|
|
 FAQ
 Search
 Memberlist
 Usergroups
 Register
 Profile
 Private messages
 Log in
|
|
| Author |
Message |
Peter
Guest
|
 Posted: Sun Apr 16, 2006 11:21 pm Post subject: Autorecovery of registry settings ??? |
 |
|
Hi,
We have a strange issue. We have more than 1200 Windows 2003 servers, member
servers in an Active Directory. On these servers, some registry parameters
are updated every day with a counter we store in the registry. When one of
these servers crashes, these registry values containing data that dates from
the last successful reboot. We do not know how they are restored and from
were? These values are sometimes more than 15 days old. We put auditing on
the keys, but when the values are gone or replaced by older ones, after a
crash, the auditing we put on it has gone too.
Any help is welcome.
Thanks in advance,
Regards,
Peter |
|
| Back to top |
|
 |
|
|
Galen
Guest
|
| Posted: Mon Apr 17, 2006 5:30 am Post subject: Re: Autorecovery of registry settings ??? |
|
|
In news:EEE1C65D-E817-4043-BA5B-28C8639376C8@microsoft.com,
Peter had this to say:
My reply is at the bottom of your sent message:
| Quote: | Hi,
We have a strange issue. We have more than 1200 Windows 2003 servers,
member servers in an Active Directory. On these servers, some
registry parameters are updated every day with a counter we store in
the registry. When one of these servers crashes, these registry
values containing data that dates from the last successful reboot. We
do not know how they are restored and from were? These values are
sometimes more than 15 days old. We put auditing on the keys, but
when the values are gone or replaced by older ones, after a crash,
the auditing we put on it has gone too.
Any help is welcome.
Thanks in advance,
Regards,
Peter
|
First let me say I'm not 100% certain but is it last known good
configuration being automatically used? The last saved point in the
registry...
If that's them they're in the registry as ControlSet001, 002, etc. I do
believe.
Have a gander here:
What are Control Sets? What is CurrentControlSet?:
http://support.microsoft.com/?kbid=100010
The real question is - why is it crashing and what can you do to have a more
current backup of your data. (And, if this is a business, why are such
policies not already in place? Which is really why I posted this at all -
such should be a base line that you work up from in my humble opinion.)
--
Galen - MS MVP - Windows (Shell/User & IE)
http://dts-l.org/
http://kgiii.info/
"At present I am, as you know, fairly busy, but I propose to devote my
declining years to the composition of a textbook which shall focus the
whole art of detection into one volume." - Sherlock Holmes |
|
| Back to top |
|
|
Guest
|
| Posted: Mon Apr 17, 2006 6:46 am Post subject: Re: Autorecovery of registry settings ??? |
|
|
It would also be of interest to know what keys they are. Some registry
keys are quite dynamic, and they are essentially detroyed and recreated
when the system goes up and down. Can you give us at least part of the
path to the keys?
Windows administration tools and utilties
http://www.intelliadmin.com |
|
| Back to top |
|
|
Peter
Guest
|
| Posted: Mon Apr 17, 2006 2:14 pm Post subject: Re: Autorecovery of registry settings ??? |
|
|
Dear Galen,
Is there way to configure your server to load the last know good
automatically after a crash, without any manuel intervention?
Thanks,
Peter
"Galen" wrote:
| Quote: | In news:EEE1C65D-E817-4043-BA5B-28C8639376C8@microsoft.com,
Peter had this to say:
My reply is at the bottom of your sent message:
Hi,
We have a strange issue. We have more than 1200 Windows 2003 servers,
member servers in an Active Directory. On these servers, some
registry parameters are updated every day with a counter we store in
the registry. When one of these servers crashes, these registry
values containing data that dates from the last successful reboot. We
do not know how they are restored and from were? These values are
sometimes more than 15 days old. We put auditing on the keys, but
when the values are gone or replaced by older ones, after a crash,
the auditing we put on it has gone too.
Any help is welcome.
Thanks in advance,
Regards,
Peter
First let me say I'm not 100% certain but is it last known good
configuration being automatically used? The last saved point in the
registry...
If that's them they're in the registry as ControlSet001, 002, etc. I do
believe.
Have a gander here:
What are Control Sets? What is CurrentControlSet?:
http://support.microsoft.com/?kbid=100010
The real question is - why is it crashing and what can you do to have a more
current backup of your data. (And, if this is a business, why are such
policies not already in place? Which is really why I posted this at all -
such should be a base line that you work up from in my humble opinion.)
--
Galen - MS MVP - Windows (Shell/User & IE)
http://dts-l.org/
http://kgiii.info/
"At present I am, as you know, fairly busy, but I propose to devote my
declining years to the composition of a textbook which shall focus the
whole art of detection into one volume." - Sherlock Holmes
|
|
|
| Back to top |
|
|
Peter
Guest
|
| Posted: Mon Apr 17, 2006 2:15 pm Post subject: Re: Autorecovery of registry settings ??? |
|
|
Thanks For the answer.
These keys are created in HKEY_LOCAL_MACHINE\software\fortis
Regards,
Peter
"intelliadmin@gmail.com" wrote:
| Quote: | It would also be of interest to know what keys they are. Some registry
keys are quite dynamic, and they are essentially detroyed and recreated
when the system goes up and down. Can you give us at least part of the
path to the keys?
Windows administration tools and utilties
http://www.intelliadmin.com
|
|
|
| Back to top |
|
|
IntelliAdmin
Guest
|
| Posted: Mon Apr 17, 2006 5:19 pm Post subject: Re: Autorecovery of registry settings ??? |
|
|
Since this registry key is for a third-party application, and not a
System key I would say this is what is happening:
The application that updates the key makes its changes to the registry
-> But they are not written to disk
Windows keeps these changes cached in memory, and decides when to write
them to disk.
My guess is that the changes are made, and when it crashes it never had
to write them. Thus the reason why it is going back to previous values.
If you have any control over the design of the application in question,
the API call of RegFlushKey needs to be called - This will make sure
the changes are written to disk.
See MS for more info about this call
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/sysinfo/base/regflushkey.asp |
|
| Back to top |
|
|
Peter
Guest
|
| Posted: Mon Apr 17, 2006 10:20 pm Post subject: Re: Autorecovery of registry settings ??? |
|
|
Thank IntelliAdmin.
I think you could be right, but sometimes, the data written to the registry
after a crash are more than 15 days old. Could it be possible that registry
data remains 15 days in memory before written to the disk by the OS?
Thanks in advance,
Regards,
Peter
"IntelliAdmin" wrote:
| Quote: | Since this registry key is for a third-party application, and not a
System key I would say this is what is happening:
The application that updates the key makes its changes to the registry
-> But they are not written to disk
Windows keeps these changes cached in memory, and decides when to write
them to disk.
My guess is that the changes are made, and when it crashes it never had
to write them. Thus the reason why it is going back to previous values.
If you have any control over the design of the application in question,
the API call of RegFlushKey needs to be called - This will make sure
the changes are written to disk.
See MS for more info about this call
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/sysinfo/base/regflushkey.asp
|
|
|
| Back to top |
|
|
|
|
Galen
Guest
|
| Posted: Tue Apr 18, 2006 2:53 am Post subject: Re: Autorecovery of registry settings ??? |
|
|
In news:1482217D-ABCF-43DC-921C-3611E4EAB368@microsoft.com,
Peter had this to say:
My reply is at the bottom of your sent message:
| Quote: | Dear Galen,
Is there way to configure your server to load the last know good
automatically after a crash, without any manuel intervention?
Thanks,
Peter
|
Yes but it won't do you any good.
The issue in this case is the poor software design and it not writing
information at a more acceptable frequency level. Are there updates
available? Are there support lines you can go through for them? If so then
that's your best choice - or really - your best choice is preventing the
crash in the first place. Seeing as it's already crashing every couple of
weeks what is the reason behind it? If it's already going down then what's
preventing the box from automatically rebooting, say, nightly or at another
time when it isn't in use?
I guess that's where I'd personally attack this. At the same time I'd
approach the vendor to ask if they were high when they (from what I'm
reading) had it set to not write the data until the OS was shutdown
properly. Better yet - why are they storing it in the registry in the first
place? The registry isn't really MEANT to be a giant repository for garbage
from poor code authors. Attempting to use it as such may very well be what
is causing the errors in the first place.
Unless you're held back by vendor lock-in (is this the ERM software?) then
maybe, just maybe, you can look for an alternative. I know a lot of
companies pile data into the registry but it's really not a good practice
and not at all what it was meant for. Is there an option - you'll want to
check with the vendor - to maybe change the frequency at which data points
are saved? Sheesh... Is there any option to have them saved outside of the
registry? 15 days lost data with each server crash (and to me that's where
the root of the problem is and is what also needs to be worked on) is
unacceptable and in some industries borderline illegal if compliance is an
issue.
--
Galen - MS MVP - Windows (Shell/User & IE)
http://dts-l.org/
http://kgiii.info/
"At present I am, as you know, fairly busy, but I propose to devote my
declining years to the composition of a textbook which shall focus the
whole art of detection into one volume." - Sherlock Holmes |
|
| Back to top |
|
|
Guest
|
| Posted: Tue Apr 18, 2006 3:51 am Post subject: Re: Autorecovery of registry settings ??? |
|
|
I have to agree with Galen. A server should not be crashing at this
type of interval. Most software is not going to expect to be killed
right in the middle of processing. And again, why don't they use a
different method for storing this info?
Imagine if you just pulled the power at any given moment from the
system. It would have the same type of adverse effects. Find out why it
is crashing. I have worked with 100s of windows servers over the years
and most of them have been up and running for *years* without crashing
or blue screening.
That is your best avenue for solving this issue.
Steve Wiseman
Windows Admin Tools
http://www.intelliadmin.com |
|
| Back to top |
|
|
|
|
