krstfvndm
/
blog
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
2 Commits
1 Branch
0 Tags
464 KiB
 
 
 
Tree: a81c619b3f
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'a81c619b3f'
${ noResults }
blog/public/administration/windows_troubleshooting/index.html

436 lines
14 KiB
Raw Blame History

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en-us">
<head>
<title>
Windows troubleshooting // Hagfi.sh
</title>
<link href="http://gmpg.org/xfn/11" rel="profile">
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1">
<meta name="description" content="">
<meta name="keywords" content="">
<meta name="author" content="Olivier De Ram">
<meta name="generator" content="Hugo 0.92.0" />
<meta property="og:title" content="Windows troubleshooting" />
<meta property="og:description" content="" />
<meta property="og:type" content="website" />
<meta property="og:locale" content="en_US" />
<meta property="og:url" content="https://blog.hagfi.sh/administration/windows_troubleshooting/" />
<link rel="stylesheet" href="//cdnjs.cloudflare.com/ajax/libs/pure/0.5.0/base-min.css">
<link rel="stylesheet" href="//cdnjs.cloudflare.com/ajax/libs/pure/0.5.0/pure-min.css">
<link rel="stylesheet" href="//cdnjs.cloudflare.com/ajax/libs/pure/0.5.0/grids-responsive-min.css">
<link rel="stylesheet" href="https://blog.hagfi.sh//css/redlounge.css">
<link rel="stylesheet" href="https://blog.hagfi.sh//css/prism.css">
<link href="//maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css" rel="stylesheet">
<link href='//fonts.googleapis.com/css?family=Raleway:400,200,100,700,300,500,600,800' rel='stylesheet' type='text/css'>
<link href='//fonts.googleapis.com/css?family=Libre+Baskerville:400,700,400italic' rel='stylesheet' type='text/css'>
<link rel="apple-touch-icon-precomposed" sizes="144x144" href="/touch-icon-144-precomposed.png">
<link rel="shortcut icon" type="image/x-icon" href="/img/favicon.png">
<link href="" rel="alternate" type="application/rss+xml" title="Hagfi.sh" />
<script src="//cdnjs.cloudflare.com/ajax/libs/moment.js/2.18.1/moment.js"></script>
<script src="//cdnjs.cloudflare.com/ajax/libs/vue/2.5.17/vue.min.js"></script>
<script src="//cdnjs.cloudflare.com/ajax/libs/axios/0.18.0/axios.min.js"></script>
<script src="//cdnjs.cloudflare.com/ajax/libs/fuse.js/3.2.1/fuse.min.js"></script>
<script src="//cdn.jsdelivr.net/npm/vuewordcloud@18.7.11/VueWordCloud.js"></script>
<script src="https://blog.hagfi.sh//js/prism.js"></script>
<script type="application/javascript">
var doNotTrack = false;
if (!doNotTrack) {
(function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
(i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
})(window,document,'script','https://www.google-analytics.com/analytics.js','ga');
ga('create', 'UA-124890410-1', 'auto');
ga('send', 'pageview');
}
</script>
</head>
<body>
<div id="layout" class="pure-g">
<div class="sidebar pure-u-1 pure-u-md-1-4" id="app">
<div class="header">
<h1 class="brand-title"><a href="/">Hagfi.sh</a></h1>
<h2 class="brand-tagline">A devops guide to the galaxy</h2>
<div class="counters">
<a class="counter" href="/">13
<div class="counter-sub">Documents</div>
</a>
<a class="counter" href="/tags">29
<div class="counter-sub">Tags</div>
</a>
<a class="counter" href="/categories">3
<div class="counter-sub">Categories</div>
</a>
</div>
<nav class="nav">
</nav>
<div class="search-wrapper">
<input
type="text"
placeholder="Search ..."
v-model="search"
@keydown.down.prevent="navigate(1)"
@keydown.up.prevent="navigate(-1)"
@keyup.enter.prevent="navigate(result[selected].href)"
ref="searchInput"
class="search"
/>
<svg height="100" width="100" ref="resultPoint" class="result-point">
<circle cx="5" cy="5" r="5" fill="#FFF" />
</svg>
<ul class="result-items">
<li v-for="r, i of result" class="result-item" ref="resultItem">
<div class="result-item-wrapper" :class="{ 'result-item-selected': selected === i }">
<div class="result-item-left">
<span class="post-date">
<span class="post-date-day"><sup v-text="moment(r.date).format('D')"></sup></span><span class="post-date-separator" v-text="'/'"></span><span class="post-date-month" v-text="moment(r.date).format('MMM')"></span> <span class="post-date-year" v-text="moment(r.date).format('YYYY')"></span>
</span>
<template v-if="r.author">By <a class="post-author" v-text="r.author"></a></template>
</div>
<div class="result-item-left">
<span class="result-item-separator nav-item-separator" v-text="'//'"></span><a :href="r.href" v-text="r.title" class="result-item-link"></a>
</div>
</div>
</li>
</ul>
</div>
</div>
</div>
<div class="content pure-u-1 pure-u-md-3-4">
<a name="top"></a>
<div id="toc" class="pure-u-1 pure-u-md-1-4">
<small class="toc-label">Contents</small>
<nav id="TableOfContents">
<ul>
<li><a href="#windows-troubleshooting">Windows troubleshooting</a>
<ul>
<li><a href="#eventviewer"><em>EventViewer</em></a></li>
<li><a href="#powershell"><em>PowerShell</em></a></li>
<li><a href="#task-viewer"><em>Task Viewer</em></a></li>
<li><a href="#resource-monitor"><em>Resource monitor</em></a></li>
<li><a href="#netstat"><em>Netstat</em></a></li>
<li><a href="#chocolate"><em>Chocolate</em></a></li>
<li><a href="#usefull-programs"><em>Usefull programs</em></a></li>
<li><a href="#eventids"><em>EventID&rsquo;s</em></a></li>
<li><a href="#powershell-1"><em>PowerShell</em></a></li>
</ul>
</li>
</ul>
</nav>
</div>
<section class="post">
<h1 class="post-title">
<a href="/administration/windows_troubleshooting/">Windows troubleshooting</a>
</h1>
<h3 class="post-subtitle">
</h3>
<span class="post-date">
<span class="post-date-day"><sup>25</sup></span><span class="post-date-separator">/</span><span class="post-date-month">Aug</span> <span class="post-date-year">2018</span>
</span>
<span class="post-author-single">By <a class="post-author" target="">Olivier De Ram</a></span>
<h2 id="windows-troubleshooting">Windows troubleshooting</h2>
<p>VRAGEN:</p>
<ul>
<li>openen vanuit ticketing, wachtwoord en gebruiker</li>
<li>custom even viewer view?</li>
<li>test server?</li>
</ul>
<h3 id="eventviewer"><em>EventViewer</em></h3>
<p>run: eventvwr</p>
<ul>
<li>custom views</li>
<li>windows
<ul>
<li>application (non windows standard, puppet, vmware, mssql, &hellip;)</li>
<li>security, aan en afmelden</li>
<li>set-up: updates en installatie verwijderen programma&rsquo;s</li>
<li>system: OS meldingen</li>
</ul>
</li>
<li>application and services: diep graven</li>
</ul>
<p>&ndash;&gt; Filter Log:</p>
<ul>
<li>logged (date range)</li>
<li>event level</li>
<li>event source</li>
<li>event ID: 99,-1024,-4634</li>
</ul>
<p>rechtsonderaan &gt; event copy &gt; copy as text</p>
<h3 id="powershell"><em>PowerShell</em></h3>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-PowerShell" data-lang="PowerShell">$first =
$last =
get-eventlog -Logname system -
</code></pre></div><div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-PowerShell" data-lang="PowerShell"> `get-winevent -LogName <span style="color:#e6db74">&#39;Microsoft-Windows-TaskScheduler/Operational&#39;</span> | Where-Object { $_.Message <span style="color:#f92672">-like</span> <span style="color:#960050;background-color:#1e0010">‘</span>*insta* }`
</code></pre></div><h3 id="task-viewer"><em>Task Viewer</em></h3>
<ul>
<li>tasks</li>
<li>users</li>
<li>performance (indien gecrasht, bevestigen anders is het netwerk)</li>
</ul>
<h3 id="resource-monitor"><em>Resource monitor</em></h3>
<p>(task manager &gt; performance &gt; open resouce monitor)</p>
<p>Overview &gt; CPU (ovenste tab) app aanvinken &ndash;&gt; filtert alles</p>
<h3 id="netstat"><em>Netstat</em></h3>
<p><code>netstat -abo &gt; C:\temp\log.txt</code></p>
<h3 id="chocolate"><em>Chocolate</em></h3>
<p>C:\ProgramData\chocolatey\bin\Procmon.exe
&ndash;&gt; selecteer lijn+kolom &gt; exclude &lsquo;name&rsquo; (=grep -v) / include &lsquo;name&rsquo; (=grep)</p>
<h3 id="usefull-programs"><em>Usefull programs</em></h3>
<ul>
<li>TreeView</li>
<li>VBluescreenviewer</li>
<li>Sysinternals</li>
<li>Zabbix</li>
<li>VMware events</li>
<li>BareTail</li>
<li>choco install</li>
<li>choco list -lo (view choco installed programs)</li>
<li>telnet 12.34.56.78 900</li>
<li>powershell: <code>stop service 'name'</code></li>
</ul>
<h3 id="eventids"><em>EventID&rsquo;s</em></h3>
<ul>
<li>
<p>Event ID 6005: “The event log service was started.” This is synonymous to system startup.</p>
</li>
<li>
<p>Event ID 6006: “The event log service was stopped.” This is synonymous to system shutdown.</p>
</li>
<li>
<p>Event ID 6008: &ldquo;The previous system shutdown was unexpected.&rdquo; Records that the system started after it was not shut down properly.</p>
</li>
<li>
<p>Event ID 6009: Indicates the Windows product name, version, build number, service pack number, and operating system type detected at boot time.</p>
</li>
<li>
<p>Event ID 6013: Displays the uptime of the computer. There is no TechNet page for this id.
Add to that a couple more from the Server Fault answers listed in my OP:</p>
</li>
<li>
<p>Event ID 1074: &ldquo;The process X has initiated the restart / shutdown of computer on behalf of user Y for the following reason: Z.&rdquo; Indicates that an application or a user initiated a restart or shutdown.</p>
</li>
<li>
<p>Event ID 1076: &ldquo;The reason supplied by user X for the last unexpected shutdown of this computer is: Y.&rdquo; Records when the first user with shutdown privileges logs on to the computer after an unexpected restart or shutdown and supplies a reason for the occurrence.</p>
</li>
</ul>
<h3 id="powershell-1"><em>PowerShell</em></h3>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-PowerShell" data-lang="PowerShell">$filter = <span style="color:#e6db74">&#34;*abbix*&#34;</span>
get-winevent -logname <span style="color:#e6db74">&#39;Application&#39;</span> | Where-Object { $_.Message <span style="color:#f92672">-like</span> $filter }
</code></pre></div>
<div class="paging">
<span class="paging-label">More Reading</span>
<div class="paging-newer">
<span class="dark-red">Newer</span><span class="decorative-marker">//</span>
<a class="paging-link" href="/administration/luks-encryption/">Luks Encryption</a>
</div>
<div class="paging-older">
<span class="dark-red">Older</span><span class="decorative-marker">//</span>
<a class="paging-link" href="/administration/mysql_tuner/">MySQL Tuner</a>
</div>
</div>
</section>
<div id="disqus_thread"></div>
<script type="application/javascript">
var disqus_config = function () {
};
(function() {
if (["localhost", "127.0.0.1"].indexOf(window.location.hostname) != -1) {
document.getElementById('disqus_thread').innerHTML = 'Disqus comments not available by default when the website is previewed locally.';
return;
}
var d = document, s = d.createElement('script'); s.async = true;
s.src = '//' + "hagfish" + '.disqus.com/embed.js';
s.setAttribute('data-timestamp', +new Date());
(d.head || d.body).appendChild(s);
})();
</script>
<noscript>Please enable JavaScript to view the <a href="https://disqus.com/?ref_noscript">comments powered by Disqus.</a></noscript>
<a href="https://disqus.com" class="dsq-brlink">comments powered by <span class="logo-disqus">Disqus</span></a>
<div class="footer">
<hr class="thin" />
<div class="pure-menu pure-menu-horizontal pure-menu-open">
<ul class="footer-menu">
</ul>
</div>
<p>&copy; 2022. All rights reserved.</p>
</div>
</div>
</div>
<script>
var app = new Vue({
el: '#app',
data: {
fuse: null,
search: "",
result: [],
index: [],
selected: 0
},
mounted() {
let self = this
window.addEventListener("keypress", function(e) {
self.$refs.searchInput.focus()
})
let options = {
shouldSort: true,
threshold: 0.6,
location: 0,
distance: 100,
maxPatternLength: 32,
minMatchCharLength: 1,
keys: [
"title",
"author",
"date",
"content"
]
}
axios.get('/index.json')
.then(function (response) {
self.index = response.data
self.fuse = new Fuse(response.data, options)
})
.catch(function (error) {
})
},
watch: {
result(nval, oval) {
nval.length > 0 ? this.pointer(0) : this.pointer(-1)
},
search(nval, oval) {
this.result = this.fuse.search(nval)
}
},
methods: {
navigate(val) {
switch (val) {
case 1: if (this.selected < this.result.length - 1) { this.selected++ }; break;
case -1: if (this.selected > 0 ) { this.selected-- }; break;
default: window.location.href = val; break;
}
this.pointer(this.selected)
},
pointer(selected) {
let self = this
if (selected >= 0) {
Vue.nextTick().then(function() {
let height = self.$refs.resultItem[selected].clientHeight
let top = self.$refs.resultItem[selected].getBoundingClientRect().top
let left = self.$refs.resultItem[selected].getBoundingClientRect().left
self.$refs.resultPoint.style.top = (top+height/2)+'px'
self.$refs.resultPoint.style.left = (left-20)+'px'
})
} else {
this.$refs.resultPoint.style.left = '-50px'
return
}
}
}
})
</script>
</body>
</html>