How do I troubleshoot when I have no clue where to start?

39

20

I am looking for hints, tips and answers on how to get started on troubleshooting when:

  1. The problem is intermittent
  2. The problem could lie literally anywhere - operating system; free source software; my own software developments; purchased software; crumbs on the keyboard; the specific combination of software I am currently running; Maxwell's demon; the little blue men actually running the machine have gone on strike; etc.
  3. I have expertise only in a few of the areas that are potential candidates for the cause of the problem.

The specific problem I am having is detailed below as an example, but I am not seeking answers to my current problem, but rather where and how to start on tackling such problems.

I am currently encountering a problem with my new machine. On a few occasions the machine has just frozen; not accepting keystrokes, mouseclicks, or anything except the power on/off switch. Invariably I have been merely browsing the web; I have had a few (<= 6 other applications) running. None of these applications are major; and represent a mix of commercial programs and open source programs, typically migrated from Unix of some variety.

My machine is a Windows 7 I7 quad core laptop.

EDIT:

Although I stated that the actual problem description was only an example, some of the comments are concentrating on solving this problem. Unfortunately, as it was only an example, the information given is correct but not complete. To avoid having people wasting their time on trying, remotely, to aid with the actual problem, I am giving some other information about my setup. As I originally said, I am not seeking answers to this specific problem.

My machine is a high powered laptop; is my main machine; is used for development and technical writing, communications - email, web, FTP, etc, and for photo editing and indexing. A rigorous and extensive suite of hardware test programs,including CPU tests, multiple memory tests, and tests on all other components are run on it at least monthly. Also run at least monthly are a full virus scan; a full spyware scan; a disk cleanup; and a disk defragmentation.

The disk contains approximately 3*10^6 files; disk usage is 300 Gb leaving 150 Gb free. Memory is 8 Gb. While the machine can get slightly warm when I am running a full complement of major development tools, I have encountered the problem only when using the machine very lightly - web browsing plus Textpad plus Graphviz plus a Firebird database plus a lightweight database browser (Flame Robin). In these circumstances even the fan is not slightly warm. I have made no changes to software, operating system or hardware over the period I have encountered the problem. There have been a number of automatic updates occur - Microsoft, Adobe, and Lenovo mostly but not exclusively.

This background puts into context (I hope) my reasons for asking this question the way I did. I am now going to start investigating the various logs mentioned in the answers as a first step in trying to narrow the field of investigation. And I am going to try an exercise one of the characteristics suggested in the answers I have received so far - patience - in my investigation.

Chris Walton

Posted 2011-03-20T18:48:10.530

Reputation: 559

6+1 Because this question can be useful for me to link to in the future. – Tamara Wijsman – 2011-03-20T20:42:26.580

2Sometimes, before launching into a full, methodical problem solving approach, you should attempt a sweep of common low-hanging fruit: Run a full spyware scan, search the windows log for unexpected shutdowns and see what (if any) problems preceded it, check the disk space situation, run check disk, give Sysinternal's Autoruns a quick scan for unfamiliar/suspicious software. Have a simple set of tools to run which can quickly identify a large variety of hardware and software issues. If they find nothing, you've wasted little time and can commence a more thorough process. – Alain – 2011-03-21T13:15:28.277

1

Also, follow Mark's Blog for examples how annoying issues are troubleshooted with Sysinternals.

– Tamara Wijsman – 2011-03-21T14:25:23.590

1Good luck on troubleshooting, I would suggest to create a new question if you want more feedback to keep things organized... – Tamara Wijsman – 2011-03-21T18:31:16.940

Answers

42

Get a better idea.

You ain't going to win a battle without sufficient field information.

  1. Describe your problem in detail so that you have a good idea of it, who knows it just happens once.

  2. Track back in time what happened before and together with the problem, both you and your computer.

  3. Think of the possible causes because sometimes it might be something that's not obvious.

  4. Get more information whenever you have no idea of what's happening, this could range from Events, to SysInternals Tools, to Performance Analysis, to Debugging, to any other tool in your expertise.

  5. Test your assumptions to be sure that your thoughts don't filter the cause away.

Divide and conquer.

Because that's how military defeat their opponent even when outnumbered.

Eliminate the possible causes, or you'll have a problem keeping track of the problem. This way, you will get closer and closer to the root cause of the problem, it allows you to solve the problem a lot easier.

For example, with hardware, disconnect and remove anything that you don't need for fixing your problem. This way, you might disconnect the component causing the problem. And then it's again a matter of inserting half the components in, checking if it reoccurs and repeat splitting till you have the bad component...

Testing something on another computer, if available, is also a good benefit towards solving the problem.

For example, with software, rebooting into safe mode, disabling start-up entries also helps. This also applies to enabling/disabling settings, trying the default configuration and so on...

Let's put it to the test.

I am currently encountering a problem with my new machine. On a few occasions the machine has just frozen; not accepting keystrokes, mouseclicks, or anything except the power on/off switch. Invariably I have been merely browsing the web; I have had a few (<= 6 other applications) running. None of these applications are major; and represent a mix of commercial programs and open source programs, typically migrated from Unix of some variety.

  1. That's a proper description by itself, it doesn't just happen once either.

  2. You know what happened together with the problem,
    but haven't thought of things you or your computer did before the problem.

    I can't tell this, but you, your event log and recently modified files/folders could tell.

  3. Possible cause is most likely to be CPU related, because it's the component that processes things.

    More specific this could be a process, a driver or failing hardware (perhaps temperature problems?).

  4. I know it's CPU, but don't know what. Events don't show this, Process Explorer would hang on DPC.

    So, next step, I let trace analysis run which I close after the hang has occured.

    I look into the trace, and I see that driver X is causing the problem!

  5. No real assumptions are made. The CPU assumption is handled by our Divide & Conquer approach...

So, this is where I start dividing to conquer the problem, I stop once solved:

  1. Problem with current version of the driver?
    Update the driver to the latest version.

  2. Problem with newest versions of the driver?
    Get a new trace. Update the driver to an older version different from the initial.

  3. Problem with the device? Configuration problem in the registry?
    Get a new trace. Reinstall and/or disable the device if possible.

  4. Problem is random, is it the processor heating up?
    Check the processor temperature, replace fan if needed.

  5. Problem is not the processor, are there other hardware and software influences?
    Remove hardware and disable software from running, to nail down third-party influence.

  6. Problem is not in a removable part, it should be replaced.
    In the worst case, if all else fails, you need to go for a replacement.

Getting new traces and removing hardware gives us more information, so we know where to look next.

Tamara Wijsman

Posted 2011-03-20T18:48:10.530

Reputation: 54 163

4+1 for divide and conquer. Accepted for specification of description, tracking back, and mechanisms to divide and conquer the problem. – Chris Walton – 2011-03-20T20:31:29.043

5+1 Brilliant answer. Only thing to add is this: Test your assumptions – Bevan – 2011-03-20T22:48:20.640

how about "change one thing at a time"? – Florenz Kley – 2011-03-21T11:27:34.043

2@Florenz: Well, by dividing you either take them one by one (for a small number, or when you can't base yourself on multiple causes) or you split them up (for a larger number, when you can check multiple things at once. Splitting up in halfs, if possible, is faster than doing them one by one. For example, to troubleshoot 100 things you only need to test it 8 times (100->50->25->13->7->4->2->1), instead of 100 times... – Tamara Wijsman – 2011-03-21T14:21:30.193

2sensible division! What I meant to say is "don't fix stuff faster than you can attribute a change to an observed delta". Using a lab book with pages I can't tear out is my method to ensure I can do it. – Florenz Kley – 2011-03-21T16:33:11.800

6

Good logs and intuition - really.

  • From day 1, keep track of everything you do to the system: app & OS updates, new installs, new or removed hardware or connections, the thunderstorm that "didn't cause a problem".
  • When you first noticed the issue:
    • What had you been doing?
    • What else unusual happened recently?
    • What have you done differently recently?
    • From then on, keep aware of what you're doing so the next time it happens, you have a better handle on what had just preceded it.
    • Snapshot the system logs.
  • See if you can you reproduce it. Until you can reproduce it, you can't find it.
  • Start partitioning the system: safe mode vs. running live, new account vs. your regular account, different keyboard and mouse than your regular ones (esp. bluetooth vs. wired), does it happen within a few minutes of starting or waking vs. only after an hour more of running (think thermal).

JRobert

Posted 2011-03-20T18:48:10.530

Reputation: 6 128

2+1 for logging activity; and for intuition. Not the accepted answer only because logging is only good if done from day 1. I have been keeping logs but not sufficiently detailed; and have not included system updates from Microsoft, and other automated updates. – Chris Walton – 2011-03-20T20:28:59.560

1@ChrisWalton: There are detailed logs for Windows Update, device insertion/removal, driver installation and so on. See C:\Windows\*.log, C:\Windows\Logs, C:\Windows\inf\*.log and also Performance Monitor > Data Collector Sets > (Startup) Event Trace Sessions. Also, @JRobert, +1 for explaining how to get an idea in more detail... – Tamara Wijsman – 2011-03-20T20:39:11.810

4

I usually start with the event logs and any logs that a program mmay create on its own. Programs will sometimes crete a log in the program folder.

Once you can identify the time, search the logs for events. Naturally windows logs may present with Stop errors that will be easy to identify.

Check all drivers and make sure they are current.

Patience will likley be required in large doses.

Dave M

Posted 2011-03-20T18:48:10.530

Reputation: 12 811

2

In addition to all the good advice already given, if log files aren't giving you a lot to go on, a proper memory test of the machine is often worthwhile - faulty memory can cause all sorts of strange intermittent freezes and crashes. The built in memory test is much more akin to a memory count it's extremely rare the power on test catches a memory fault.

Google for Windows Memory Diagnostic and burn it to a CD. It's old but it's one of the better memory tests, and it's free.

Matt

Posted 2011-03-20T18:48:10.530

Reputation: 141

thanks for your answer and the suggested tool. I'm afraid you rather missed the point of my question - you suggest memory testing; somebody else suggested Adobe automatic software downloads. My question was; in these circumstances how do you decide what to do when there are a huge range of possibilities. – Chris Walton – 2011-03-21T10:24:28.967

1@Chris: As I said; when troubleshooting intermittent and unexplainable issues (In a none sw development situation ofcourse), if there's no log to start from, and no other markers to suggest where to start, I'd run a memory test. The logic being, it's relatively fast to run compared to trying to replicate an intermittent issue. Once ruled out then you start on the narrowing down and getting an idea as TomWij puts it. – Matt – 2011-03-21T11:11:29.673

fair enough. – Chris Walton – 2011-03-21T11:16:53.540

Asked: 2011-03-20T18:48:10.530

Viewed: 2 612 times

Active: 2019-09-15T18:43:21.460