SYSTEM ADMINISTRATIONChapter 17

Using a Structured Troubleshooting Strategy

Understanding Troubleshooting

• Troubleshooting is the process of taking a large, complex problem, and, through the use of various techniques, excluding all potential elements until only the actual cause remains.

• Once the actual cause is identified, it can then be fixed.

• Good troubleshooting skills require a commonsense, structured approach.

Establish the Symptoms

• At this stage of the process you are primarily working with symptoms of the actual problem.

• Most symptoms manifest themselves as a failure of some type.

• Failures may or may not be accompanied by one or more error messages.

Open-Ended Questions

• Open-ended questions are designed to elicit additional information. The plan is to engage in a dialog with the user.

• Examples of open-ended questions are:

– What did you observe when the problem happened?

– What were you doing when the error occurred?

Closed-Ended Questions

• With closed-ended questions, you are looking for a specific answer. Many times the answer will be yes or no, or a selection or one or more options.

• Examples of closed-ended questions are:

– Is there an error message?

– What does the error message say?

– Is your computer plugged into the wall?

– Is anyone else having this problem?

– Has any recent changes been made to the computer?

The Basic Questions• Always remember to answer the essential questions:

Who, what, when, where, why, and how. Here are a few examples:

• Who – Who reported the problem?

– Who found the actual problem?

– Whom does the problem affect?

• What– What are the symptoms of this particular problem?

– What type of device is having the problem?

– What was the user doing when he or she first noticed the problem?

(continued)

The Basic Questions(continued)

• When – When was the problem first noticed?– When did the problem actually start?

• Where– Where is the affected device?– Where was the device when the problem occurred? (Used

primarily with laptop computers.)• Why

– Why was this problem noticed?– Why is this problem occurring?

• How– How did this problem occur? – Can you make this problem reoccur? If so, how?

Is There a Problem?

One of the questions you must always answer is, “Does the problem really exist or is the system simply operating the way it is intended?”

Identify the Affected Area

• This section is concerned with the scope of the problem.

• A common question to ask at this point is, “How widespread is the problem?” That is to say, is the problem limited to a single user, group, computer, server, subnet, or an entire network?

• If one user calls the help desk to report a problem, you can usually deduce that it affects only one user or computer.

(continued)

Identify the Affected Area(continued)

• On the other hand, if your phones start ringing off the hook with multiple users reporting the same problem, you can be fairly certain that the problem is more widespread.

• The importance here is how you will focus your troubleshooting efforts.

Establish What Has Changed

• A good question to ask is if anything has changed recently. For example, has any new software been installed on the computer?

• A dialog with other departments within the IT department will help you determine what software upgrades or repairs have been made to user workstations.

• Always keep in mind that the user may have made changes on her or his own, but has decided not to tell you about them.

Could You Do This Before?

• It is important to determine if an employee has been able to perform a task in the past.

• Many times, a user will have certain expectations of a computer system based on home use or past job experiences.

Recreate the Problem

It is always a good idea to see if you can recreate the problem.

Select the Most Probable Cause• Once you have asked a sufficient number of questions,

you should have a fairly good idea where the problem is, although you may not be able to describe what the problem is.

• The problem here is that you rarely have only one possible answer to the problem.

• At this point, you will start using some more techniques. For example, you may need to make a trip to the users’ computers, if possible, and run some diagnostics or utilities to eliminate some of the possibilities.

• Always keep an open mind and avoid jumping to conclusions when it comes to troubleshooting.

What Can You Eliminate?

• By testing one thing at a time, TCP/IP, DHCP, router, and DNS, you have systematically eliminated one problem after another, until only the actual problem remains.

• Through the use of the process of elimination and basic troubleshooting utilities, you have been able to quickly identify where the problem exists.

• Now you must determine what the problem is. That is to say, you know the problem rests with DNS, you just don’t know what the problem is with DNS.

Troubleshooting Tools• Always use all of the troubleshooting tools that are

available to you.

• Most computers provide a either a utility or log files with which to view system problems. These files log or document everything that happens at the server.

• Looking through these log files might direct you to the problem, or at least identify for you the area where the problem is occurring.

Event Viewer• The Windows Event Viewer contains three logs:

Application, Security, and System.– Application

• The application log contains events that are caused by applications or programs.

– Security• The security log records events that relate directly to

system security, such as valid and invalid logon attempts.

– System• The system log contains events that are reported by

system components.

(continued)

Event Viewer(continued)

• The log indicates three different types of entries: Information, Warning, and Error. – Information

• Describes a successful operation. For example, when an application, driver, or service loads successfully, an Information event will be logged.

– Warning• An event that may be an indicator of a possible

future problem. For example, if a system begins to get low on disk space, it will issue a Warning.

(continued)

Event Viewer(continued)

– Error

• Indicates a significant problem. This problem may result in a loss of data or loss of a function. For example, if a device driver fails to load during system startup, an Error will be logged.

• In order to view additional information for a specific event, double-click on the entry in the right pane.

Log Files• Most log files are simple text files that can be

viewed through a text editor such as Notepad.

• These log files normally monitor one particular item or process and report on the successes and failures of that item or process.

• Each operating system contains a number of log files. The easiest way to locate them is to use the search utility for your particular computer.

Formulate a Solution• Once you have a good idea where the problem is, you

can begin formulating a plan of attack to fix it. • This plan should be based on your knowledge of the way

the system is supposed to operate, and any ancillary factors that affect the operation of that particular object.

• Always consider consulting a technical reference when troubleshooting.

• Most major manufacturers of computer hardware and software have a Web site loaded with support information for their products.

• Many times, the problem has already been identified by the manufacturer, who can provide the information or software necessary to fix the problem.

• Based on your knowledge of the systems and your understanding of the problem, you will start to develop one or more solutions to fix the problem.

Implement a Solution

Always try not to make the problem worse.

One Thing at a Time• Implement only one solution at a time. There are

two reasons for this: – First, if you do three things and the problem is

corrected, you really don’t know which of these actions fixed the problem.

– Conversely, if your actions made the problem worse, you really don’t know which one of the actions made the problem worse; therefore, you have to undo all three actions.

• Each step should build on the previous step. For example, if restarting the server does not correct the problem, what is the next most logical step to try that is not destructive? Continue working through these steps until you have resolved the problem.

Consider the User• While you are working to resolve the problem, it is

easy to forget about the person who is actually experiencing the problem, the user.

• When possible, always try to accommodate the user to the extent possible.

• In all cases, keep the user informed on your progress. If you believe that it will take two hours to fix the problem, be sure you communicate that information to the user.

• Be realistic with your time estimates. If you try to make up the time required, it will reflect badly on you as a technician and the IT department as a whole.

Test the Result

• Testing the result means simply, did it work?

• Keep in mind that you should only implement one potential solution at a time.

• After you implement that one solution, try it to see if it works. If not, try another possible solution and then test it.

Recognize the Potential Effects of the Solution

• Will the “fix” that you developed “unfix” something else?

• Occasionally, you will repair one problem only to cause another.

• This is especially prevalent when working with several companies that make competing products.

• Some “side-effect” problems are not obvious.• The best way to head off these problems is to

consider all of the factors involved and to conduct extensive research prior to implementing a new software solution.

(continued)

Recognize the Potential Effects of the Solution (continued)

• Independent discussion groups and good technical references are a great place to start.

• In most cases, real users or administrators of a product moderate these groups. Since these folks have no vested interest in the product, they tend to be more honest about the problems that they have experienced with different manufacturers’ software.

• A good technical reference will inform you of how all network components work together.

Document the Solution• Once the problem is fixed, write down what you did.

Most problems reoccur at some time.

• Once a problem has been successfully resolved, document the problem and the solution in a format that is available to others.

• The documentation can be stored in some type of formal, structured facility or as simply as a notebook of loose-leaf papers.

• Many companies use a knowledge base to document their troubleshooting efforts.

Knowledge Base • A knowledge base is generally a computerized

system that allows you to log reported problems along with the steps a technician took to repair them.

• A knowledge base can range from the very simple to the elaborate.

• The simplest type of knowledge base might be a series of folders or binders containing technical notes that are compiled and maintained by technicians.

• A knowledge base can also be a very sophisticated database-based system that can be queried by keyword or simply asked a question in the form of a text string.

Frequently Asked Questions (FAQs)

• Another simple knowledge base might consist of one or more Web pages made up largely of text that users or technicians can browse for frequently asked questions (FAQs).