?

Log in

No account? Create an account

Windows problems - John C. Kirk

Sep. 16th, 2005

09:11 pm - Windows problems

Previous Entry Share Next Entry

Like rjw1, I'm spending an exciting Friday night in the office. In my case, I've been fixing a Windows 2000 PC that's been running extremely slowly for the past few days. I've got that problem solved now (I'm just sticking around to do general maintenance on it), and I thought it was worth documenting here, in case anyone else encounters it.

Problem:
PC running Windows 2000 Pro with SP4 is extremely slow.

Symptoms:
services.exe taking 99% or 100% of CPU time.
Can't run Event Viewer.
In Admin Tools | Services, the "Event Log" service says "Starting".

Cause:
One or more of the event viewer log files was corrupt, so the service couldn't start, and therefore the application couldn't run. But the service didn't fail either, it just kept retrying, which meant that it was tying up the whole CPU.

Solution:
Change the startup type of that service to "Manual", then reboot the computer. After rebooting, delete *.evt from
C:\WinNT\system32\config
(or just move them to a spare folder), and start the service manually. If this works (which it did in this case), it will recreate the three files, and then you should change the service's startup type back to "Automatic".

Further info:
In this case, two of the three files had a size of 512kb. When the service had restarted, I ran Event Viewer, and looked at the properties for each of the logs. They all had a maximum size of 512kb, and they were also configured to overwrite events after 7 days. I've changed this setting to be "Override events as needed". My theory is that the files got corrupted because Windows tried to add new events, but it had run out of space, and it couldn't delete the old entries because they were less than 7 days old. Normally this would just give an error message on the screen, but I think it's best to avoid this configuration in general (I really don't know why Microsoft made this the default). So, if you're working on any other machines, take a minute to change this setting over.

Any comments along the lines of "That's because Micro$oft sux! You should be using Linux instead!" will be met with a cheery wave, and a cry of "Take it to slashdot, monkey boy"...

Tags: ,

Comments:

[User Picture]
From:bazzalisk
Date:September 16th, 2005 10:03 pm (UTC)
(Link)
Guess I'll take it to slashdot then ;)

No seriously, is there a particular reason why the company chooses to use windows?
(Reply) (Thread)
[User Picture]
From:johnckirk
Date:September 16th, 2005 10:25 pm (UTC)
(Link)
Hmm, I'm now skirting the edges of client confidentiality, but I think I'm ok with my answer here.

Actually, there's a mixture of platforms here - mostly Windows PCs, but there are also a couple of Macs and some Unix machines. I don't know why they originally went for Windows, but at this point it makes sense to continue with it, for two main reasons:

a) Even if there are equivalents for Windows/Office/etc., there are also some custom applications run here. I wouldn't want to trust them to an emulator, and it would be a long/expensive job to port them to a different platform. Also, all the software that we do use has to be validated by the Quality department, so that would delay any big shifts.

b) Staff training. As well as the end users, there's the IT staff, and we all have a background in Windows. For instance, I can look at a problem and say "Ah yes, error 2140 from the Exchange IMC service - I had to deal with that on my home server about 5 years ago, so I've got a pretty good idea of what's causing it". I know the basics of Unix, but I'm nowhere near qualified to support an entire network. So, it's partly a case that I don't want to get myself fired, but it's also that I don't know enough about Unix to advocate a switch to it, whereas I can say "These are the advantages of Windows XP over NT4, and I think that the benefits outweigh the cost of the upgrade".

Having said all that, I've moved the company over to Microsoft's "Open Subscription" volume licencing plan, which basically means that we rent the software rather than buying it outright. So, this does mean that in three years time (when it comes up for renewal) we can re-evaluate this decision, and consider alternate platforms.
(Reply) (Parent) (Thread)
[User Picture]
From:bazzalisk
Date:September 16th, 2005 10:43 pm (UTC)
(Link)
Makes perfect sense. Corporate inertia is certainly a wonderful thing for manufactureres who can gain a dominant place early.
(Reply) (Parent) (Thread)