Exception Event Details

Examples for performance event details are given for ASP.NET applications and web services. Note that this information applies to any .NET components monitored by AVIcode products.

Event Properties Tab

The 'Event Properties' tab provides property information about the event such as what computer the event occurred on, the Event Date, etc. The Properties tab also displays event data that allows you to drill down the call stack, and view such detailed information as parameters and member variables.

General Information Area

The properties area displays all non-data related information about an exception or performance event.

Event Class: .NET Exception Event
Aspect: Application Failure, Connectivity, Performance, Security, Operational Info, System Failure
Component: Win32, COM or .NET DLL. In development environment library typically corresponds to Visual Studio Project. It's typically deployed as part of an application.
Status: Indicates that someone has applied a rule to a set of events via the 'Rules Management wizard..', in order to properly triage events. This value may be 'New', 'Reviewed', 'Behavior by Design' or 'Deleted'
Source: The name of the application from which Intercept Studio received the event. This name is also a link which will open the Application Resource Utilization window for the named application.
Event Date: The date/time stamp for when an event occurred
Build: The version from the main assembly of the application, which is automatically incremented when the assembly is built, and which is stored in Assemblyinfo.cs
Computer: The name address of the monitored computer from which the Intercept Agent generated an event. This name is also a link which will open the Computers Resource Utilization window for the named computer.

The event type icon (, , ) is also displayed below the General Information area and to the right of the tabs to indicate whether you are looking at a performance event, handled exception or critical exception. The icon will also display a tooltip with event ID and event category.

Description Area

This area will only appear for exceptions that fall within either the Security or Connectivity aspects.

Generally, exceptions that occur from either Security or Connectivity problems fail with a description that contains the name of the failed function, but with little useful context for troubleshooting the issue. Intercept Studio is able to intelligently interpret the exception data to display a more useful description of the problem, and to provide additional context targeted to troubleshooting the issue.

This symbol identifies the Target, or subject, of an operation. For example, if the operation attempts to open a registry key, then the target is the registry key being opened. If it is a SQL query, then SQL is the target. For file I/O operations, the filename is the target.

Actions - Actions - Actions are the actual methods executed as the result of a user requested action such as File.Open or the text of a SQL query that results in a Security or Connectivity failure. (exceptions)

Security Context - The Security context provides the connection string (for database connections) and the user that the ASP.NET process is running under.

Exception Chain Area

This area displays all of the places where the exception was caught and re-thrown between where the error occurred (highlighted in red) and where the call was initially made.

Use the plus () symbol to expand the chain. The minus () symbol will collapse the chain.

Clicking on any of the exceptions in the chain will reload the Exception Data Area with information specific to that exception.

Exception Data Area

This area provides the data that can be exposed through the exception itself, including various structures and public properties.

Use the plus () symbol to expand structures such as class (), functions (), arrays (), and objects (). The minus () symbol will collapse the information displayed.

Stack Area

The 'Stack' section of the screen displays all function and resource calls that are relevant to the cause of the event.

Thrown vs. Handled

All exception events display the stack trace displaying where the exception was thrown. Operational exception events also display where the exception was caught and handled:

Getting to the details

Use the plus () symbol to expand structures such as class (), functions (), arrays (), and objects (). The minus () symbol will collapse the information displayed.

Use the down arrows () to show details related to parameters and member variables, and the up arrows () to reduce the level of detail displayed. Diagnosing performance issues only requires information about the dialog between your application and external resources.

When you expand a bottom level function call () in the Stack area using the down arrows (), SE-Viewer will display a tabbed box that will allow you to view parameters, member variables and source code for the expanded function.

Note that the stack frame where the exception occurred is highlighted in red as indicated below:

Where's the first call the exception stack trace? Because the stack shows how the exception was raised through the calling functions, the stack is displayed with the first function executed at the bottom, and the last function executed at the top.

Show all of the stack

The 'Show complete call stack' menu item is available when viewing exception events. It will display every call on the stack back trace, including Microsoft or System frames not directly related to the application. By default, the display only shows stack frames directly related to the cause of the exception. Frames not directly called by the application are displayed in gray.

Show parameters

The 'Show parameters' menu item is available when viewing exception events. It displays the parameter names and types for each function call in the stack.

Show lines

The 'Show lines' menu item is available when viewing exception events. It will display the fully qualified path name of the source code file that the function is defined in, as well as the line number at which that definition appears. It also allows the function offsets (see below) to be displayed.

What are function offsets?

Function Offsets appear at the end of each stack frame, which permit using Ildasm.exe to locate the actual line of code that corresponds to that frame

What are the Chain Links for?

Intercept Studio allows you to see exception events propagated from the server-side to the client-side through chains. If an event is generated for both tiers, you will be able to click on the chain icon to see the corresponding event on the other tier.

This symbol links to details about the event node that will receive this exception as a result of the call.

This symbol links to details about the event node that an exception was received from.

Example:

Event #45300 is from a client running 'QuestionnairePage.aspx', that displays the following exception chain:

By opening the exception data, we can see that the error actually occurred on the server-side when it was unable to process a request:

The stack shows that the exception was caught in the 'GetRootId()' immediately following the call to 'GetRootId()' in the 'Questionnaire.asmx' web service on the server:

To see what happened on the server-side, click on the link, and Intercept Studio will link to the corresponding event.

If there is no corresponding event, then the message described above will be displayed.
If there are more than one possible corresponding events, then the 'Chain Wizard' will open. The 'Chain Wizard' will ask you to decide whether Intercept Studio should make the best possible choice, or provide you with all possible choices of corresponding events.. Once you make your selection form the wizard, you must click on the link again.
If there is only one event that corresponds to this one, then its event details window will open.

Event #45299 is the server-side event that corresponds to the 'GetRootId()' call from event #45300.

If we look at the exception chain, we see that the primary exception was a result of calling the OldeDbConnection.Open() method on the server-side:

If we look further down to the bottom of the exception chain, we also see a 'System.NullReferenceException', which is the exception that was propagated back to the client-side as a SoapException.

No exception chains to the remote server? Be sure to check the synchronization of times between your servers for each tier so that Intercept Studio can properly correlate transactions for the chain functionality. Also make sure that the related events exist on both tiers.

Viewing Parameters

Once you drill down to the bottom frame of an exception event through the links, you will see a tabbed area that links you to detailed information about function parameters, member variables and the source code.

The icon is provided next to each frame that contains details about function parameters and member variables. Click the symbol to open the frame to view the details.

Note that the 'Parameters' label on the tab tells you how many parameters there are for this function, in this case two (2). Notice that by using the plus () symbols that you can drill further into the details about the member variables and their values. The structure column identifies whether or not each item is a class. Each of these parameters matches those displayed in the function call in number, type and order.

Viewing Member Variables

The icon is provided next to each frame that contains details about function parameters and member variables. Click the symbol to open the frame to view the details.

Note that the 'Member Variables' label on the tab tells you how many member variables there are for this function, in this case seven (7). Notice that by using the plus () symbols that you can drill further into the details about the member variables and their values. The structure column identifies whether or not each item is a class.

Viewing the Source Code

The icon is provided next to each frame that contains details about source code. Click the symbol to open the frame to view the details.

The Assembly area at the top of the tab provides detailed information about the assembly in which the exception occurred. Information includes: The name of the assembly, the last date modified, the assembly path and the symbols path.

If your PDB files are available on the Monitored System, SE-Viewer will also display several lines of source code around the line that cause the event to occur. This information includes the line number of the failed function call, Several lines of code surrounding the highlighted line of code in question and the file name where the function source code resides. This name is also a link, which when clicked, will bring you to the those lines of code in Visual Studio .NET

Source code information is available for exceptions, but not for performance events. At most, the information includes the name of the file, the line number of the function call, and several lines of code around the function call.

No source code in your events? In order to allow SE-Viewer to display file names and line numbers, you must have your PDB files installed on the Monitored System. If there is not a PDB file available, you will see:

Open the Source Code in Visual Studio .NET

The name of the file with the exception on the Source tab is a link that will open your Visual Studio solution file to the exact line of code with the issue. Simply click on the link and browse to the appropriate solution file:

Link to your source code doesn't work? You must have the following in order for this link to function correctly:

The Visual Studio Plug-in for Intercept Studio must be installed
The Plug-in must be installed on the same machine as the Visual Studio project file for the failing application
The Visual Studio project must be the same revision as the one that built the deployed PDB file
The link must be clicked from the machine where Visual Studio, the project and the Plug-in all reside

PDB Files and Displaying Source Code

In order to allow SE-Viewer to display file names and line numbers, you must have your PDB files installed on the Monitored System. A program database (PDB) file holds debugging and project state information that allows incremental linking of a Debug configuration of your program. Installing PDB Files on your Monitored System will allow SE-Viewer to display file names and line numbers related to a particular defect.

To create your application's PDB Files for release versions:

Open your project solution in Visual Studio .NET
For each module in the solution explorer:

Open the right-click menu and 'Properties'.
In the Property Page navigation menu, select:

Configuration Properties

Build

Open the 'Outputs' section of the properties, and set 'Generate Debugging Information' to 'True'.

To deploy PDB files

For private DLLs, the PDB Files must reside in the same folder as the DLLs on the monitored system.

Installing the Visual Studio Plug-in

Open Internet Explorer to SE-Viewer from the developer's machine with the Visual Studio project
Open 'Tools' menu from the main SE-Viewer menu bar
Select the 'Download wizard...' menu item
Wait for the 'Download Wizard' to open
Select 'Download the AVIcode Intercept VS Plug-in'
Click Next
Click Download to download the MSI installer for the Visual Studio Plug-in
Run the MSI installer from the location that you downloaded to
When the installation is completed, Click Next in the Download Wizard
Click Finish

Using the Visual Studio Plug-in

You must have both Visual Studio .NET and the Intercept Plug-in installed on your machine in order to drill down to the line of source code that caused an event.

Open the SE-Viewer event details window
Click on the description of an event in SE-Viewer to open the Event View dialog window.
In the 'Stack' area of the 'Event Data' area, click on the down arrow () to show details related to parameters and member variables.
Click on the Source tab of the detailed information.
Click on the link next to the 'File' label to go directly to the source code for that event.

Modules List Area

The Module List area displays which modules were loaded in memory at the time the event occurred.

The module data includes the module name, date modified, assembly path and symbols path.

Use the plus () symbol to expand information about each module. The minus () symbol will collapse the information displayed.

Collection Notes

Collection notes provide additional data about any restrictions that apply to the event. If restrictions are in effect, the Collection Notes area will be open and visible when the event details are opened.

Similar Events Tab

This tab may be used to find similar events that are occurring in your system. You may filter for identical events, events where the exception occurred in the same place, events that failed with the same exception class or events that have the same function at the bottom of the call stack.

Filtering and General Information Area

The properties area provides selection criteria for filtering how many and what type of similar events you wish to view.

Event List Area

The event list area will display links to all similar events in a 'Table View' or graphically in a 'Diagram View'.

Finding Similar Exception Events

Find identical events

Grouping exception events by 'Problem' means that all events are identical and have the same call stack.

Open the Event Details window for an exception event
Select the 'Similar events' tab
Select 'Problem' from the 'Similar by:' dropdown list
The 'Problem:' field will automatically refresh with the common root cause
Select the earliest event date that you are interested in the 'From:' date picker ()
Select the latest event date that you are interested in the 'To:' date picker ()
Click Apply
The 'Number of Events:', 'First Event Date:' and 'Last Event Date' fields will automatically update, and the list area will fill with the selected events. Each event in the list is a link to that event's details page.
Click the 'Diagram View' link at the bottom of the page to view a bar chart which will compare the number of events from this problem against the number of events from other problems for the selected time period.

Grouping exception events by 'Action' means that all events had the same root node (where the exception occurred in the stack), e.g. a button click, page load, etc.

Open the Event Details window for an exception event
Select the 'Similar events' tab
Select 'Action' from the 'Similar by:' dropdown list
The 'Action:' field will automatically refresh with the common root node
Select the earliest event date that you are interested in the 'From:' date picker ()
Select the latest event date that you are interested in the 'To:' date picker ()
Click Apply
The 'Number of Events:', 'First Event Date:' and 'Last Event Date' fields will automatically update, and the list area will fill with the selected events. Each event in the list is a link to that event's details page.
Click the 'Diagram View' link at the bottom of the page to view a bar chart which will compare the number of events from this action against the number of events from other actions for the selected time period.

Find similar events by Exception Class

Grouping exception events by 'Exception Class' means that all events threw the same exception, e.g. System.NET.WebException, System.NullReferenceException, System.Data.SqlClient.SqlException, etc.

Open the Event Details window for an exception event
Select the 'Similar events' tab
Select 'Exception Class' from the 'Similar by:' dropdown list
The 'Exception Class:' field will automatically refresh with the common root node
Select the earliest event date that you are interested in the 'From:' date picker ()
Select the latest event date that you are interested in the 'To:' date picker ()
Click Apply
The 'Number of Events:', 'First Event Date:' and 'Last Event Date' fields will automatically update, and the list area will fill with the selected events. Each event in the list is a link to that event's details page.
Click the 'Diagram View' link at the bottom of the page to view a bar chart which will compare the number of events from this exception class against the number of events from other exception classes for the selected time period.

Grouping exception events by 'Failed Function' means that all events had the same function at the bottom of the call stack, e.g. System.Web.HttpApplication.ExecuteStep, ThrowsSoapException(), Microsoft.Samples.Client.Main, etc.

Open the Event Details window for an exception event
Select the 'Similar events' tab
Select 'Failed Function' from the 'Similar by:' dropdown list
The 'Failed Function:' field will automatically refresh with the common root node
Select the earliest event date that you are interested in the 'From:' date picker ()
Select the latest event date that you are interested in the 'To:' date picker ()
Click Apply
The 'Number of Events:', 'First Event Date:' and 'Last Event Date' fields will automatically update, and the list area will fill with the selected events. Each event in the list is a link to that event's details page.
Click the 'Diagram View' link at the bottom of the page to view a bar chart which will compare the number of events from this failed function against the number of events from other failed functions for the selected time period.

Related Events Tab

This tab may be used to find events from an event log that are related to this exception event. To tie event log events to your application:

Open the Intercept Management Console
Select an application, executable or Windows Service node from the list
Right-click the node
Choose 'Properties' from the menu
Go to the Event Log tab
Select the Enable Monitoring checkbox, and set the custom filters

Filtering and General Information Area

The properties area provides time criteria for filtering how many related events you wish to view.

Event List Area

The event list area will display links to all related events. Click on any of the links to view the details for that event.

Finding Related Events

Open the Event Details window for an exception event
Select the 'Related events' tab
Select the time frame within which the other events must have occurred relative to the selected event
Click Apply
The 'Number of Events:', 'First Event Date:' and 'Last Event Date' fields will automatically update, and the list area will fill with the selected events. Each event in the list is a link to that event's details page.

Distributed Chains Tab

The Distributed Chains Tab provides a graphical display of all applications, and their related Web Service and .NET Remoting calls, associated with a client-side business transaction.

General Information Area

The properties area displays information about the events which are displayed in the graphical chain.

Number of Events: The number of exception nodes displayed in the graph
Primary Exception: The same as the root node, which is the location where the exception was raised, which provides information about entry points (external call) for an application: Asp page, Webservice method, Remoting methods and etc.
Last Exception: The left-most event in the event chain

Performance Counters Tab

Troubleshooting performance counters are collected continuously within a 15 minute window. When a .NET exception or performance event occurs, all performance counter data from the 15 minute window leading up to the event are captured and stored. To enable/disable troubleshooting performance counters, or to change the collection window:

Open the Intercept Management Console
Right-click the 'Applications' node
Choose 'Properties' from the menu
Go to the 'Performance Counters' tab

By default, details for the collection period are displayed for:

Process\Private Bytes: Private Bytes is the current size, in bytes, of memory that this process has allocated that cannot be shared with other processes.
Process\% Processor Time: % Processor Time is the percentage of elapsed time that this thread used the processor to execute instructions.
Process\ID Process: ID Process is the unique identifier of this process. ID Process numbers are reused, so they only identify a process for the lifetime of that process.
Process\Virtual Bytes
Processor\% Processor Time: % Processor Time is the percentage of elapsed time that the processor spends to execute a non-Idle thread. It is calculated by measuring the duration of the idle thread that is active in the sample interval, and subtracting that time from interval duration. (Each processor has an idle thread that consumes cycles when no other threads are ready to run). This counter is the primary indicator of processor activity, and displays the average percentage of busy time observed during the sample interval.
Logical Disk\% Free Space: % Free Space is the ratio of the free space available on the logical disk unit to the total usable space provided by the selected logical disk drive. A recommended threshold for % Free Space is 15%.
Network Interface\Output Queue Length: Output Queue Length is the length of the output packet queue (in packets). If this is longer than two, there are delays and the bottleneck should be found and eliminated, if possible. Since the requests are queued by the Network Driver Interface Specification (NDIS) in this implementation, this will always be zero.
Network Interface\Bytes Total/sec: Bytes Total/sec is the rate at which bytes are sent and received over each network adapter, including framing characters. Network Interface\\Bytes Received/sec is a sum of Network Interface\\Bytes Received/sec and Network Interface\\Bytes Sent/sec.
.NET CLR Exceptions\# of Exceptions Thrown/sec: This counter displays the total number of exceptions thrown since the start of the application. These include both .NET exceptions and unmanaged exceptions that get converted into .NET exceptions e.g. null pointer reference exception in unmanaged code would get re-thrown in managed code as a .NET System.NullReferenceException; this counter includes both handled and unhandled exceptions. Exceptions that are re-thrown would get counted again. Exceptions should only occur in rare situations and not in the norm.
.NET CLR Memory\# Bytes in all Heaps: This counter is the sum of four other counters; Gen 0 Heap Size; Gen 1 Heap Size; Gen 2 Heap Size and the Large Object Heap Size. This counter indicates the current memory allocated in bytes on the GC Heaps
.NET CLR Memory\% Time in GC: This counter indicates the percentage of elapsed time spent performing a garbage collection since the last garbage collection cycle. The most common cause of a high value is making too many allocations, which may be the case if you are allocating on a per-request basis for ASP.NET applications. You need to study the allocation profile for your application if this counter shows a higher value.
.NET CLR Memory\# Gen 0 Collections: This counter indicates the number of times the generation 0 objects are garbage-collected from the start of the application. Objects that survive the collection are promoted to Generation 1. You can observe the memory allocation pattern of your application by plotting the values of this counter over time.
.NET CLR Memory\# Gen 1 Collections: This counter indicates the number of times the generation 1 objects are garbage-collected from the start of the application.
.NET CLR Memory\# Gen 2 Collections: This counter indicates the number of times the generation 2 objects are garbage-collected from the start of the application. The generation 2 heap is the costliest to maintain for an application. Whenever there is a generation 2 collection, it suspends all the application threads. You should profile the allocation pattern for your application and minimize the objects in generation 2 heap.
.NET CLR Memory\Allocated Bytes/sec: This counter displays the number of bytes per second allocated on the garbage collection heap. This counter is updated at the end of every garbage collection, not at each allocation. This counter is not an average over time; it displays the difference between the values observed in the last two samples divided by the duration of the sample interval.
Memory\Available MBytes: Available MBytes is the amount of physical memory, in Megabytes, immediately available for allocation to a process or for system use. It is equal to the sum of memory assigned to the standby (cached), free and zero page lists. For a full explanation of the memory manager, refer to MSDN and / or the System Performance and Troubleshooting Guide chapter in the Windows Server 2003 Resource Kit

Memory\Pages/sec

This area also displays the average, minimum and maximum values that occurred during the collection period (5 minutes in this example). To display other counters, select the checkbox next to the counter(s) of interest, and select Apply.

Diagram View

The diagram view displays counter values across a 10 minute interval, with each counter displayed in a unique color. The selection area (above) also serves as the color key for this table.

Table View

The table view display counter values for the last 10 minutes in intervals of 'Frequency' (set to 3 seconds in this example). To change the collection frequency:

Open the Intercept Management Console
Right-click the 'Applications' node
Choose 'Properties' from the menu
Go to the 'Performance Counters' tab
Enter the interval in seconds into the Collection Frequency field.

This number must be at least 30 seconds.

Last update: Thursday, December 09, 2010 02:08:27 PM