Locating Errors

Locating Errors

Thinstall logging functionality (created using Log Monitor) provides a large amount of information. Here are a few tips you can follow to more easily zoom in on problems to investigate.

Tip 1. Use TextPad to view your log files, as it can handle fairly large files.
Most text file viewers cannot handle large log files, and Thinstall trace files can easily be larger than 100MB. If your trace file exceeds 200MB, you may need to chop off the beginning of the file using a utility like "tail.exe".

Tip 2. Look at "Potential Errors" section first.
The most important part of the log for diagnosing problems comes at the end of the log, in the section labeled "---- Potential Errors Detected ---". You'll find this at the very bottom of your .txt trace file.

Many entries listed in the potential errors section are innocent and do not actually indicate an error. Thinstall list each Win32 API call where the windows error code changed, and most of these do not indicate a real problem which you need to focus on.

Red Flags:

Exceptions

Many applications generate exceptions while they are running; exceptions do not always indicate an error or fault, but are generally a good indicator. Exceptions have different types, (C++, .NET, Floating point, Access Violation, Data Execution Prevention, etc). The trace file will record the type of exception generated and the DLL which generated the exception. If the application threw an exception from self-generating code, as is sometimes the case for .NET and Java applications, the trace will indicate "unknown_module".

example trace entry for an exception:

*** Exception EXCEPTION_ACCESS_VIOLATION on read of 0x10 from unknown_module:0x7c9105f8

Note:VB6 applications throw many floating point exceptions during their normal execution, you can ignore these.

Once you find an exception, look higher in the trace file to see if you can locate the source of the exception.

MSI error messages

The MSI system will often kick in for applications that are not installed correctly and will try to perform self-repair. Unless a feature was installed using "on demand install", it usually indicates that there is something wrong in the environment. Luckily, MSI provides good indicators and error messages in the trace file before it starts self-repair. Search your trace file for calls to FormatMessage; this will also give you important information from the MSI installer.

Tip 3. The error may occur in a child process, make sure you look at the correct trace file.
Log monitor will produce one trace file for each process that is started. If your application starts several child processes, the first step is to determine which process is causing the problem. In some cases such as out-of-process COM, a parent application will use COM to launch a child process, execute a function remotely, and then continue executing.

Tip 4. When running applications from a network share, there is always 2 processes created - Ignore the first one.
In order to work-around Symmatec AntiVirus slow performance issues, Thinstall always relaunches processes when running from a network share.

Tip 5. Search for the error message you see in dialog boxes.
Many applications will call the Win32 API function MessageBox to display unexpected errors at runtime. You can search your trace file for either "MessageBox" or the contents of the string displayed in the error dialog. For example, if the application displayed a cryptic error message "Unexpected child node / Press OK to continue," you could search for this string (or part of the string) and find what the application was doing just before the dialog box appeared.

Tip 6. Kill the application as soon as it gets to an error situation.
By killing the application as soon as possible, you will have less information to sift through in the trace file. If you kill the application immediately after it has an error, chances are good that you can look at the end of the trace and scan upwards to see the source of the problem. Thinstall's Log Monitor utility has a handle "Kill" button to help you do this.

Tip 7. You can generate .txt versions of .trace files while an application is still running.
If needed, you can convert a .trace file into a text report while the application is still running.

Tip 8. Narrow your focus on calls originating from a specific DLL and thread.
Thinstall's log format lets you see which DLL and thread is making a call. When tracking back from the source of an error, you can usually ignore other threads and often ignore calls from system DLLs.