click 'Start' -- Run -- "explorer.exe" -- OK. I don't have Process Explorer installed on the computer I am using at the moment but there is likely a similar way to do it using Process Explorer. Cheers, MB |
#5
|
|||
|
|||
Escaping system lockups by using Process Explorer
On Dec 25, 7:03*pm, "Bill in Co"
wrote: Jose wrote: On Dec 25, 5:14 pm, "Bill in Co" wrote: Once in awhile an errant app can lock up the system, and I've at least found one way out of this predicament (short of unplugging the computer), by using "Process Explorer". (I'm talking about cases where "End Task" fails to do anything, and ditto on using Ctrl-Alt-Del). You can select "services.exe" in Procees Explorer, and then use "Kill Process". This forces a reboot in 60 seconds ("system will shutdown in 60 seconds...". (Sometimes selecting "svchost.exe" instead will do it, but it seems killing "services.exe" is better, since it seems to be the main root of the tree (encompassing the various instances of svchost). Is there any other way (or some even simpler app) others have used to get out of a system lockup (short of pulling the plug)? It would be nice having a simpler way for those rare cases of system freezes due to some errant program. Again, this is for those extreme cases where Task Manager is unable to do it (by selecting End Task or Reboot or whatever in there). I condensed one small piece of a Mark Russinovich webinar on troubleshooting performance issues and system lockups into the following process. Since Mark is one of (or maybe the sole) MS developers of such things as Process Explorer, this gives him some credibility regarding how to effectively troubleshoot malfunctioning Windows based systems. Here are my standard copy/paste instructions for how do figure out what is going on when a system hangs or stops responding: If your system stops responding, hangs or freezes and you can't figure out why, you can force a Blue Screen of Death (BSOD) which will create a crash dump file that you can analyze and see what is running at the point of the freeze and get some ideas that do not involve guesswork. While it may seem odd to think about purposely causing a Blue Screen Of Death (BSOD), Microsoft includes such a provision in Windows XP. The feature is built in to XP specifically to diagnose the problem when a system hangs, freezes or stops responding. This will eliminate trying things or guessing about what might be happening maybe. *You will know what is happening. When the system hangs, there will often not be any indication or clues in the Event Viewer logs, but feel free to look and see if there are any significant event around the time of the failure. Here's how to force your system to create a BSOD: First make sure your system is not set to automatically restart on a system failure and is set up to create a crash dump file when a Blue Screen of Death (BSOD) occurs. Right click My Computer, Properties, Advanced, Startup and Recovery, Settings. In the System failure section: Put a check mark in the "Write an event to the system log" box Put a check mark in the "Send an administrative alert" box Uncheck the "Automatically restart" box In the Write debugging information section, choose: Small memory dump (64 KB) Set the Small dump directory to: %SystemRoot%\Minidump Click OK twice to save the settings. Now enable the XP feature to generate a crash dump on demand. Before making registry changes, backup your registry with this popular free and easy to use tool: http://www.snapfiles.com/get/erunt.html For PS/2 keyboards, launch the Registry Editor (Start, Run, regedit.exe) and navigate to: HKLM\System\CurrentControlSet\Services\i8042prt\Pa rameters For USB keyboards, launch the registry editor (Start, Run, regedit.exe) and navigate to: HKLM\System\CurrentControlSet\Services\kbdhid\Para meters Click Edit, select New DWORD Value and name the new value: CrashOnCtrlScroll Double-click the CrashOnCtrlScroll DWORD Value, type 1 in the Value Data text box to enable the feature, and click OK. Close the Registry Editor and restart Windows XP for the changes to take effect. When you want to cause a BSOD (when your system has stopped responding), press and hold down the [Ctrl] key on the right side of your keyboard, and then tap the [ScrollLock] key twice. Now you should see the BSOD and you will have a crash dump file to analyze. You may not see the information about your problem on the BSOD screen, but you will find the answer in the crash dump file. *You may need help interpreting your crash dump file if you have never seen one before. You can read about the feature he http://msdn.microsoft.com/en-us/library/ff545499.aspx There is no harm in leaving the feature enabled (mine is always on), but if you are compelled to remove it, just undo the change you made in the registry. Launch the Registry Editor (Start, Run, regedit.exe) and navigate to: HKLM\System\CurrentControlSet\Services\i8042prt\Pa rameters or HKLM\System\CurrentControlSet\Services\kbdhid\Para meters Select the CrashOnCtrlScroll value, click the Edit menu, and select the Delete command. Close the Registry Editor and restart Windows XP. Go ahead and test the new manual crash dump on demand feature to be sure it works as expected, then wait for the system to hang again. When you have some crash dump files accumulated, you can learn how to figure out what is going on with the system when it is hung or not responding and then you can decide what needs to be done to fix it. Thanks for the info, Jose. * I've looked before at some of the crash dumps in the past (for another problem), and it wasn't all that easy to debug, to put it mildly. But in this particular case, I'm not so much interested in the why's as much as having an easy way out. * Process Explorer and killing "services.exe" works in these rare cases, but I was just thinking there might be even a simpler app that's just dedicated to getting the same end result. You know, like someone could have made an app (analogous to End Task) that could actually work when Task Manager can't. *(It must be possible, since killing "services.exe" in Process Explorer DOES work in these rare cases, and bringing up Process Explorer seems a bit overkill for just doing that). It takes a little practice and some set up. There are tools like BlueScreenView to help with the unexpected BSODs, but the manually initiated one will always show the same cause (manually initiated), but then using the MS tools, you can see what is loaded into memory at the time and see what else is in memory at the time. You can easily spot a video, sound or network driver for example. It is really very interesting if you like figuring these things out. The MS tools are sometimes intimidating until you get the hang of things by actually doing a few. I usually just get folks to email me the recent forced crash dumps generated when their system is locked up and and look at them myself. I'll see if I can find the link to the webinar from Mark and post it up... |
#6
|
|||
|
|||
Escaping system lockups by using Process Explorer
Jose wrote:
On Dec 25, 5:14 pm, "Bill in Co" wrote: Once in awhile an errant app can lock up the system, and I've at least found one way out of this predicament (short of unplugging the computer), by using "Process Explorer". (I'm talking about cases where "End Task" fails to do anything, and ditto on using Ctrl-Alt-Del). You can select "services.exe" in Procees Explorer, and then use "Kill Process". This forces a reboot in 60 seconds ("system will shutdown in 60 seconds...". (Sometimes selecting "svchost.exe" instead will do it, but it seems killing "services.exe" is better, since it seems to be the main root of the tree (encompassing the various instances of svchost). Is there any other way (or some even simpler app) others have used to get out of a system lockup (short of pulling the plug)? It would be nice having a simpler way for those rare cases of system freezes due to some errant program. Again, this is for those extreme cases where Task Manager is unable to do it (by selecting End Task or Reboot or whatever in there). I condensed one small piece of a Mark Russinovich webinar on troubleshooting performance issues and system lockups into the following process. Since Mark is one of (or maybe the sole) MS developers of such things as Process Explorer, this gives him some credibility regarding how to effectively troubleshoot malfunctioning Windows based systems. Here are my standard copy/paste instructions for how do figure out what is going on when a system hangs or stops responding: If your system stops responding, hangs or freezes and you can't figure out why, you can force a Blue Screen of Death (BSOD) which will create a crash dump file that you can analyze and see what is running at the point of the freeze and get some ideas that do not involve guesswork. While it may seem odd to think about purposely causing a Blue Screen Of Death (BSOD), Microsoft includes such a provision in Windows XP. The feature is built in to XP specifically to diagnose the problem when a system hangs, freezes or stops responding. This will eliminate trying things or guessing about what might be happening maybe. You will know what is happening. When the system hangs, there will often not be any indication or clues in the Event Viewer logs, but feel free to look and see if there are any significant event around the time of the failure. Here's how to force your system to create a BSOD: First make sure your system is not set to automatically restart on a system failure and is set up to create a crash dump file when a Blue Screen of Death (BSOD) occurs. Right click My Computer, Properties, Advanced, Startup and Recovery, Settings. In the System failure section: Put a check mark in the "Write an event to the system log" box Put a check mark in the "Send an administrative alert" box Uncheck the "Automatically restart" box In the Write debugging information section, choose: Small memory dump (64 KB) Set the Small dump directory to: %SystemRoot%\Minidump Click OK twice to save the settings. Now enable the XP feature to generate a crash dump on demand. Before making registry changes, backup your registry with this popular free and easy to use tool: http://www.snapfiles.com/get/erunt.html For PS/2 keyboards, launch the Registry Editor (Start, Run, regedit.exe) and navigate to: HKLM\System\CurrentControlSet\Services\i8042prt\Pa rameters For USB keyboards, launch the registry editor (Start, Run, regedit.exe) and navigate to: HKLM\System\CurrentControlSet\Services\kbdhid\Para meters Click Edit, select New DWORD Value and name the new value: CrashOnCtrlScroll Double-click the CrashOnCtrlScroll DWORD Value, type 1 in the Value Data text box to enable the feature, and click OK. Close the Registry Editor and restart Windows XP for the changes to take effect. When you want to cause a BSOD (when your system has stopped responding), press and hold down the [Ctrl] key on the right side of your keyboard, and then tap the [ScrollLock] key twice. Now you should see the BSOD and you will have a crash dump file to analyze. You may not see the information about your problem on the BSOD screen, but you will find the answer in the crash dump file. You may need help interpreting your crash dump file if you have never seen one before. You can read about the feature he http://msdn.microsoft.com/en-us/library/ff545499.aspx There is no harm in leaving the feature enabled (mine is always on), but if you are compelled to remove it, just undo the change you made in the registry. Launch the Registry Editor (Start, Run, regedit.exe) and navigate to: HKLM\System\CurrentControlSet\Services\i8042prt\Pa rameters or HKLM\System\CurrentControlSet\Services\kbdhid\Para meters Select the CrashOnCtrlScroll value, click the Edit menu, and select the Delete command. Close the Registry Editor and restart Windows XP. Go ahead and test the new manual crash dump on demand feature to be sure it works as expected, then wait for the system to hang again. When you have some crash dump files accumulated, you can learn how to figure out what is going on with the system when it is hung or not responding and then you can decide what needs to be done to fix it. I did not know about the forced BSOD. Thank you for posting that; I can see where that would be very useful. -- SC Tom -There's no such thing as TMI when asking for tech support. |
Thread Tools | |
Display Modes | |
|
|