VRTA is one tool which can help you analyzing and improving the performance of your web site. VRTA examines the communications protocol, identifying the causes of excessive round-trips, and recommending solutions. Performance engineers, testers, developers, operations personnel should use VRTA to conduct their web performance analysis.

In the background VRTA tool captures the NETMON traces and does an automated analyses on the HTTP traffic captured during the collection phase.

VRTA provides a lot of recommendations which can help in improving the website’s end user response time but in this blog I will focus on couple of key points which I found very useful.

Feature number 1

VRTA tool lets you know the Average Compressibility of your website contents even when the contents are not served compressed from the web server. Isn't that cool feature..?

How does VRTA does this?

The VRTA tool compresses every file and then compares the new file size to the original downloaded. The ratio is shown Original KB / compressed KB.

Here is the snapshot of VRTA showing Average Compressibility.

Feature number 2

VRTA does a quick analyses on the captured network traces to find out the data packet loss during the communication between client and the server. To do such kind of checks one needs to have an in depth knowledge of analyzing the network traces but using VRTA this can be done automatically.

Recently I have used the VRTA tool to find out the reason of intermittent "Page cannot be displayed” error messages showing up on the client browsers. This issue turned out to be related to packet loss.

Here is a snapshot of the rule which analyze the network traces against the packet loss.

You can download VRTA from the below URL.

https://www.microsoft.com/downloads/details.aspx?FamilyID=119f3477-dced-41e3-a0e7-d8b5cae893a3&displaylang=en

This is what I am actually talking about…

So I assume that you have already installed .NET framework 1.1 and .NET 1.1 SP1 on the server but if you haven’t then here are the links to download the same. I am sure all of you might be knowing that Windows server 2008 doesn’t have .NET 1.1 pre-installed like the way it was the case with Windows server 2003. And also .NET 1.1 doesn’t have any 64bit version.

Question

At most of the sites the full and differential database backups are done using some kind of third party utilities like VERITAS NETBACKUP, SQL LITESPEED and almost all of these utilities relies of SQLVDI interface to take the backup. I would like to know if there is any way we can force backup compression while the backup is triggered from SQLVDI interface.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Since there is not much information available regarding backup compression while the backup is triggered from SQLVDI interface, I got in touch with SQL program managers to find out the answer.

The answer to this question is now blogged at our SQLSTORAGEENGINE blog site. https://blogs.msdn.com/sqlserverstorageengine/archive/2010/02/21/backup-compression-and-virtual-device-interface-vdi.aspx

If in case you need more information on it , do send me an email or leave a comment.

Hope this helps!!!

Environment details:-

Windows 2003 ENT x64 OS, SQL server 2005 ENT SP3 32bit , Oracle 10G client drivers 32bit

Error Messages:-

ORA-12154: TNS:could not resolve the connect identifier specified.

ORA-06413: Connection not open.

Resolution:-

This is a very unique issue and is related to the bug available in the oracle 10g client drivers but before i jump to the resolution I must say that we still need do the basic troubleshooting regarding oracle connectivity like creating a UDL file or using the ODBC utility to test the oracle connectivity and rule out any mismatched/or faulty oracle client driver installation issue.

In my case I could connect to the remote Oracle database using a UDL file and from the ODBC 32bit utility, it is only from legacy DTS packages and through the linked server from SQL server 2005 I was not able to connect to the Oracle database.

While I didn’t have lot of information on why the error messages are coming up while connecting Oracle database from SQL server, I went to the Oracle support site to see if there were any known issues.

There I found this link which to my luck has the resolution to this issue.

https://forums.oracle.com/forums/thread.jspa?messageID=1943221

According to oracle forum mentioned in the above link there is bug in oracle 10g client driver which is causing this issue.

There is a networking bug in the oracle 10g client driver where the networking layer is unable to parse program locations that contain parenthesis in the path to the executable which is attempting to connect to Oracle.

So in my case the location of SQL server 2005 installation is under  “C:\Program Files (x86)\..." and as we can see that the path of the SQL binaries has parenthesis , this would cause oracle client driver to fail to connect to oracle database.

Currently the following patches have been released on Windows by Oracle to fix this issue:

Windows 32-bit
9.2.0.7.0 Patch 6: Apply Patch 4928723 or later
10.2.0.1.0 Patch 4: Apply Patch 4923768 or later
10.2.0.2.0 Patch 5: Apply Patch 5383042 or later
10.2.0.3.0: Apply Patch 5337014 or later

Windows 64-bit AMD64 and INTEL EM64T
10.2.0.1.0 Patch 4: Apply Patch 4923787 or later
10.2.0.2.0 Patch 5: Apply Patch 5388871 or later
10.2.0.3.0: Apply Patch 5337014 or later

But while I was on call with the Oracle support professional to get a confirmation regarding this bug, he suggested me to install the following version of oracle 10g client drivers.

10.2.0.4 ( latest Oracle 10G client driver version)

After installing 10.2.0.4 version of Oracle client 10G driver, we were able to connect to oracle from legacy DTS packages and also from the linked servers using SQL server 2005.

Hope this help!!!

Till few days back I was not aware of fact that there is no MS specific driver which would allow non java based application running on UNIX/LINUX platform to connect to the SQL server hosted on Windows.

And I hope that with this blog post I could help few of you folks to know what are the other available options to connect to SQL server from a UNIX/LINUX platform.

First and foremost I would like to highlight that MS has a JDBC driver which could allow Java based application running on UNIX/LINUX platform to connect to SQL server.

The SQL Server JDBC Driver is available to all SQL Server users at no additional charge, and provides access to SQL Server 2000, SQL Server 2005, and SQL Server 2008 from any Java application, application server, or Java-enabled applet. This driver is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application program interfaces (APIs) available in Java Platform Enterprise Edition 5 (Java EE 5).

For more information on SQL server JDBC driver please click on the following link.

Microsoft SQL Server JDBC Driver.

Connectivity options for non java based applications running on UNIX/LINUX platform.

In a scenario where customer wants to connect to a SQL server from a PERL/C++ application running on UNIX box, there are few things to consider before the search begins for the appropriate connectivity driver.

Case 1: Interoperating an ODBC DBD Application

If the original C++/PERL application was written using ODBC DBD, then the best migration option is to continue to use this driver. Because ODBC is not database-specific, no changes should need to be made to the application's source code. The only changes that need to be made concern connectivity with the SQL Server database.

The DBD::ODBC module requires a driver manager and a driver to interact with SQL Server. DBD::ODBC is packaged with the Independent ODBC (iODBC) driver manager from OpenLink Software (https://www.openlinksw.com/). For more information about this driver, refer to https://www.freetds.org/userguide/perl.htm#DBD.ODBC. Another driver manager, unixODBC, that could be used in an interoperation scenario is available from https://www.freetds.org/userguide/prepodbc.htm.

Case 2: Interoperating an Oracle DBD Application

If the original application was written using the Oracle DBD, there are two possible options that can be evaluated. The recommended option is to replace the Oracle DBD with a Sybase DBD. The second option is to migrate to an ODBC framework similar to the one seen in "Case 1: Interoperating an ODBC DBD Application." Sybase DBD offers better performance than ODBC.

For more information on both Case 1 and Case 2, please click on the following link.

https://technet.microsoft.com/en-us/library/bb497071.aspx

Hope this helps,

In scenarios where load is something to consider , use NMCAP to capture network data.

Some of the features for NMCAP

—Highest Capture Performance

—/Examples for Help

—Can Run for Days with No Problems

—Circular and Chain Capture Support

—Automatable

Example Usage:
  Example 1:

This example starts capturing all TCP frames and will be saved in a capture file name tcp.cap. If you want to stop capturing, Press Control+C.

nmcap /network * /capture tcp /File tcp.cap

  Example 2:

This example starts capturing network frames at 3:17 PM on JAN 31, 2010. ALL the HTTP frames that contains keyword “localhost” in the URI property of the HTTP protocol. The size of the capture file will not exceed 6 megabytes and will create a chained capture files named HTTP.cap, HTTP(1).cap, HTTP(2).cap. If the user presses x at any time during this capture, the program will terminate, otherwise the capture will stop 10 minutes after it has begun.

nmcap /network * /startwhen /time 3:17:00PM 01/31/10 /capture contains(HTTP.Request.URI,’localhost') /file HTTP.chn:6M /stopwhen /timeafter 10Min /TerminateWhen /KeyPress x

NMCAP can easily be scriptable in a batch file and this makes the tool highly automatable, even the pre-configured batch files can be provided to the customer to capture the network data from the production servers.

For more information on NMCAP check out the following link..

https://blogs.technet.com/netmon/archive/2006/10/24/nmcap-the-easy-way-to-automate-capturing.aspx

Hope this helps…..

1) First and foremost make sure that you have access to a root certification authority and you must be able to create client and server certificates. If in case you don’t have a root CA available in your network then get one installed preferably on a separate server discounting the RMS or MS server. The root CA could either be a stand-alone or enterprise CA.

2) Now since we have access to a CA, browse to the following URL from the agent managed workgroup computer. https://certificatio_authority_server/certsrv. 

a. Click download a CA certificate, certificate chain , or CRL.

b. Click Download CA certificate chain.

Tip:- If in case you are not able to access the above HTTP URL don’t be upset, there is another way out by which you can still be copy the CA certificate chain on the workgroup computer. Just go to the C:\WINDOWS\system32\certsrv directory on the CA server and copy the certnew.p7b file from this folder to the server in the workgroup.

3) Import the above certificate under the trusted root certificate authority. The only thing to remember here is that while opening the certificate MMC, you choose COMPUTER account instead of other two options.

4) At this point of time we need to generate a certificate for the server in the workgroup. There are several ways by which you can generate a certificate but I would recommend you following the steps documented under the following KB article.

To request a certificate from a stand-alone CA

https://technet.microsoft.com/en-us/library/bb735417.aspx

Note:- Please make sure that you also generate a server certificates for the RMS , MS servers as we need to import these certificates under different zones on the servers. The steps would be same to generate the server certificates for RMS, MS, workgroup servers.

5) Now since we have imported both CA certificate chain and server certificate under the respective zone on the workgroup computer , it is time to import the server certificate into another zone using the MOMCERTIMPORT tool (\SupportTools\i386) . But before this we need to get the server certificate exported with its private key. And also we need to get the server certificate exported with its private key on the RMS server as well (If you have already done this then you can ignore this).

Following are the steps to do so.

 Click Start, click Run, type mmc, and then press ENTER.

 On the File menu, click Add/Remove Snap-in.

 Click Add.

 Click Certificates, and then click Add.

 Select Computer account, and then click Finish.

 Select Local computer, click Finish, click Close to close the snap-in list, and then click OK to close the Add/remove snap-in window.

 Expand Certificates (local computer), expand Personal, expand Certificates, and then select a suitable certificate.

 Right-click the certificate, point to All tasks, and then click Export.

 Click Next.

 Select Yes, export private key, and then click Next.

 Use the default setting for the file format.

 Type a password for the file.

 Type a file name, and then click Next. For example, type C:\Workgroup_ComputerName.pfx.

 Click Finish.

Note:- Repeat all these steps on the management server and on the workgroup computer.

6) Install the MOMAgent.msi setup file on the workgroup computer.

7) It’s time to import the exported PFX file on the workgroup servers using MOMCERTIMPORT tool.

a. Type the following command, and then press ENTER:

MOMCertImport path_of_the_certificate .pfx_file_that_is_exported_in_step_5

Note:- One of the most important thing to remember here is that we import the exported certificates using the above commands on the RMS and MS servers.

8) Restart the System center management service on the workgroup servers and on the RMS, MS servers.

9) After this if everything has gone according to the plan then you must see the workgroup servers either in pending management or in the agent managed pane under SCOM console.

If in case you don’t see the workgroup computer under any of the above panes in SCOM console then it’s time to start with the troubleshooting.

Troubleshooting steps:-

1) Make sure the servers in the workgroup can ping the FQDN of the RMS or MS server which have provided while installing the SCOM agent on the server.

2) Port number 5723 should be opened bi-directional between the RMS, MS <-> workgroup servers.

3) View the operation manager Event logs under the workgroup computer. You should look for the error messages like:-

Event Type:    Error
Event Source:    ABC Connector
Event Category:    None
Event ID:    21016
Date:        9/27/2009
Time:        2:52:20 AM
User:        N/A
Computer:    ABC
Description:
ABC was unable to set up a communications channel to HOST.HOMEDC.COm and there are no failover hosts.  Communication will resume when HOST.HOMEDC.COm is available and communication from this computer is allowed.

Event Type:    Error
Event Source:    ABC Connector
Event Category:    None
Event ID:    20070
Date:        9/27/2009
Time:        2:52:17 AM
User:        N/A
Computer:    ABC
Description:
The ABC Connector connected to HOST.HOMEDC.COm, but the connection was closed immediately after authentication occurred.  The most likely cause of this error is that the agent is not authorized to communicate with the server, or the server has not received configuration.  Check the event log on the server for the presence of 20000 events, indicating that agents which are not approved are attempting to connect.

Now it’s time to look for the error messages under the RMS or MS servers regarding the communication failure with the above ABC server.

Event Type:    Error
Event Source:    ABC Connector
Event Category:    None
Event ID:    21010
Date:        9/27/2009
Time:        2:21:49 AM
User:        N/A
Computer:    HOST
Description:
The ABC Connector negotiated the use of mutual authentication with 192.168.1.8:1077, but Active Directory is not available and no certificate is installed. A connection cannot be established.

The above error message means that there is no certificate available with the SCOM server on the RMS or MS to authenticate the workgroup server. Make sure you have correctly imported the server certificate using the MOMCERTIMPORT tool on the RMS and MS server.

In windows Vista Doctor Watson doesn't really exist!!, which was suppose to be a default debugger program in all the previous version of Windows.

This made me put my thinking cap on to find out what application has replaced Dr. Watson on Vista , many of you might be knowing it but I invested some time not only to find out what application has replaced Dr. Watson on Vista but also how to configure it to take automatic dumps while the application unexpectedly crashes.

Dr. Watson, the system failure or "crash" analysis tool, has been replaced in this version of Windows with Problem Reports and Solutions.

Problem Reports and Solutions helps you check for solutions to hardware and software problems that can occur on your computer. You can set Windows to report problems and check for solutions automatically, or you can choose to check for solutions whenever a problem occurs. Problem descriptions and solutions are saved, so you can view them at any time.

Where does Problem Reports and Solution exist in windows vista.

1) Open Problem Reports and Solutions by clicking the Start button , clicking Control Panel, clicking System and Maintenance, and then clicking Problem Reports and Solutions.

To find more information on Problems Reports and Solutions program , go to the following link to see the detailed video on it.

How Do I: Create and Analyze a Mini-Dump File in Windows?https://msdn2.microsoft.com/en-us/visualc/bb738099.aspx

The client first authenticates the server using the certificate. After authentication, the client uses public-key encryption to send information that is used to created a shared key (the session key). Then the session key is used to perform the more efficient symmetrical-key encryption on the rest of the data. The shared key is specific to this session and is never used again.

The SSL handshake is what brings authentication, encryption, and verification together. The following occurs during an SSL handshake:

1. The client sends the server the client's SSL version number, cipher settings, randomly generated data, and other information that the server needs to communicate with the client using SSL.

2. The server sends the client the server's SSL version number, cipher settings, randomly generated data, and other information the client needs to communicate with the server over SSL. The server also sends its own certificate.

3. The client authenticates the server as described in the Certificate Authorities and Trusts section.

4. With the information gathered so far, the client creates a premaster secret for the session, encrypts it with the server's public key, and sends it to the server.

5. Using the premaster secret, the server follows a series of steps to create the master secret; this occurs on the client.

6. The client and the server use the master secret to create the session keys.

7. The client sends a message to the server stating that the next message will be encrypted with the session key.

8. The client sends an encrypted message to the server stating that the handshake process is finished.

9. The server sends a message to the client stating that the next message will be encrypted with the session key.

10. The server sends an encrypted message to the client stating that the handshake process is finished.

11. The process is now finished. The client and the server use the session keys to encrypt data with symmetric-key encryption.

 Hope this helps!
 

One of the key changes which I would be talking in this blog post would be Kernel Mode Authentication in IIS7.

1) Componentized Architecture

In IIS7 all of its features are no longer implemented as a part of server code, they are implemented as individual modules. This modular architecture makes it easier to reduce the attack surface of the web server.

Example:-  What if the customer do not want to use BASIC authentication feature on IIS, In IIS6 the only way to turn that feature off was to just *UNCHECK the Checkbox* available under the security configuration of the website.

But in IIS7 since BASIC authentication feature is implemented as a separate module , customer can not only disable the feature but can totally unload the binary used of basic authentication from the process.

Benefits:-

a) Reduced Attack Surface with minimal server footprints.

b) Lower Total Cost of Ownership through reduced patching requirements since you only need to patch the module installed.

2) Configuration Encryption

I believe everybody of you by now must be aware of changes made in regards of the Configuration Database for IIS7. In IIS7.0, there is no longer an entity known as the "IIS Metabase". It is conceptually replaced by ApplicationHost.Config.

In IIS6 there were very few properties that were marked as secure properties like AdminACL, AnonymousUserPass, WAMUserPass, UNCPassword.

Since the configuration of IIS6 was stored in the Metabase.xml file, it has no relation with the ASP.NET application configuration which was normally stored either in the Machine.config or Web.config files.

ASP.NET provides a feature where a user can encrypt a particular section of the configuration file using a RSA provider like:-

aspnet_regiis -pe "connectionstrings" -app "/App1" -prov "RsaProtectedConfigurationProvider"

In IIS7 with the existence of delegation feature user can store IIS and application related settings under a one common configuration file that is "web.config" file.

This brings the above encryption feature to the IIS table also, now with the above command IIS related configuration sections can also be encrypted.

Either users can use the default encryption provider that is already defined in the machine.config or can create their own custom encryption key for use in encrypting/decrypting configuration data.

If you are interested in learning in detail regarding this then I would recommend you to go to the link mentioned below.

https://www.iis.net/default.aspx?tabid=2&subtabid=25&i=1066

3) Request Filtering

In IIS6 the only way to do the request filtering was either to use "Web Service Extensions" or to install the URL scan on the server.

In IIS7 all the features that was provided by URLScan has been incorporated into a separate module called "Request Filtering Module".

One of the key advantages which we get in IIS7 with the request filtering module is its granular (can be applied differently for each website, Virtual Directory, file) approach where as the setting applied using URLScan were global.

List of some of the features provided by Request Filtering Module.

A) File extension restrictions

B) Hidden segments

C) Deny URL sequences

D) Verbs

E) Request limits restrictions

Maximum allowed content length
Maximum URL length
Maximum query string length
Header limits

4) Kernel Mode Authentication

In IIS7 by default Kerberos authentication happens in Kernel. It might not look to be a very impressive statement but trust me this feature will take care of at least 50% of the issue related to the Kerberos authentication.

Authentication performed in kernel mode allows server applications to run on a different user accounts and most importantly Site Admins don’t have to set the SPN's for each account under the domain. Only HOST SPN's set under the IIS web server machine A/C would be enough.

If you have read my last blog post on Kerberos authentication than you would realize what does kernel Mode Authentication really means when it comes to Kerberos and how much it can help in Kerberos Authentication.

I will talk more about Kernel Mode Authentication in my upcoming blog post.