How to remotely connect using perfmon?

Question

Suprised there is not a ton of information on google when i search for this but there is not. Lot of people asking the question but i none of them have any good answers.

I have a remote computer running hyper-v (server) running a Windows 7 x64 guest (guest). Occasionally i won't be able to remote desktop to guest. I will then remote to server and see that the guest instance is constantly using about 25% of the cpu. WHen i try to connect directly from server i will get the login screen but as soon as i type the password in it will just stay at the windows 7 login screen but the account names will disappear and it will not log in. It responds to pings though. I don't know how else to diagnose other than trying to run perfmon remotely. It only happens like every 3 weeks and i run it 24/7.

So i'm trying to run remote desktop remotely. I tested this out on a local vm i have running under vmware. When i try to connect using perfmon to my local vm i get this error: "when attempting to connect to the remote computer the4 following system error occurred: the network path was not found"

I found in another past to start the remote registry service and when i start the service i get this error: "No such interface supported"

Anyways, how do i remotely connect to another machine with perfmon or if anyone has a better idea how i can diagnose the problem above then let me know.

Solution

I'm 99.99% sure that perfmon just uses RPC. From a port perspective, this needs access to port 135 on the target (RPC server), but then subsequent access to an ephemeral port. The Windows firewall deals with this quite nicely, as it can follow the conversation from the RCP endpoint mapper (TCP 135) to the subsequent communication port.

However, the issue you're describing above is nothing to do with connectivity. A Windows server that's still responding to PING, but can't be RDP'd to, and gets "the network path was not found" is almost certainly experiencing kernel resource starvation.

Quite often, these situations come and go, but it can be frustrating and challenging to diagnose.

I'd start with:

• Make sure the server is patched, especially 3rd part device drivers
• Check your antivirus software is up-to-date. AV vendors' kernel minifilters are notorious sources of kernel resource starvation.
• If the server is x86, seriously consider changing to x64. The limitations of the 4GB process address space are obviously gone with x64.
• Ensure you have sufficient physical memory (granny... eggs, I know!).
• Check your total paging file space is sufficient. Ignore the "memory * 1.5" (and similar) recommendations on the web (total paging space should equal max. commit charge less your physical RAM). You'll only work out your max. commit charge by monitoring your server during peak load.
• Use poolmon.exe to take snapshots of your paged pool and (more importantly) non-paged pool values. Compare your snapshots over a period of time.
• If one of the pools shows ever-increasing deltas (i.e.: allocations > frees), find out what component owns the offending pool tag. If it's a device driver, update it.

Good luck!

Comments

[FooBee]

The first step to diagnose things like that is usually a peek into the Event Viewer.

[coding4fun]

Unfortunately i've looked at the logs and haven't found any evidence of problems..

[culter]

I have the same problem - No such interface supported. No good answer found after hours of googlin.. :(