Problems with slow machies and custom updates (win2k).

I've been noticing a pattern develop lately with custom updates.

I do clean installs of win2k sp4 on older machine, and then do updates,
which has worked well until recently. What has started to happen, is
that the slower machines take so long to get custom updates, that after
20+ minutes of the green infinate looping progress bar, they time out,
and i get the screen of doom (0x8ddd0009) THe slower a machine is, the
more likely it is to happen. Around celeron 500 and lower, it's a
guarentee. Pentium 3 700 and up, it rarely, if ever happens. Has anyone
else noticed this? It's been getting worse, this didn't happen a couple
of months ago.

Usually, you can reload the page and it will finish, but some seem to
be stuck there.

Yes, i do have ie6 installed before going to update, but nothing else.

Yes, I've been trying to track this down. If I leave my system up and try a
Custom Update around 2-3 AM, it seems to work.

This I don't understand because the Express and Custom, both go to the same
route in determining download criteria.

ANd the error messafe, The web-site has detected an error ...., SUCKS! I
don't know how many times that comes out with different error codes. Why
can't MS be SPECIFIC!

<> wrote in message
news: oups.com...
> I've been noticing a pattern develop lately with custom updates.
>
> I do clean installs of win2k sp4 on older machine, and then do updates,
> which has worked well until recently. What has started to happen, is
> that the slower machines take so long to get custom updates, that after
> 20+ minutes of the green infinate looping progress bar, they time out,
> and i get the screen of doom (0x8ddd0009) THe slower a machine is, the
> more likely it is to happen. Around celeron 500 and lower, it's a
> guarentee. Pentium 3 700 and up, it rarely, if ever happens. Has anyone
> else noticed this? It's been getting worse, this didn't happen a couple
> of months ago.
>
> Usually, you can reload the page and it will finish, but some seem to
> be stuck there.
>
> Yes, i do have ie6 installed before going to update, but nothing else.
>

On Wed, 16 Aug 2006 10:06:39 -0400, "NewScience"
<> wrote:

>Yes, I've been trying to track this down. If I leave my system up and try a
>Custom Update around 2-3 AM, it seems to work.
>
>This I don't understand because the Express and Custom, both go to the same
>route in determining download criteria.
>
>ANd the error messafe, The web-site has detected an error ...., SUCKS! I
>don't know how many times that comes out with different error codes. Why
>can't MS be SPECIFIC!
>
As I mentioned in an earlier post, using Sysinternals "process
explorer" you can narrow the High CPU down to the thread level.
The thread is named, but at that point, it's only of use to
individuals familiar with Windows programming.

Perhaps we need to enlist some help, and post the details
in a programming-oriented group.

Dave

dave xnet wrote:
> On Wed, 16 Aug 2006 10:06:39 -0400, "NewScience"
> <> wrote:
>
> >Yes, I've been trying to track this down. If I leave my system up and try a
> >Custom Update around 2-3 AM, it seems to work.
> >
> >This I don't understand because the Express and Custom, both go to the same
> >route in determining download criteria.
> >
> >ANd the error messafe, The web-site has detected an error ...., SUCKS! I
> >don't know how many times that comes out with different error codes. Why
> >can't MS be SPECIFIC!
> >
> As I mentioned in an earlier post, using Sysinternals "process
> explorer" you can narrow the High CPU down to the thread level.
> The thread is named, but at that point, it's only of use to
> individuals familiar with Windows programming.
>
> Perhaps we need to enlist some help, and post the details
> in a programming-oriented group.
>
> Dave

I do enough of these, that I may be able to start collecting statistics
on the affected machines. From what I've seen so far, it's purely a
function of processor speed, on if you get timed out.

There must be a timeout function within the activex control somewhere.

One theory I've heard, is that the windows update catalog has simply
grown too large to be processed by slow machines before a timeout
occurrs. Is there any way to confirm that?

The solution for microsoft would be to release a new service pack, and
reduce the burdon. Yes, I know they cancelled sp5 for windows 2000, but
they may want to reconsider.

I have monitored this with Process Explorer. The 'hog' is svchost that
controls Automatic Updates and BITS (as well as many others). Using FileMon
as well I've monitored file access, which is quite extensive, in which
checks are being done when 'hook-up' occurs.

I'm also on a dial-up 56K modem, and there is a 'feature-bug' with dial-up
icon set to taskbar. If you have always show icon (internet setting ... not
HIde icons setting), the registry is access constantly delaing with TCPIP
parameters (verified with REGMON). Turn off always show dial-up icon, the
polling stops.

The problem is, that if you run into a problem dealing with OE spawning
hyperlinks for into IE, without the dial-up icon, you cannot manually
disconnect.

"dave xnet" <> wrote in message
news:...
> On Wed, 16 Aug 2006 10:06:39 -0400, "NewScience"
> <> wrote:
>
>>Yes, I've been trying to track this down. If I leave my system up and try
>>a
>>Custom Update around 2-3 AM, it seems to work.
>>
>>This I don't understand because the Express and Custom, both go to the
>>same
>>route in determining download criteria.
>>
>>ANd the error messafe, The web-site has detected an error ...., SUCKS! I
>>don't know how many times that comes out with different error codes. Why
>>can't MS be SPECIFIC!
>>
> As I mentioned in an earlier post, using Sysinternals "process
> explorer" you can narrow the High CPU down to the thread level.
> The thread is named, but at that point, it's only of use to
> individuals familiar with Windows programming.
>
> Perhaps we need to enlist some help, and post the details
> in a programming-oriented group.
>
> Dave

"NewScience" <> wrote in message
news:%...
>I have monitored this with Process Explorer. The 'hog' is svchost that
> controls Automatic Updates and BITS (as well as many others). Using FileMon
> as well I've monitored file access, which is quite extensive, in which
> checks are being done when 'hook-up' occurs.


I bet if you activated verbose mode logging there would be even more. <w>
(ref. KB902093)


BTW if you are actually getting as far as downloading, bitsadmin
can be a useful diagnostic too. E.g. in a cmd window enter:

bitsadmin /monitor /allusers /wrap

E.g. sometimes there seems to be is an error in the update's packaging
and you will note a loop as a result both via this monitor or (more explicitly)
in the WindowsUpdate.log.


>
> I'm also on a dial-up 56K modem, and there is a 'feature-bug' with dial-up
> icon set to taskbar. If you have always show icon (internet setting ... not
> HIde icons setting), the registry is access constantly delaing with TCPIP
> parameters (verified with REGMON). Turn off always show dial-up icon, the
> polling stops.


Or, just change your FileMon filter to eliminate its capture of that process.
FWIW the filter that I like to use is: SoftwareDistribution;update;CatRoot

That really helps you "read between the lines" of the log
and even lets you correlate the log's records with the
FileMon and RegMon trace entries (using appropriate Options).


>
> The problem is, that if you run into a problem dealing with OE spawning
> hyperlinks for into IE, without the dial-up icon, you cannot manually
> disconnect.


Just because the DUN icon is gone? Find another way to disconnect.

There are several:
1. Set Work Offline in OE and accept the prompt
2. Use rasdial /d (in a cmd window)
3. Open DUN Monitor from the Start menu
4. Etc.


HTH

Robert Aldwinckle
---


>
> "dave xnet" <> wrote in message
> news:...
>> On Wed, 16 Aug 2006 10:06:39 -0400, "NewScience"
>> <> wrote:
>>
>>>Yes, I've been trying to track this down. If I leave my system up and try
>>>a
>>>Custom Update around 2-3 AM, it seems to work.
>>>
>>>This I don't understand because the Express and Custom, both go to the
>>>same
>>>route in determining download criteria.
>>>
>>>ANd the error messafe, The web-site has detected an error ...., SUCKS! I
>>>don't know how many times that comes out with different error codes. Why
>>>can't MS be SPECIFIC!
>>>
>> As I mentioned in an earlier post, using Sysinternals "process
>> explorer" you can narrow the High CPU down to the thread level.
>> The thread is named, but at that point, it's only of use to
>> individuals familiar with Windows programming.
>>
>> Perhaps we need to enlist some help, and post the details
>> in a programming-oriented group.
>>
>> Dave
>
>

>> I'm also on a dial-up 56K modem, and there is a 'feature-bug' with
>> dial-up
>> icon set to taskbar. If you have always show icon (internet setting ...
>> not
>> HIde icons setting), the registry is access constantly delaing with TCPIP
>> parameters (verified with REGMON). Turn off always show dial-up icon,
>> the
>> polling stops.
>
>
> Or, just change your FileMon filter to eliminate its capture of that
> process.
> FWIW the filter that I like to use is:
> SoftwareDistribution;update;CatRoot

FileMon does not monitor RegMon, and RegMon does not monitor FileMon. In
this scenario, I have RegMon monitoring svchost.exe, only.

The overhead is the polling of the TCPIP connection by RegMon, with the
Dial-up Icon on, the polling occurs.
With the icon off, polling stops.

Setting OE to offline has no bearing on the polling. It's the connection.
And I cannot control how every Network oriented application operates in
Windows XP. The problem is Dial-up causing polling when the icon shows.

However, I didn't know about the rasdial /d (assuming the /d is for
disconnect).

"Robert Aldwinckle" <> wrote in message
news:...
> "NewScience" <> wrote in message
> news:%...
>>I have monitored this with Process Explorer. The 'hog' is svchost that
>> controls Automatic Updates and BITS (as well as many others). Using
>> FileMon
>> as well I've monitored file access, which is quite extensive, in which
>> checks are being done when 'hook-up' occurs.
>
>
> I bet if you activated verbose mode logging there would be even more. <w>
> (ref. KB902093)
>
>
> BTW if you are actually getting as far as downloading, bitsadmin
> can be a useful diagnostic too. E.g. in a cmd window enter:
>
> bitsadmin /monitor /allusers /wrap
>
> E.g. sometimes there seems to be is an error in the update's packaging
> and you will note a loop as a result both via this monitor or (more
> explicitly)
> in the WindowsUpdate.log.
>
>
>>
>> I'm also on a dial-up 56K modem, and there is a 'feature-bug' with
>> dial-up
>> icon set to taskbar. If you have always show icon (internet setting ...
>> not
>> HIde icons setting), the registry is access constantly delaing with TCPIP
>> parameters (verified with REGMON). Turn off always show dial-up icon,
>> the
>> polling stops.
>
>
> Or, just change your FileMon filter to eliminate its capture of that
> process.
> FWIW the filter that I like to use is:
> SoftwareDistribution;update;CatRoot
>
> That really helps you "read between the lines" of the log
> and even lets you correlate the log's records with the
> FileMon and RegMon trace entries (using appropriate Options).
>
>
>>
>> The problem is, that if you run into a problem dealing with OE spawning
>> hyperlinks for into IE, without the dial-up icon, you cannot manually
>> disconnect.
>
>
> Just because the DUN icon is gone? Find another way to disconnect.
>
> There are several:
> 1. Set Work Offline in OE and accept the prompt
> 2. Use rasdial /d (in a cmd window)
> 3. Open DUN Monitor from the Start menu
> 4. Etc.
>
>
> HTH
>
> Robert Aldwinckle
> ---
>
>
>>
>> "dave xnet" <> wrote in message
>> news:...
>>> On Wed, 16 Aug 2006 10:06:39 -0400, "NewScience"
>>> <> wrote:
>>>
>>>>Yes, I've been trying to track this down. If I leave my system up and
>>>>try
>>>>a
>>>>Custom Update around 2-3 AM, it seems to work.
>>>>
>>>>This I don't understand because the Express and Custom, both go to the
>>>>same
>>>>route in determining download criteria.
>>>>
>>>>ANd the error messafe, The web-site has detected an error ...., SUCKS!
>>>>I
>>>>don't know how many times that comes out with different error codes.
>>>>Why
>>>>can't MS be SPECIFIC!
>>>>
>>> As I mentioned in an earlier post, using Sysinternals "process
>>> explorer" you can narrow the High CPU down to the thread level.
>>> The thread is named, but at that point, it's only of use to
>>> individuals familiar with Windows programming.
>>>
>>> Perhaps we need to enlist some help, and post the details
>>> in a programming-oriented group.
>>>
>>> Dave
>>
>>
>
>
>

<big snip>

Not sure if it's a coincidence, but I renamed
windowsupdate.log and let the system create a new one.

This seems to have speeded up the "scan".

I also ran qfecheck from the CMD box, and
some fixes were flagged and need to be
reapplied.

Cheers,
Dave