Last Object

Although in the case of system hangs we, usually, recommend dumping Stack Trace Collection (Volume 1, page 409), in some cases it is very time-consuming, especially when it involves thousands of processes such as in modern terminal services environments. In such a case, if the problem description indicates the last action such as a not progressing user logon or a recently launched process we first check the tail of the corresponding linked list where Last Object is usually added to the tail of the list:

images

Sometimes we can simply check the end of some enumerated collection, such as sessions (dotted lines represent ALPC Wait Chains, Volume 3, page 97):

images

This analysis pattern can be added to the first tier of RSDP (Volume 7, page 444). If nothing found around a couple of Last Objects we then resort to the analysis of entire linked lists.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.138.34.75