Managing software executables

Managing problems with windows applications can be an awkward situation. Users will have heard of the registry, DLLs and memory but few will have the knowledge to identify the cause of the problems. Windows Task Manager gives basic information to help identify the cause of problems. This document is designed to help support staff determine causes of some of the problems. It explains some of the basic concepts and outlines some of the potential problems that can occur.

Process information
When a process is started various pieces of information are available. The following details are available via the top pane in the Process Explorer: Detail Potential use Windows user name User name to contact if the process needs to be shut Path Path to the executable that has been executed. Useful for confirming that the appropriate executable is being run Start Time Date and Time that the process is started. This is useful for checking if a process has loaded a new version of a DLL PID This is the process number for the process. If this number is stored and passed to the capacity management tools then they are able to identify the individual processes and graph the process requirements The memory used by a process can be seen by using the Process Explorer tool. If a process has crashed then typically the amount of memory it uses will stay the same. If a process is still active then the memory should change.

Memory
A process requires memory to store its executable and to store its workings and results. If a server has a lot of applications running then it may have used up all of its physical memory (RAM) and it may resort to using the disk drive to store applications and their data. The use of disk space is treated as virtual memory. By its nature virtual memory is a lot slower than RAM and this can slow down applications on the PC if they have to wait for data from the hard disk. The memory used by a process can be seen by using the Process Explorer tool. If a process has stopped responding but not died then typically the amount of memory it uses will stay the same. It is possible for a process to stop responding but to continue to use memory; this is normally seen with processes where the process is involved with long running calculations. V1.1

If a process is still active then the memory should change periodically.

How can a process run out of memory on a server with 8 GB?

Window itself uses large amounts of memory (128Mb for Windows 2000/XP) to store its DLLs/executables. It then makes the remaining memory available for individual processes. Windows 2000/2003 and XP all have rules that limit how much memory a process can use governed by the windows architecture. By default each process can use up to 2 GB of memory. This memory is shared between the executable/DLLs and the data used by the executable. If a process requests memory above the 2 GB limit then windows has to refuse the request and the application is liable to crash. So it is possible for the server to have 4 GB of memory free but for a process to crash. It may not be an error in the system when a process runs out of memory. If a user has selected a particularly large task then it may break the 2 GB memory limit.

Problem: PC running out of memory

Symptoms Hard disk is continually being used to retrieves data. Applications generate out of memory messages Checks and Causes Use System Information (My Computer->System) to see how RAM is installed. Use Process Explorer/Task Manager to determine how much memory is being used and if virtual memory is being used. Actions The best short term solution is to reduce the number of open applications (including any items in the system tray). The best long term solution is to add more memory to the PC if possible so that the need for virtual memory is reduced. It isnt possible to eliminate the use of virtual memory completely but it use can be substantially decreased. Consider increasing the amount of virtual memory available on the PC. A typical value would be twice the amount of RAM installed. Consult the helpdesk on how to change this setting and if it is necessary.

Problem: PC using large amounts of virtual memory

Symptoms Hard disk continually being used as the computer retrieves data from it. Listen for the sound of the hard disk being used

V1.1

Checks and Causes Use System Information (My Computer->System) to see how RAM is installed. Use Process Explorer/Task Manager to determine how much memory is being used and if virtual memory is being used. Actions The best short term solution is to reduce the number of open applications (including any items in the system tray). The best long term solution is to add more memory to the PC if possible so that the need for virtual memory is reduced. It isnt possible to eliminate the use of virtual memory completely but it use can be substantially decreased.

DLLs
Overview
Software is typically made up of a number of components. While the components can be grouped together into one large executable (exe file) it is often more appropriate to split them into separate files and manage them accordingly. In the windows environment these files are called Dynamic Linked Libraries (DLLs). The DLL can consist of several parts: Import table containing public function/constants overview. This can contain references that allow the DLL to act as a server for other applications List of DLLs that the DLL is dependent on Private Functions used to perform the actions. DLLs are typically stored within program folders, although Windows contains a large number of DLLs that are available for use. Not all DLLs contain servers that external applications can use. Individual DLLs will contain a list of the DLLs that they were compiled with and that are required to enable the DLL to be used. This list is automatically built by the compiler when the DLL is compiled. A DLL is registered with the windows system where it is then available for use by other applications that understand how to reference and call it. To enable the DLL to act as a server it needs to be compiled with a special function listing the functions that can be called by other applications. Only those functions that have been declared can be used by other applications. The public functions are able to call private functions available within the DLL. A DLL is registered using the Regsvr.exe command e.g. Regsvr <dllname> Once a DLL with a server has been registered other software is able to use it. V1.1

The DLL references used by applications are stored in the registry. Each DLL is referenced with a unique Class ID (CLSID) that references the DLL The entry for the CLSID is a unique ID for a DLL, the CLSID and entries created when a DLL is registered will uniquely identify where a DLL is expected to be. DLLs are not normally used to store user details or details of a session. These details are typically stored in the registry or in configuration files. The DLL files are normally monitored by anti-virus software to detect changes in the files. Once a DLL has been loaded in memory windows will use that version rather than keep loading it from the hard disk. This means that new versions of the DLL placed on the hard disk are ignored unless the DLL is unregistered and registered again.

Uninstalling a DLL
Once a DLL containing a server is registered with the registry it needs to be unregistered before it can be removed or replaced. A DLL cannot be installed while it is being used by another application. All applications that use the DLL must be exited. If an application is using that DLL then the details cant be updated as they are still in use. See the Process Explorer section for details on how to identify which applications are using a given DLL. DLLs are uninstalled using the following command: Regsvr /u <dllname>

What problems can occur with DLLs?

Typical problems include: Applications using the wrong versions of DLLs Applications using referencing DLLs that have been renamed or removed Applications using DLLs that rely on other DLLs that are missing Trying to register DLLs which are not designed to be a sever.

Problem: Applications using the wrong versions of DLLs

Symptoms Application crashes with error messages referring to memory exceptions in DLLs or missing functions or missing functionality Checks and Causes Check that the correct version of the DLL has been installed by checking: The size and date of the DLL

V1.1

The properties of the DLL (use windows explorer to see the file properties of the DLL). There is often a version number that can be read and noted. If the version number is 1,0,1 then it is possible that the developer who produced the file has not enabled build version control in their compiler. They should be encouraged to do so. The different version numbers can cut down the amount of time spent checking DLL versions. If there are doubts about the version of the DLL then always refer back to the original developer. Do not copy DLLs over from different PCs. This can cause other problems as they may need different versions of DLLs that have not been copied over. Problems may not become apparent until a long time afterwards as the other DLLs may not be used on a regular basis.

Problem: Applications using referencing DLLs that have been renamed or removed
Symptoms: Application crashes with error messages stating that it is unable to find DLL <x> Checks and Causes: Confirm that the DLL is present on the computer or accessible network drives. Uninstall the current application and reinstall the application as necessary

Problem: Applications using DLLs that rely on other DLLs that are missing
Symptoms: Application crashes with error messages stating that it is unable to find DLL <x> Checks and Causes: Uninstall the current application and reinstall the application as necessary Developers can use the dependency checker tool to analyse a DLL and determine which DLLs it requires. Administrators can check the file system to confirm that the DLLs are available as necessary.

Problems: Trying to register DLLs which are not designed to be a sever.

Symptoms: Administrators receive the following error message when trying to register a server: Checks and Causes: Confirm with the developer that the DLL is designed to be a server. V1.1

Confirm that the DLL has the relevant function/compile flags set if the software is developed/compiled in-house.

V1.1