Performing Change Analysis

Change analysis is a basic technique for troubleshooting system and application problems. It’s the process of tracking down configuration changes on a computer.

With Diagnostics, you can build profiles to collect application and system configuration information, audit computers, and then analyze the collected diagnostic data. Diagnostics automatically compares application or system settings against a baseline, at different points in time, or on different computers. This allows you to quickly identify and correct the changes that caused the problem.

Manually Building a Profile

To manually build a profile, you have to decide what information you want to collect. For example:

Do you want to collect information on files? Which files? DLLs, ActiveX controls, shortcuts, or other types of files? Do you want to retrieve copies of files?

Do you want to check the registry for specific keys and values?

What kind of system configuration information do you want to collect? Installed applications? Running services? Loaded modules? Memory usage? Hardware components?

Adding Items

Diagnostics Console includes tools for building lists of items you want to audit, such as files, ActiveX controls, registry keys and values, shortcuts, and environment variables. To simplify the process, you can use regular expressions to select groups of files based on their names (for example, all the DLLs in a folder). You can also define variables to represent computer-specific values such as paths.

Collecting System Resource Information

Setting up a profile to collect system resource information is straightforward. Just check off the items you want to collect.

System Resources

Operating system information.

System configuration information such as the amount of free disk space, what DLLs are loaded into memory, and what applications are running.

Hardware component and configuration information.

Defining Variables

You use variables to represent paths that can vary from computer to computer, such as the location of the Windows system folder or the installation folder of an application.

Variable Definitions

If you want to collect information on files and shortcuts, or retrieve copies of file, you can use variables to locate the files on each computer.

For example, you can use variables to represent the location of the Windows system folder, the installation folder of an application, or the location of the shortcuts on the Start menu.

For application files, you can define a variable that extracts the application install path from the registry, or use a predefined variable such as $(Common Files), which stores the location of the Program Files\Common Files folder.

Adding Files

Auditing PCs

Auditing is the process of collecting diagnostic and configuration information from a computer. For basic change analysis, you can simply audit a computer to see if anything listed in the profile (such as a file) is missing.

For more detailed change analysis, you need at least one baseline audit of a working configuration on a computer. Then when a problem occurs, you can audit the non-working configuration and compare it against the baseline audit.

You can keep just a baseline audit, or you can periodically audit a computer to track configuration changes over time (for example: original configuration, configuration after a operating system upgrade, and so on).

Audits are saved on the Support Site server, so after you audit you do not have to connect to the computer again to diagnose the problem. All the collected diagnostics and configuration information is available from the Support Site server.

To audit a PC:

In the console tree, right-click a computer and then click Audit.

In the Console dialog box, double-click a profile to start the audit.

To batch audit PCs on a network:

On the Action menu, click New and then click Job.

In the box beside the task icon

, type a name for the job.

In the Command list, click Audit.

In the Select Machines box, select the Microsoft Windows Network check box. Or select the check box for one or more domains, or for one or more computers.

In the Select Products box, select the check boxes for the products you want to audit.

In the Job view toolbar, click

to save the job.

In the Job view toolbar, click

to run the job.

You can limit the maximum number of audit reports saved for each application on a computer. When the limit is exceeded, the oldest audit is deleted. To set the limit: on the Action menu click Options, and then click the Maintenance tab.

If the audit request seems to be taking a long time to finish, check the Requests.

If the audit request is listed there, it means that the Diagnostics Agent running on the target computer never picked up the request.

Viewing Audit Reports

Audit Report

To view an audit report:

In the console tree, expand a computer, then expand Protected Applications and expand an application.

Expand Audits and click an audit report.

In the Details view, expand the sections of the audit report you want to view.

If a section name is highlighted in a different color, that means an item is missing in the audit report (for example, a file was not found).

In an audit report, the Variables section contains the values of the variables on the audited computer.

Opening and Editing Copied Files

By default, ASCII and binary files are always attached to the audit report, and opened or edited with their associated applications. However, ASCII files can be included in the body of the audit report, and viewed directly in Diagnostics Console (if the Attach Copied Files preference is set to False). Including copied files in audit reports also allows you to compare the contents and highlight differences.

To view attached files:

In the Details view, expand Copied Files.

Under Copied Files, right-click the file you want to view.

Click Open, Open With, or Edit.

The command you choose depends on the type of file and what actions are associated with that file type. For example, on some systems, Open will execute a javascript (.JS) file, while Edit will simply load the file into a text editor.

If you are not sure, click Open With and click the program you want to use to open the file.

To view included files:

In the Audit view, expand Copied Files.

Under Copied Files, expand the file you want to view.

Expand Contents.

To copy content from included files:

Expand Contents.

Right-click the line you want to copy and click Properties.

Highlight the text you want to copy.

Right-click the highlighted text and click Copy.

Comparing Audit Reports

When you compare two audit reports, Diagnostics automatically highlights any differences between the two reports. This allows you to review configuration changes and quickly spot bad or missing files, wrong file versions, missing registry entries, invalid OS settings, and more.

Changes Visually Highlighted

Against a baseline.

At two different points in time.

Against the configuration of another computer.

The reference report is in the left pane, and the audit report is in the right pane.

To compare audit reports:

In the console tree, click the audit report you want to use as a baseline for the comparison.

In the Details view toolbar, click Compare Audit Reports .

In the right pane, click a computer in the list (this allows you to compare the configuration of one computer against another), then click an audit report in the list of available audits.

Review the differences:

Click

to display only the differences.

Click

to the display the next or previous difference.

By default, the display of the two audit reports is synchronized, so that both reports scroll up and down together, and expand and collapse together. This makes it easier to perform a side-by-side comparison of the reports. Turn this feature off if you want to view each report independently

To turn off	Click
Synchronized vertical scrolling
Synchronized horizontal scrolling
Synchronized expanding and collapsing of report sections

Click Synchronize Item

to display the same item in both reports when display synchronization is turned off.

Filtering Audit Reports

Filtering allows you to filter out irrelevant differences when comparing audit reports. Use filters to reduce the number of differences displayed when you view differences only.

To filter out differences:

In the Details view toolbar, click Options .

In the Filters tab, clear the check boxes for the audit items you want to filter out.

Select when to apply the filter: When viewing differences only or all items, click Always.

When viewing differences only, but not when viewing all items, click when viewing Differences Only.

Diagnostics saves the filter settings, so each time you compare two audit reports the same items are filtered out.

Filtered items are never highlighted when they are different. For example, if you choose to always apply a filter, the filtered items are never highlighted as different, even if they are.

Filters are ignored if you load a single report.

Customizing the Difference Highlighting

To customize difference highlighting:

In the Details view toolbar, click Options and then click the General tab.

Change the colors.


To change the color of	Do this
Items that are different in each report.	In the Color of different items list, click a color.
Items missing in the audit report displayed in the left pane	In the Color of items missing in reference report list, click a color.
Items missing in the audit report displayed in the right pane	In the Color of items missing in audit report list, click a color.

Hiding Files from Non-Active Operating Systems

When more than one operating system is installed on a computer, an audit report contains information for each operating system. You can filter out the non-active operating system when viewing the audit report.

To filter out files from the non-active OS:

In the Details view toolbar, click Options then click the General tab.

Click Ignore files in the non-active operating system.

Printing Audit and Diagnostic Reports

Diagnostics can print audit reports and diagnostic reports. A diagnostic report summarizes the differences between two audit reports. You can also save diagnostic reports (in a .TRD file).

To print an audit report:

View an audit report.

In the Details toolbar, click

and then click Print Reference.

If you are comparing audit reports, Print Reference prints the audit in the left pane, and Print Audit prints the audit in the right pane.