A case, put to the test

Yesterday's post was about a phone call: a client's practice software crashing ten times a day after its vendor reinstalled it, and a technician who wanted to know whether their own remote-access tool was to blame. We answered it by hand, using what Wegweiser had collected.

This morning the obvious question was whether a case would have got there without us. So we opened one on that machine, in the MSP's own words from their email, with none of our findings as hints.

It took six minutes. It agreed with what we had sent: the remote-access tool was not the cause, and the practice software was failing in its own graphics layer. Then it went further than we had:

• The fault is old. Windows had been filing reports of the program leaking graphics resources since May.
• The reinstall changed nothing. Every crash, before and after it, came from the same build of the program.
• Ten a day was not what the logs showed. Counted per program, it was four one day and two the next. The user had restarted the machine six times that morning.
• The vendor's work had not finished. Their components were reinstalled three times across the week.

Its advice was to hand that evidence to the software vendor as a defect, and to have the user watch one number in Task Manager to prove the leak. That is a better answer than ours.

Crashes, counted per program

The same exercise showed where the ordinary analyses had let the technician down, days before anyone called.

Windows files most crashes under one event number, whichever program crashed, and our summary of the log kept only the newest message for each event number. So a count of 113 crashes carried the name of whichever program crashed last, and the analysis reported that the sign-in screen had crashed 108 times. It crashed four times. The crash analysis, given only a file name, guessed that the practice software was a hardware vendor's utility and suggested it might not be needed.

Both analyses now receive a count per program: crashes, hangs and unhandled .NET errors, with where each program is installed, which component failed and how. A program in its own folder under Program Files is treated as software your client chose to install, often the one their business runs on, and is never described as a utility or recommended for removal. The parsing works on a German Windows as well as an English one.

The daily read of a machine leads with the machine

Every day Wegweiser reads all of a device's checks together, looking for what no single one of them says. For four days on that machine it opened with an internal forecast score from August, a number that exists for our own bookkeeping and counts towards nothing. It no longer sees it.

Event history that had quietly stopped

The agent sends each machine's last 30 days of event logs once a day, and on a busy machine the security log alone reaches 95 MB. That was just over the most our server would accept in one go. Since late August three machines' uploads had been refused every day, and everything that reads that history was working from where it stopped.

The server now accepts much larger uploads on that one route, so those machines catch up tonight. Agent 0.3.106 also compresses the logs to about a tenth of their size, which fixes a slower office connection that ran out of time on every upload. It is on our own machines now and reaches yours tomorrow.

Cases, a size up

• A group or a whole client. "Every PC at this site freezes at nine" is not one machine. The group and organisation chats now open cases too. The case works out which machines are affected and which are not, and names them in its conclusion.
• How deep. Standard, or In depth with twice the room and twice the ceiling, for the problem that needs a long trail.
• Any tenant can open one. If your chat runs on your own model or another provider, a case still runs on ours, charged in wegcoins.
• Your ticket, your state. With Zammad connected you choose which open or pending state a concluded case leaves its ticket in.

Also new

• What each check costs the score. The device page shows how many points each check takes off the device score, and they add up to the gap below 100.
• The chat can read a client's website findings. Ask whether anything is wrong with their website and it answers from the scan, worst first, with the fix.
• Search is always there. On a wide screen the search is now a field in the top bar. Press / to jump to it.
• Select, raise a ticket. Text you select on any page can go straight to your helpdesk from the small pop-up.
• Two more diagnostics. Cases can read SQL Server's own view of its waits and databases, and a Hyper-V host's logs, in agent 0.3.105.