Articles Tagged “Bug Investigation”
35 articles tagged “Bug Investigation”, newest first.
-
Disk at 100%: What Do You Actually Have to Stop? — Telling SysMain, Windows Search, and Defender Apart
Isolate Windows 100% disk usage by throughput, response time, and files. Pause SysMain safely, narrow Windows Search, and analyze Defender without disabling it.
-
The Order of Name Resolution on Windows — hosts, the DNS Cache, LLMNR/mDNS, and DoH
Whether hosts, the DNS cache, the DNS server, or LLMNR/mDNS answered decides why some PCs fail. Learn the Windows name resolution order, what DoH changes, an...
-
Time Travel Debugging — Recording and Rewinding the Bugs That Never Reproduce in Long-Running Apps
A once-a-month bug leaves only its result in a crash dump. Record and rewind execution with WinDbg Time Travel Debugging (TTD): TTD.exe, ring buffers, and TT...
-
Apps That Break on Resume from Sleep — How Power Events Work and How to Build Business Apps That Survive Resume
Why business apps break after a laptop resumes from sleep: WM_POWERBROADCAST notifications, Modern Standby, reconnect design, sleep suppression, and powercfg.
-
DllMain and the Loader Lock — The Real Reason You Are Told to "Do Nothing in DLL Initialization"
Why DllMain must not call LoadLibrary or wait on threads: the loader lock serializes DLL notifications, typical deadlocks, deferred initialization, and hang ...
-
What "Not Responding" Really Is — How Windows Decides an App Has Hung, and How to Design Apps That Don't
Windows marks a window Not Responding after 5 seconds without message retrieval and shows a ghost window: the check, hang causes, UI-thread design, and inves...
-
Spurious Wakeups — Why a Condition Variable Wakes "Without a Notification" and How to Wait Correctly on Windows
Condition variable waits can wake with no notification (spurious wakeups). Why Windows allows it, and the correct while-and-predicate wait in Win32, C++, and...
-
WPR/WPA in Practice — A Primer on Investigating "the Whole PC Is Slow" Across the Entire System
Investigate a slow PC or slow startup that Task Manager cannot explain with an OS-wide ETW trace: capture with wpr.exe, then read CPU, waits, and disk I/O in...
-
OneDrive Files On-Demand and Business Apps — The Assumptions Placeholders Break and How to Fix Them
A desktop CSV will not open or an import fails with "file not found": OneDrive's KFM and Files On-Demand may be why. Covers placeholders, attribute checks, a...
-
Packet Capture on Windows in Practice — Choosing Among pktmon, netsh trace, and Wireshark
When the app log says only timeout, the packets on the wire tell more. Capture with built-in pktmon or netsh trace where Wireshark cannot be installed, and r...
-
Decoding Windows Error Codes — The Three-Layer Structure of Win32 Errors, HRESULT, and NTSTATUS
Decompose 0x80004005 before searching. The three layers of Win32 errors, HRESULT, and NTSTATUS, why 0x8007xxxx is a rewrapped Win32 error, and lookup via err...
-
What Does Windows' "Memory Usage" Actually Mean? — Reading Working Set, Private Bytes, Commit, and the Page File Correctly
Task Manager Memory, Working Set, Private Bytes, and Commit differ. See how virtual and physical memory relate, the page file's role, and which metrics revea...
-
Practical Multithreading Best Practices: Java Edition — Conventions for the Virtual Thread Era
Run Java tasks on ExecutorService and virtual threads, not raw threads. Covers synchronized vs. ReentrantLock, cooperative stopping via interruption, atomic ...
-
Practical Multithreading Best Practices: C Edition — Writing Safely the Win32 API Way
In C on Win32 the established practice is _beginthreadex, SRW locks and condition variables, Interlocked, and a stop event plus WaitForMultipleObjects. Also ...
-
Practical Multithreading Best Practices: C++ Edition — Designing Failures Out with RAII and jthread
C++ data races are undefined behavior. Learn the std::thread destructor trap, stopping with jthread and stop_token, scoped_lock, atomic's real role, and Win3...
-
Practical Multithreading Best Practices: .NET Edition — What to Decide Before You Add More Threads
Keep .NET/C# threads from crashing or hanging. Ride on Task, cut shared mutable state, lock with discipline, stop with CancellationToken, and respect the UI ...
-
Volume Shadow Copy (VSS): The Mechanism and the Practice — Why Backup Software Can Copy Files That Are Still in Use
In-use files hit sharing violations, yet backup software copies them. This covers VSS requester, writer and provider roles, copy-on-write, vssadmin, and diff...
-
The Depths of Windows I/O (Part 6, Final) — How Minifilters Work and Investigating Slow I/O with Procmon
Explains how minifilters monitor and control file I/O: FltMgr, altitudes, pre/post callbacks, fltmc, finding slow operations in Procmon, plus exclusion and D...
-
The Depths of Windows I/O (Part 5) — NTFS Internals: Understanding the File System Through the MFT
An illustrated Part 5 on NTFS internals for developers: the MFT, file records, data streams, hard links, 8.3 names, reparse points, journals, sparseness, and...
-
The Depths of Windows I/O (Part 1) — Every Read and Write Becomes an IRP: The Big Picture of the I/O System
Part 1 of a series on Windows I/O from the ground up: the Object Manager namespace, the driver, device and file objects, the IRP lifecycle, and what CloseHan...
-
Incident Response Doesn't End at Recovery — A Postmortem (Recurrence Prevention) Template for Small Development Teams
Treating an incident as over once it's fixed and apologized for guarantees you'll repeat it. This article translates the blameless postmortem for small teams...
-
Sleep, Hibernation, Modern Standby, and Long-Running Apps — Designing Around 'It Stopped Overnight'
Why a long-running Windows app can end up 'stopped by the time you check it in the morning,' worked through from the differences between S3 sleep, hibernatio...
-
When You Inherit a System With No Source Code and No Documentation — A Practical Playbook for Keeping It Running
A practical playbook for starting operations and maintenance on a business system that has no source code and no specifications. Covers preserving and backin...
-
MAX_PATH and Windows Path/Filename Pitfalls — the 260-Character Limit, Reserved Names, Trailing Dots, and Case Sensitivity
A rundown of the path and filename limits behind the classic 'file not found' bug. Covers the breakdown of MAX_PATH=260, enabling long paths with LongPathsEn...
-
Pitfalls of Network Drives and UNC Paths — Working With File Servers (Shared Folders) From a Business Application
This article organizes the classic problems that show up when a business application writes to or watches a shared folder: why a drive letter (Z:) is invisib...
-
A Practical Guide to Process Monitor (ProcMon) — Pinpointing "Settings Not Applied" and "ACCESS DENIED" in 10 Minutes
"I fixed the config file, but nothing changed." "It worked yesterday, but won't start today." Before touching the source code, Process Monitor (ProcMon) lets...
-
Pinpointing "Slow" with PerfView and dotnet-trace — A Practical Introduction to .NET Performance Investigation
When a business app is "slow," "pegs the CPU," or "occasionally freezes," which tool should you reach for, and what should you look at? This article walks th...
-
An Introduction to Windows Event Log and ETW — Putting Your Business App's Logs on the OS's Standard Mechanisms
Are you relying on file logging alone for your Windows business app? Event Log and ETW are records visible on a different layer — to operations staff and OS-...
-
Reading Crash Dumps with WinDbg + SOS — A Practical Guide to Analysis After Collection
Explains how to actually read a collected Windows crash dump using WinDbg and the SOS extension. Covers symbol path configuration, tracking exceptions and me...
-
Windows App Outsourcing and Custom Software Development: What to Sort Out Before You Ask
Before commissioning Windows app outsourcing or custom software development, here is how to sort out existing software modification, device integration, COM/...
-
Designing Windows Apps to Leave Logs and Dumps When They Crash
How to combine regular logging, a final crash marker, WER LocalDumps, and a watchdog process so that even when a Windows app dies from an unexpected exceptio...
-
An Introduction to Collecting Windows Crash Dumps - WER/ProcDump/WinDbg
To chase hard-to-reproduce Windows application crashes, we walk through when to use WER LocalDumps, ProcDump, MiniDumpWriteDump, and WinDbg, along with the o...
-
Building a Windows Failure-Path Test Foundation with Application Verifier
What Application Verifier is, organized together with how to build a Windows failure-path test foundation using Handles, Heaps, Low Resource Simulation, and ...
-
Investigating Long-Run Crashes of an Industrial Camera App - The Handle Leak (Part 1)
How to look at a Windows app that suddenly crashes after long-running operation, using a case study of an industrial camera control app, from the perspective...
-
Why TCP Retransmissions Stall Industrial Camera Communication, and How to Isolate Them
How to isolate the cause when industrial camera communication stalls for several seconds due to TCP retransmissions, covering packet loss, RTO, RFC1323 times...