Win2000 troubleshooting list

The introduction of Win2000 marks that the operating system has reached a new stage, but because of the reality is too much (I heard that there are more than 60,000 terrible?), in the process of using various The problems are coming one after another. I will list the problems I encountered in the actual situation. I hope I can help you a bit.

1. When the security log is full, pause the computer and take the following steps:

(1) Open the event viewer.
(2) In the console tree, right-click Security Logs, and then click Properties.
(3) On the "General" tab, click "Overwrite events older than n days" or "Do not overwrite events (manually clear logs)."
(4) Click "Start", click "Run", type regedit, enter "HKEY_LOCAL_MACHINESYSTEM CurrentControlSetControlLsa", right click "CrashOnAuditFail", create "REG_DWORD" type, the value is "1".
(5) Restart the computer.

Warning:

(1): Incorrectly editing the registry can severely damage your system. At least any useful data on your computer should be backed up before changing the registry.
(2): After this process is finished, when the security log is full, Windows 2000 will stop responding and display the message "Audit Failed". When Windows 2000 is stopped, the security log must be cleared for recovery.

Note:

(1): You must be logged in as an administrator or a member of the management group to complete the process.
(2): To open the Event Viewer, click Start, point to Settings, and then click Control Panel. Double-click Administrative Tools and double-click Event Viewer.
(3) If Windows 2000 is suspended because the security log is full, you must restart the system, if you need to use a full log to stop in the future, you must repeat the process.

2. Recovery when Windows 2000 stops

(1) Restart your computer and log in with the account in the System Administrators group.
(2) Open the "Event Viewer", archive the currently recorded security events (if needed), and then clear all events from the security log.
(3) Open the Registry Editor and find the following registry key: "HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlLsa"
Right click on "Lsa", create "EG_DWORD" type from the pop-up menu, the value is "1", delete and replace CrashOnAuditFail value. Exit the Registry Editor and restart your computer.

Note:

(1) If the registry was previously configured with CrashOnAuditFail = 1, and the security log is full, Windows 2000 will stop responding with a "review failed" message. If this happens, use the steps above.
(2) To start the Registry Editor, click Start, click Run, type regedit, and then click OK.

3, find memory bottlenecks

Use the following counters in the performance tool to identify memory resources that have bottlenecks:

(1)System Processor Queue Length
(2) Memory Pages/sec

4, Find Disk Bottlenecks

Use the following counters in the Performance Tool to identify bottlenecked disk resources:

(1)PhysicalDisk % Disk Time and % Idle Time
(2)PhysicalDisk Disk Reads/sec and Disk Writes/sec
(3)PhysicalDisk Avg.Disk Queue Length
(4)LogicalDisk % Free Space

Also monitor memory Counters to determine if there are too many memory paging makes the disk use tight.

Note: Unlike the data of the physical disk counter, the data of the logical disk counter is not collected by the operating system by default. To get performance counter data for a logical drive or storage volume, you must type diskperf -yv at the command prompt. This causes the disk performance statistics driver for collecting disk performance data to report data for logical drives and storage volumes. By default, the operating system uses the diskperf -yd command to include physical drive data. For more information on using the diskperf command, type diskperf -? at the command prompt. .

5, find the processor bottleneck

Use the following counters in the performance tool to identify the processor resources that have bottlenecks:

(1)Processor Interrupts/sec
( 2)Processor % Processor Time
(3)Process(process) % Processor Time
(4)System Processor Queue Length

6. Find network bottlenecks

In the performance tool Use the following counters to identify bottlenecked network resources:

(1)Network Interface Bytes Total/sec, Bytes Sent/sec, and Bytes Received/sec
(2)Protocol_layer_object Segments Received/sec, Segments Sent/Sec, Frames Sent/sec, and Frames Received/sec For NWLink performance objects, the frame-related counters only report zeros. Use datagram-based counters for these objects.
(3) Server Bytes Total/sec, Bytes Received/sec and Bytes Sent/sec
(4)Network Segment % Network Utilization