recovery

Apr 27 2009   7:22PM GMT

Pandemic preparation, risk and business continuity

Posted by: Troy Tate
business continuity, business continuity planning, continuity planning, environment, hardware, remote access, pandemic, planning, recovery, risk, risk management, risks, Pandemic planning

I’m not the kind to run around thinking the sky is falling or that the swine or bird flu risk is non-existent. I take a lot of these warnings with a grain of salt. However, the pandemic watches of the past few years should obviously have organizations thinking about their risks and business continuity plans. In fact, my organization has a few sites in Mexico and along the border with Mexico. So, this situation has the potential to directly affect our employees.

I wanted to bring your attention to a recent posting on the excellent SANS organization website about the pandemic watch of 2009. This posting is titled Pandemic Watch April 2009. This has very good explanations of the current situation and the potential health risks.

The section that I think is most appropriate to IT folks (actually to everyone) describes a skeleton plan for companies to help deal with the situation. The following is an excerpt from the SANS website.

Don’t Panic!

Initial monitoring stage (where we are right now)

* If you’re sick, stay home
* Family is sick, stay home
* Close contact with someone showing symptoms, stay home
* Wash your hands, cover your cough

Then, if multiple cases in your area,

* Think about telling non-essential workers to stay home
* Recommend workers take kids out of daycare

Pandemic stage

* Everyone will be staying home, how will you handle it?
* Do you have enough laptops?
* Can your VPN concentrators handle the load

I would recommend taking some time to read the summary about the health risks of the various flu strains. Let’s continue to keep our thoughts and best wishes for those who have already been affected by this most recent health issue.

Thanks for reading and let’s continue to be good network citizens - stay healthy too and if you are not healthy, then please contact a health care organization as soon as you can. Get well soon!

Oct 6 2008   1:12PM GMT

Did you see this? - Process monitor now does TCP/UDP monitoring

Posted by: Troy Tate
administration, Networking, forensics, Security, tools, Microsoft Windows, Monitoring, reporting, internet, LAN, debugging, Data security, malware, performance monitoring, recovery, Microsoft, anti-virus, troubleshooting, Performance, howto, network analysis, Sandbox, packet capture, research, diagnostics, Sysinternals, toolkit, analysis

If you ever need to get under the covers of running Windows processes for investigating why a system is running slow, then the Sysinternals toolkit has an updated tool that will help you. Per the website:

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. It combines the features of two legacy Sysinternals utilities, Filemon and Regmon, and adds an extensive list of enhancements including rich and non-destructive filtering, comprehensive event properties such session IDs and user names, reliable process information, full thread stacks with integrated symbol support for each operation, simultaneous logging to a file, and much more. Its uniquely powerful features will make Process Monitor a core utility in your system troubleshooting and malware hunting toolkit.

Process Monitor runs on Windows 2000 SP4 with Update Rollup 1, Windows XP SP2, Windows Server 2003 SP1, and Windows Vista as well as x64 versions of Windows XP, Windows Server 2003 SP1 and Windows Vista.

I had previously talked about the Sysinternals Live website. This update to one of the excellent tools is well worth your time in investigating. Take a look at the updated tool here. The entire Sysinternals toolset can be found here.

If you have not used these tools yet, then you are definitely missing a critical item for being successful in your IT position. Check them out… it may save your reputation some time!

Oct 2 2008   12:00PM GMT

My server is hung! What do I do? - debugging resources

Posted by: Troy Tate
administration, tools, Microsoft Windows, reporting, debugging, performance monitoring, recovery, server, troubleshooting, Performance, howto, diagnostics, toolkit

Debugging a dump from a hung server may not be something you do every day, so you may want to engage with a Microsoft debug expert, however with this information as your guide you may find that you can narrow down a problem and save yourself a call.

My Server is hung - what do I do?

http://blogs.msdn.com/ntdebugging/archive/2008/09/12/red-alert-my-server-is-hung-what-do-i-do.aspx

If you need additional background on debugging, this article can get you started:

Basics of Debugging Windows

http://blogs.msdn.com/ntdebugging/archive/2008/08/28/basics-of-debugging-windows.aspx

 ·  Collect a kernel dump:  http://support.microsoft.com/kb/244139

·  Set up the debugger:  http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx

·  Know how to use the symbol server:  http://support.microsoft.com/kb/311503

Additional resources that you may find useful (including links to the tools, book recommendations, etc.):

·  Microsoft Debugging Tools

·  ADPlus – An automated way to use the cdb.exe to capture/create a usermode dump when a process hangs or crashes (more info - http://msdn.microsoft.com/en-us/library/cc265629.aspx or KB286350)

·  Public Symbols for Microsoft Operating Systems:

o Microsoft Public Symbol server : srv * DownstreamStore * http://msdl.microsoft.com/download/symbols

o   example: srv*c:\mysyms*http://msdl.microsoft.com/download/symbols

o   Microsoft Symbol packages http://www.microsoft.com/whdc/devtools/debugging/symbolpkg.mspx#d

·  Use !Analyze-v to gather additional information about the bugcheck and a bucket-id for your dump file.  The bucket-id can be submitted to Microsoft for review for similar crashes and resolutions.  Try using the Microsoft Online Crash Analysis to submit your crash dump bucket-id for possible follow up from Microsoft or for Microsoft to look for trends:  http://oca.microsoft.com/en/Welcome.aspx

·  For concepts, tools and information about the system architecture:  http://msdn.microsoft.com/en-us/default.aspx

·  Windows Internal 4^th edition (by Mark E. Russinovich & David A. Solomon):  the whole book or Chapter 14 - Crash Dump Analysis

·  Advanced Windows Debugging (by Mario Hewardt & Daniel Pravat):  http://technet.microsoft.com/en-us/default.aspx

·  How to Access the User Mode Debugger from the Kernel Debugger

·  How can I find out why the Cluster Resource Monitor dumped – Access Violation

·  1394 Kernel Debugging Tips and Tricks [WinHEC 2004; 373 KB]

·  Debugging Windows Vista

Aug 18 2008   7:11PM GMT

Did you see this? - Boot CD tutorial

Posted by: Troy Tate
administration, forensics, Security, tools, Microsoft Windows, Monitoring, Mobile, DataCenter, DataManagement, antivirus, recovery, Microsoft, troubleshooting, Performance, howto, risk, packet capture, research, diagnostics, bootcd

How often have you needed to recover a Windows system or use some type of boot disk? It’s not easy to create a bootdisk in the current versions of Windows (XP or Vista). There’s still a need for this capability. One source of how-to information can be found on the BootCD.US website. I recommend that you check out this fine resource and test this capability before you are in need and don’t have a lot of time to wade through a lot of how-to documentation.

Thanks for your time. Let’s be good network citizens together & practice safe networking!