|
|
Collecting Information
In addition to collecting information on files, registry entries, ActiveX controls, self-registered files, shortcuts, and environment variables, a profile can also collect:
- System, operating system, and hardware information.
- Copies of text and binary files. For example, you can get copies of text files such as .INI, .SYS, and .BAT files.
- Database configuration and connection information.
- Advanced diagnostics from Microsoft Windows systems through Windows Management Instrumentation (WMI).
- Diagnostic information about Microsoft Internet Information Server (IIS).
Defining Variables
Diagnostics uses variables to specify the paths to files and shortcuts. A variable can represent a file path that can vary from machine to machine. For example, the location of the Windows folder can vary from machine to machine, and different users can install an application in different directories.
If an application stores paths in the registry, in an INI file, or relies on environment variables, Diagnostics can use variables to look for files and shortcuts only in those locations. Otherwise, Diagnostics searches the entire computer. Similarly, if you know that a file should be in the Windows folder, you can use a variable to search only the Windows folder.
Variables can be combined together to form a single expression. Variables can also be combined with regular expressions.
Diagnostics provides the following variable types:
- Registry variables that are expanded based on a value stored in the registry.
- INI variables that are expanded based on a value stored in an INI file.
- Predefined variables that are automatically expanded by Diagnostics.
- Environment variables that are expanded based on the value of an environment variable.
- User-defined variables, which act like constants in a profile.
Using Variables
To reference a variable, you type an expression of the form $(Variable Name), where Variable Name is the name you gave to the variable when you defined it.
To reference an environment variable, enclose it in “%(“ and “)”. For example, “%(TEMP)”.
You can use variables with the following items:
- File names of files, shortcuts, ActiveX controls, and files to copy (to specify computer-specific paths)
- Definitions of Variables
You can use INI, Registry, Pre-defined, and Environment variables in the definitions of INI and Registry variables.
- Values of the Pre-audit Application and Post-audit Application audit preferences.
- Self-repair rules for files, ActiveX controls, shortcuts.
- Repair rule conditions.
- Database Information: database connection names, SQL statements, SQL server attributes, and SQL connection strings.
Registry Variables
A registry variable represents a value stored under a registry key (either the default value or a named value). You use these variables to specify file paths when you add files, ActiveX controls, files to copy, or shortcuts to a profile. When you use a variable to specify the path to a file or shortcut, Diagnostics looks only in that location for the file. Otherwise, Diagnostics searches all drives for the file.
For example, suppose an application stores its installation directory in the registry as the default value of a key named InstallPath. If you want Diagnostics to look for files in this installation directory, you can define a variable that extracts the default value of the InstallPath key. Then you can use this variable to specify the location of the file.
Using a Variable to Specify the Location of a File
![]()
To define a registry variable:
- In the profile tree, click Variables.
- Click Add.
- Click Registry to define a registry variable.
- In the Registry Key row, click
to open the Registry dialog, and select a registry value.
If you select a registry key, the variable is given the default value of the key (if the default value is set).
- In the Variable Name row, click in the Value column and enter a name for the variable.
INI Variables
An INI variable represents a value stored in an INI file. You can use these variables to specify file paths when you add files, files to copy, or shortcuts. For example, suppose an application stores its installation directory in an INI file as follows:
You can then define an INI variable that extracts the value of the InstallPath entry in the PATHS section of the INI file. This INI variable can then be used to specify the location of a file.
When you use a variable to specify the path to a file, Diagnostics looks only in that location for the file. Otherwise, Diagnostics searches all drives for the file and audits every instance it finds.
To define a registry variable:
Other Variable Attributes for INI and Registry Variables
The Variable Value attribute is set when you click OK or Apply. This value is used while building the profile (for example, to find the files you add to the profile). During an audit or protect, the variable value is determined by the settings of the user's computer.
The Default Value attribute is used when the value cannot be extracted from the INI file. For example, when an application is protected, the Default Value attribute is assigned the value of the variable. Then when the application needs to be repaired, the value will be available even if it cannot be found in the registry.
The Extract As and Variable Data Type attributes are used to extract folder paths from file names. See Extracting Folders from File Names.
User-Defined Variables
A user-defined variable is a variable that stores a value specified in the profile. If you want to use the same value (for example, a string) in a number of places, you can define a variable to hold this value.
To define a user-defined variable:
Predefined Variables
Predefined variables are variables whose values are supplied by Diagnostics when you audit or protect a computer. Most of the predefined variables provide computer-specific values, such as the location of the Windows folder and the name of the computer.
Predefined System Variables
WinDir
Windows folder (for example, "c:\WinNT").
WinSysDir
Windows system folder (for example, "c:\WinNT\system32").
SystemDrive
Drive where the operating system is installed (for example, "c:\").
CommonFiles
Windows common files folder (for example, "c:\Program Files\Common Files").
ComputerName
Name of the computer (for example, "KIMA").
RootDir
Boot drive (for example, "c:\").
Predefined User-profile Variables
Common Desktop
Location of the shared Desktop folder. For example, %SystemRoot%\Profiles\All Users\Desktop.
Common Documents
Location of the shared Documents folder. For example: C:\Documents and Settings\All Users.WINNTP\Documents.
Common Administrative Tools
Location of the shared Application Data folder. For example, C:\Documents and Settings\All Users\Administrative Tools\.
Common AppData
Location of the shared Application Data folder. For example, C:\Documents and Settings\All Users\Application Data\.
Common Programs
Location of the shared Programs folder. For example, %SystemRoot%\Profiles\All Users\Start Menu\Programs.
Common Start Menu
Location of the shared Start Menu folder. For example, %SystemRoot%\Profiles\All Users\Start Menu.
Common Startup
Location of the shared Startup folder. For example, %SystemRoot%\Profiles\All Users\Start Menu\Programs\Startup.
Common Templates
Location of the shared Templates folder. For example, C:\Documents and Settings\All Users\Templates\.
Personal
Location of the current user's My Documents folder. For example, C:\Documents and Settings\stephen\My Documents\.
AppData
Location of the current user's Application Data folder. For example, C:\Documents and Settings\stephen\Application Data\.
Cookies
Location of the current user's Cookies folder. For example, C:\Documents and Settings\stephen\Cookies\.
Desktop
Location of the current user's Desktop folder. For example, C:\Documents and Settings\stephen\Desktop\.
Favorites
Location of the current user's Favorites folder. For example, C:\Documents and Settings\kima\Favorites\.
NetHood
Location of the current user's NetHood folder. For example, C:\Documents and Settings\kima\NetHood\.
My Pictures
Location of the current user's My Pictures folder. For example, C:\Documents and Settings\kima\My Documents\My Pictures\.
PrintHood
Location of the current user's PrintHood folder. For example, C:\Documents and Settings\kima\PrintHood\.
Recent
Location of the current user's Recent folder. For example, C:\Documents and Settings\kima\Recent\.
SendTo
Location of the current user's SendTo folder. For example, C:\Documents and Settings\kima\SendTo\.
Start Menu
Location of the current user's Start Menu folder. For example, %SystemRoot%\Profiles\%UserName%\Start Menu.
SendTo
Location of the current user's SendTo folder. For example, C:\Documents and Settings\kima\SendTo\.
Templates
Location of the current user's Templates folder. For example, C:\Documents and Settings\kima\Templates\.
Startup
Location of the current user's Startup folder. For example:
%SystemRoot%\Profiles\%UserName%\Start Menu\Programs\Startup.
Local Settings
Location of the current user's Local Settings folder. For example, C:\Documents and Settings\kima\Local Settings\.
Local AppData
Location of the current user's local Application Data folder. For example, C:\Documents and Settings\kima\Local Settings\Application Data\.
Cache
Location of the current user’s Temporary Internet files folder.
History
Location of the current user’s History folder.
Fonts
Location of the system fonts folder. For example, C:\WinNT\Fonts.
Administrative Tools
Location of the current user’s Application Data folder. For example, C:\Documents and Settings\kima\Administrative Tools\.
Environment Variables
You can control where Diagnostics locates files by prefixing a filename with an environment variable. For example, to locate a file in the TEMP directory, you can specify %(TEMP)\myfile.txt.
Typical environment variables that could be useful as variables:
Extracting Folders from File Names
Sometimes, an application does not store its installation path in the registry, but it does store the full path names of some files in its installation folder. You can define a variable that gets the file name from the registry, and then extracts only the path part.
For example, if a registry value is C:\Program Files\MyApp\myapp.exe, you can define a variable that extracts just the C:\Program Files\MyApp part.
To extract the folder from a file name:
For example, if you auto profile the WinZip application, the following variable is defined:
Variable Name WinZipInstallDir Extract As Folder Registry Key HKCU\software\nico mak computing\winzip\programs\zip2exe Variable Value G:\Program Files\WinZip\WZSEPE32.EXE Variable Data Type File
Given this variable definition, $(WinZipInstallDir) evaluates to G:\Program Files\WinZip.
Using Regular Expressions
Use regular expressions to select groups of files based on their names. For example, to select all MFC DLLs in the Windows system directory, you would use the regular expression "^mfc.*\.dll".
Diagnostics audits any file whose name contains a substring that matches the regular expression. So, for example, the regular expression "mfc" matches any file containing the string "mfc"—not just the DLLs, but also files like "mfcuix.hlp" and "MFC Tracer" (a shortcut).
.
The period (.) matches any character. For example, "ie." matches both "ie5" and "ie6". To match an ordinary period, you use the backslash. For example, "\.ini" matches ".ini".
*
The asterisk (*) matches zero or more occurrences of the preceding character. For example, ".*" matches any string of characters, and “.*\.dll” matches all DLLs.
^
The caret (^) matches the beginning of a string. For example, "^reg" matches any string that begins with "reg".
$
The dollar sign ($) matches the end of a string. For example, "ini$" matches any string that ends with "ini". And while "\.ini" matches both "runlog.ini" and "foo.init", "\.ini$" matches only files with a ".ini" extension.
[ ]
Matches a range of characters. For example, "[A-Za-z0-9]" matches any alphanumeric character. "[0-9]*" matches zero or more digits. If the first character is the caret (^), the expression matches any character not in the range. For example [^AB^] matches any character except A, B and the caret itself.
\
Used to escape special characters. For example, "\." matches a period (.) and "\$" matches a dollar sign ($).
Examples
To look for all files that have a .DLL extension:
To look for all files in a specific folder:
To look for all files that have a .DLL extension in the Windows system directory:
To look for all files that have a .DLL extension in the Windows system directory and its subfolders:
To look for all files that have a .DLL extension in a subfolder of the Windows system directory:
System Resources
Diagnostics can collect a wide variety of information about the configuration of a computer:
- System resource information, including displays, drives, installed applications, NT services, printers, startup applications, loaded modules, central processor, running applications, memory, and RAM.
- Operating system information, such as international settings, keyboard, time zone information, and Windows system information.
- Hardware information about components such as CD-ROM drives, disks, displays, hard drive controllers, monitors, ports, and system boards.
To collect system resource information:
- In the profile tree, click System Resources.
- Select the check boxes for the information you want to collect. Clear the check boxes for information you don’t want to collect.
To select just one or two check boxes under Operating System or System Resources, clear the top-level check box. This clears all check boxes so you can then select the check boxes you want.
By default, the Network Neighborhood check box (under System Resources) is cleared. Do not select this check box for large networks because. auditing can take a substantial time.
The system resource information collected by Diagnostics depends on the version of Windows installed. For example, Display Fonts information is collected on Windows 95 and 98, but not on Windows NT or 2000. If Diagnostics does not collect the system resource information you need, use Windows Management Instrumentation (WMI) to collect the required information. See Auditing with Windows Management Instrumentation.Auditing Files
A profile includes a list of application files that you want to audit. To include files in a profile, you can:
- Select files from the folders on your computer or on any other computer in the network neighborhood.
- Add all DLLs that one of your application DLLs depends on.
For an EXE file, Diagnostics automatically collects information about the DLLs that the EXE loads (so you don't have to add the DLLs yourself in Diagnostics Console).
But if you want to collect information for all instances of a DLL on a system, you must add the DLL to the profile.
When you audit a file, Diagnostics collects information for all instances of the file found on the computer. Use variables in the file name to collect information for only one specific instance of the file.
To add files:
- In the profile tree, click Files.
- Click Add.
- Locate the folder containing the files you want to add.
- Add the files you want to audit:
To add specific files, select the files.
To add all files whose names match a regular expression, type the regular expression in the File Name box.
- If you have defined a variable to represent the location of the files, then in the Variables list, click the variable that represents the location of the files.
- If you selected the files, click Add. If you typed a regular expression in the File Name box, click Add with regular expression.
To use a variable to represent the location of the files:
In the Variables list, click the variable.
Note that if you use a variable and regular expressions, you do not have to locate the actual folder containing the files.
To search subfolders for the files:
Click the Include Subfolders check box.
To include files in a profile even if they do not exist on your computer:
Type the file names in the File Name box.
To search network drives and CDROMs:
By default, Diagnostics searches for files on the local hard drives of a user's machine. If you want Diagnostics to also search network or CD-ROM drives by default, set Include Network Drives and Include CDROMS to True in the Audit Preferences.
To add DLL dependencies:
- Add a DLL to the profile, click it, and then click Properties.
- Click the DLL Dependencies tab to browse the hierarchy of DLLs that your application DLL depends on.
- Click Add All to add all the required DLLs to the list at the bottom of the dialog, or click Add Selected Item to add just the selected DLL.
- Click OK to add the DLLs to the profile.
Collecting File Version Information
The File Version Information audit preference determines how much file version information is collected during an audit. Setting this attribute to Minimal or Normal reduces the amount of memory and time required to audit files. It also reduces the size of the audit reports, so they load and compare faster.
Minimal
extracts FileVersionProp, FileDescriptionProp, and LegalCopyrightProp.
Normal
extracts the Minimal information plus: CompanyName, InternalName, OriginalFileName, Productname, and ProductVersion.
Full
extracts Normal and Minimal information plus: Comments, FileVersion (not the same as the one above), ProductVersion (not the same as the one above), TradeMarks, PrivateBuild, SpecialBuild, fileFlagsMask, FileFlags, Os, Type, SubType, Translations, and TranslationsCharset.
Auditing ActiveX Controls
A profile can include a list of ActiveX controls (.OCX) and self-registered files (.OCX or .DLL) to audit. For example, you can set up a profile to check that a DLL is registered correctly.
For each ActiveX control listed in the profile, an audit report includes the CLSID and TypeLib information found in the registry, as well as general and file version information.
To add ActiveX controls to a profile:
Auditing Registry Keys and Entries
A profile can include a list of registry keys and values to collect during an audit.
Adding Keys and Values
If you add a registry key, Diagnostics adds all values and subkeys under that key, and selects the key. If you add a registry value, Diagnostics adds just the value and selects it.
Selecting Keys and Values
During an audit, Diagnostics gets the selected keys and values. To select a key or value, click the check box for the key or value.
For each selected key, Diagnostics gets all values entered in the registry for the key. If the Recursive Registry Scan audit preference is True, Diagnostics gets all subkeys and values under that key.
Only selected keys and values can be repaired.
Synchronizing
Synchronizing allows you to add missing subkeys and values. For example, after manually adding a single subkey, you may decide you want all the subkeys at the same level. To do this, click the parent key and then click Synchronize.
After you synchronize, you must select the keys and values you want to audit.
Before and After Synchronizing a Key
![]()
Restricting Keys
To prevent users from selecting keys such as HKEY_LOCAL_MACHINE\Software and all their subkeys and values, you can build a list of restricted keys. Restricted keys cannot be added or selected.
The list of restricted keys is stored in the file ProfViewer.ini, which you can find in the Diagnostics installation folder.
Auditing Shortcuts
A profile can include a list of shortcuts (.LNK files) to check. For example, you can set up a profile to check that a shortcut exists and that it points to the correct target.
For each shortcut listed in the profile, an audit report includes shortcut properties such as the shortcut's target, arguments, and working directory.
To add shortcuts to a profile:
You can use variables such as Common Start Menu to represent the location of the shortcut. In the Variables list, click a variable. Click Add to add the shortcut files.
Copying Files
A profile can include a list of files to retrieve during an audit. These files can be text files or binary files.
Unless you use a variable to specify the exact location of the file to copy, Diagnostics copies all occurrences of the file it finds on the computer. Therefore, it is strongly recommended to use variables when specifying files to copy.
Attaching Copied Files
Binary files are always attached to audit reports. And by default, ASCII files are also attached to audit reports (so the audit report contains only a reference to the copied files, which are stored externally in the file system).
Attaching the copied files reduces the size of the audit report and reduces the amount of time required to load the report into Diagnostics Console. It also allows you to use the application associated with the file type to open or edit the file.
You can include copied ASCII files in the audit report file by setting the Attach Copied Files attribute to False. Including copied files in an audit allows you to automatically compare them when you compare audit reports.
However, including copied files increases the size of the audit report and the time required to load the report into Diagnostics Console. It also means you cannot open the file in another application (such as Notepad).
If you are retrieving copies of large files, attach them to the audit report.
Auditing with Windows Management Instrumentation
Windows Management Instrumentation (WMI) is the Microsoft implementation of Web-Based Enterprise Management (WBEM), which is an industry initiative to develop a standard technology for accessing management information. Such management information includes information on the state of system memory, networks, devices, and other information on client status. WMI offers a powerful set of base services that include query-based information retrieval and event notification.
WMI is supported on Windows 2000, XP, and Me, and available as an optional install for Windows 95 OSR 2, 98, and NT4 SP5.
WMI Components
An application profile can specify a list of WMI components and their properties to audit. To customize the WMI information audited, you can:
To customize the WMI Components list, you can:
Editing WMI Category Properties
Display name
Caption of the WMI category (referred to as a namespace).
Namespace
Specifies the server path of the namespace.
Editing WMI Component Properties
Display name
Caption of the WMI component.
Query Associators
If True, Diagnostics audits all associated WMI objects.
WMI SQL
SQL statement that specifies what information to retrieve. You can change the name and the value of the WMI SQL property. You can also add new SQL statements for the same object.
For example, to query the NT event log for errors only and separate the result of each query under three different categories: Application Errors, Security Errors and System Errors:
For Diagnostics to audit a WMI Component and return information about the component, you must provide at least one WMI SQL property for the component.
Customizing the WMI Components List
To audit a WMI object not listed in the factory default list, you use the Customize feature to first add it to the list.
To add a new component to the list:
- Click Customize.
- In the Customize dialog, click the check box for component you want to add.
- Click Add.
You can change the display name of the object to a more user-friendly name by entering the new name in the Display Name column. (Objects prefixed with a '*', are objects containing a modified Display Name.)
To add several objects at once, hold down the CTRL key and then click each object you want to select. Hold down the SHIFT key to select a range of files. Click Add to add the selected objects.
To add a new category you must edit the UserWMI.INI file and add it under the [Namespaces] section.
To remove a component or category from the list:
Click a WMI component or category and then click Remove. You cannot remove any of the factory default WMI Objects from the list.
WMI INI File Format
The list of WMI categories and components displayed in Diagnostics is defined by the MqWMI.INI and UserWMI.INI files.
If you edit the INI files manually, you must follow to the file format described below so that Diagnostics can load these files. Categories (namespaces) must be added manually to the UserWMI.INI file following the format outlined below. To add a category, you must add an entry under the [Namespaces] section:
Category (Namespace) entry:
where type can have two possible values:
For example:
To add a category's component list, you must add object (class) entries under its corresponding namespace section:
Component (Class) entry:
For example:
[CIMV2]Win32_DMAChannel=0:DMA Channel:SELECT * FROM Win32_DMAChannelWin32_IRQResource=0:IRQ Resources:SELECT * FROM Win32_IRQResourceStoppedManualServices= 1:Stopped Manual Services:SELECT * FROM Win32_Service WHERE StartMode = "Manual" AND State = "Stopped"StoppedManualServices is an example of a custom class that you can add that adheres to the format guidelines.
Auditing Database Information
The Diagnostics/db install option extends the auditing capabilities of Diagnostics to include database configuration information and database content. Diagnostics/db can collect information for any ODBC-compliant database such as Oracle, Microsoft SQL Server, and Microsoft Access.
Due to the nature of how ODBC is implemented, (multiple layers of programs and drivers communicating with each other), troubleshooting can be a challenge.
With Diagnostics/db, when an ODBC call fails, you no longer need to spend hours trying to determine whether it is a problem with client libraries, or a net protocol mismatch, or even a database engine not running, Diagnostics/db can collect all the information required to perform a proper diagnosis in minutes.
ODBC Database Configuration
Diagnostics steps you through the process of specifying what to collect about a user's ODBC installation. The ODBC configuration information is grouped into categories:
System DSNs
Data Source Name, registry security, description, system database, ODBC driver, User, DSN configuration settings, and more.
User DSNs
Data Source Name, registry security, description, system database, ODBC driver, User, DSN configuration settings, and more.
File DSNs
Data Source Name, and file information (location, size, attributes).
ODBC Drivers
File version information (file name, location, file version, attributes, and more), API level, ODBC driver version, SQL level, and more.
Database Connection Information
Diagnostics/db can retrieve data from any database table a user has access to read. The Database Connection Editor provides three ways to retrieve data from a database:
By selecting tables
Diagnostics returns the content of the selected tables.
By selecting stored procedures
Diagnostics returns the result of running the stored procedure.
By specifying an SQL statement
Diagnostics returns the result of running the SQL statement.
With Database Connection Information, you can add new connections and edit or remove existing connections.
To add a database connection:
User DSN
Click a user DSN and click OK.
System DSN
Click a system DSN (if any) and click OK.
File DSN
In the Look in Drive list click a drive, then click a file DSN and click OK.
SQL Server
Enter the names of the SQL server and the database, a user ID and password, and then click OK. You can use variables in any of the fields.
No DSN
Enter a connection string that will open the database. For example:
DRIVER=SQL Server;SERVER=YourServer; UID=YourLogonName;PWD=YourPassword; APP=Microsoft®Access;WSID=YOURMACHINE; DATABASE=YOURDATABASE)You can use variables in the connection string.
Selecting Data to Collect
You can select the data to be collected from the connection as Tables, Procedures and SQL Statements.
To select tables:
To select procedures:
To enter SQL statements:
- Under SQL Statements, click Add to add a query to your connection.
- Under Edit SQL Statement, type a name and SQL statement (for example: Select * from tblAttachments).
You can use variables in the SQL statement.
- Click Test to view the results of your query in your default Web browser.
- When you are satisfied with the query, click Apply.
You can add more SQL Statements to your connection, and edit or remove existing ones.
Collecting Diagnostics for IIS
You can collect information about the Web sites, virtual directories, FTP sites, and SMTP servers on an IIS Web server.
To collect IIS diagnostics:
Collecting Security Information
You can collect files, shares, and registry security information.
To collect security information:
![]() Vector Networks http://www.vector-networks.com Voice: +44 (0) 1827 67333 Fax: +44 (0) 1827 67068 info@vector-networks.co.uk |
|
|