TOCPREVNEXTINDEX

PC-Duo Diagnostics


Collecting Information


In addition to collecting information on files, registry entries, ActiveX controls, self-registered files, shortcuts, and environment variables, a profile can also collect:

Defining Variables

Diagnostics uses variables to specify the paths to files and shortcuts. A variable can represent a file path that can vary from machine to machine. For example, the location of the Windows folder can vary from machine to machine, and different users can install an application in different directories.

If an application stores paths in the registry, in an INI file, or relies on environment variables, Diagnostics can use variables to look for files and shortcuts only in those locations. Otherwise, Diagnostics searches the entire computer. Similarly, if you know that a file should be in the Windows folder, you can use a variable to search only the Windows folder.

Variables can be combined together to form a single expression. Variables can also be combined with regular expressions.

Diagnostics provides the following variable types:

Using Variables

To reference a variable, you type an expression of the form $(Variable Name), where Variable Name is the name you gave to the variable when you defined it.

To reference an environment variable, enclose it in “%(“ and “)”. For example, “%(TEMP)”.

You can use variables with the following items:

Registry Variables

A registry variable represents a value stored under a registry key (either the default value or a named value). You use these variables to specify file paths when you add files, ActiveX controls, files to copy, or shortcuts to a profile. When you use a variable to specify the path to a file or shortcut, Diagnostics looks only in that location for the file. Otherwise, Diagnostics searches all drives for the file.

For example, suppose an application stores its installation directory in the registry as the default value of a key named InstallPath. If you want Diagnostics to look for files in this installation directory, you can define a variable that extracts the default value of the InstallPath key. Then you can use this variable to specify the location of the file.

Using a Variable to Specify the Location of a File

To define a registry variable:
  1. In the profile tree, click Variables.
  2. Click Add.
  3. Click Registry to define a registry variable.
  4. In the Registry Key row, click to open the Registry dialog, and select a registry value.
  5. If you select a registry key, the variable is given the default value of the key (if the default value is set).

  6. In the Variable Name row, click in the Value column and enter a name for the variable.

INI Variables

An INI variable represents a value stored in an INI file. You can use these variables to specify file paths when you add files, files to copy, or shortcuts. For example, suppose an application stores its installation directory in an INI file as follows:

[Paths] 
InstallPath=C:\Program Files\Company\App 

You can then define an INI variable that extracts the value of the InstallPath entry in the PATHS section of the INI file. This INI variable can then be used to specify the location of a file.

When you use a variable to specify the path to a file, Diagnostics looks only in that location for the file. Otherwise, Diagnostics searches all drives for the file and audits every instance it finds.

To define a registry variable:
  1. In the profile tree, click Variables.
  2. Click Add.
  3. Click INI to define an INI variable.
  4. Enter the name of the INI file, the name of the INI section, and the name of INI entry.
  5. In the Variable Name row, click in the Value column and enter a name for the variable.

Other Variable Attributes for INI and Registry Variables

The Variable Value attribute is set when you click OK or Apply. This value is used while building the profile (for example, to find the files you add to the profile). During an audit or protect, the variable value is determined by the settings of the user's computer.

The Default Value attribute is used when the value cannot be extracted from the INI file. For example, when an application is protected, the Default Value attribute is assigned the value of the variable. Then when the application needs to be repaired, the value will be available even if it cannot be found in the registry.

The Extract As and Variable Data Type attributes are used to extract folder paths from file names. See Extracting Folders from File Names.

User-Defined Variables

A user-defined variable is a variable that stores a value specified in the profile. If you want to use the same value (for example, a string) in a number of places, you can define a variable to hold this value.

To define a user-defined variable:
  1. In the profile tree, click Variables.
  2. Click Add.
  3. Click User Defined.
  4. In the Variable Name row, click in the Value column and type a name for the variable.
  5. In the Default Value row, click in the Value column and type a value.

Predefined Variables

Predefined variables are variables whose values are supplied by Diagnostics when you audit or protect a computer. Most of the predefined variables provide computer-specific values, such as the location of the Windows folder and the name of the computer.

Predefined System Variables

WinDir

Windows folder (for example, "c:\WinNT").

WinSysDir

Windows system folder (for example, "c:\WinNT\system32").

SystemDrive

Drive where the operating system is installed (for example, "c:\").

CommonFiles

Windows common files folder (for example, "c:\Program Files\Common Files").

ComputerName

Name of the computer (for example, "KIMA").

RootDir

Boot drive (for example, "c:\").

Predefined User-profile Variables

Common Desktop

Location of the shared Desktop folder. For example, %SystemRoot%\Profiles\All Users\Desktop.

Common Documents

Location of the shared Documents folder. For example: C:\Documents and Settings\All Users.WINNTP\Documents.

Common Administrative Tools

Location of the shared Application Data folder. For example, C:\Documents and Settings\All Users\Administrative Tools\.

Common AppData

Location of the shared Application Data folder. For example, C:\Documents and Settings\All Users\Application Data\.

Common Programs

Location of the shared Programs folder. For example, %SystemRoot%\Profiles\All Users\Start Menu\Programs.

Common Start Menu

Location of the shared Start Menu folder. For example, %SystemRoot%\Profiles\All Users\Start Menu.

Common Startup

Location of the shared Startup folder. For example, %SystemRoot%\Profiles\All Users\Start Menu\Programs\Startup.

Common Templates

Location of the shared Templates folder. For example, C:\Documents and Settings\All Users\Templates\.

Personal

Location of the current user's My Documents folder. For example, C:\Documents and Settings\stephen\My Documents\.

AppData

Location of the current user's Application Data folder. For example, C:\Documents and Settings\stephen\Application Data\.

Cookies

Location of the current user's Cookies folder. For example, C:\Documents and Settings\stephen\Cookies\.

Desktop

Location of the current user's Desktop folder. For example, C:\Documents and Settings\stephen\Desktop\.

Favorites

Location of the current user's Favorites folder. For example, C:\Documents and Settings\kima\Favorites\.

NetHood

Location of the current user's NetHood folder. For example, C:\Documents and Settings\kima\NetHood\.

My Pictures

Location of the current user's My Pictures folder. For example, C:\Documents and Settings\kima\My Documents\My Pictures\.

PrintHood

Location of the current user's PrintHood folder. For example, C:\Documents and Settings\kima\PrintHood\.

Recent

Location of the current user's Recent folder. For example, C:\Documents and Settings\kima\Recent\.

SendTo

Location of the current user's SendTo folder. For example, C:\Documents and Settings\kima\SendTo\.

Start Menu

Location of the current user's Start Menu folder. For example, %SystemRoot%\Profiles\%UserName%\Start Menu.

SendTo

Location of the current user's SendTo folder. For example, C:\Documents and Settings\kima\SendTo\.

Templates

Location of the current user's Templates folder. For example, C:\Documents and Settings\kima\Templates\.

Startup

Location of the current user's Startup folder. For example:

%SystemRoot%\Profiles\%UserName%\Start Menu\Programs\Startup.

Local Settings

Location of the current user's Local Settings folder. For example, C:\Documents and Settings\kima\Local Settings\.

Local AppData

Location of the current user's local Application Data folder. For example, C:\Documents and Settings\kima\Local Settings\Application Data\.

Cache

Location of the current user’s Temporary Internet files folder.

History

Location of the current user’s History folder.

Fonts

Location of the system fonts folder. For example, C:\WinNT\Fonts.

Administrative Tools

Location of the current user’s Application Data folder. For example, C:\Documents and Settings\kima\Administrative Tools\.

Environment Variables

You can control where Diagnostics locates files by prefixing a filename with an environment variable. For example, to locate a file in the TEMP directory, you can specify %(TEMP)\myfile.txt.

Typical environment variables that could be useful as variables:

Extracting Folders from File Names

Sometimes, an application does not store its installation path in the registry, but it does store the full path names of some files in its installation folder. You can define a variable that gets the file name from the registry, and then extracts only the path part.

For example, if a registry value is C:\Program Files\MyApp\myapp.exe, you can define a variable that extracts just the C:\Program Files\MyApp part.

To extract the folder from a file name:
  1. Create a new registry variable.
  2. Set the Extract As attribute to Folder. This specifies how to extract the variable value when replacing a variable reference in the profile.
  3. Set the Variable Data Type attribute to File. Variable Data Type specifies what kind of value is stored in the registry key.

For example, if you auto profile the WinZip application, the following variable is defined:

Variable Name
WinZipInstallDir
Extract As
Folder
Registry Key
HKCU\software\nico mak computing\winzip\programs\zip2exe
Variable Value
G:\Program Files\WinZip\WZSEPE32.EXE
Variable Data Type
File

Given this variable definition, $(WinZipInstallDir) evaluates to G:\Program Files\WinZip.

Using Regular Expressions

Use regular expressions to select groups of files based on their names. For example, to select all MFC DLLs in the Windows system directory, you would use the regular expression "^mfc.*\.dll".

Diagnostics audits any file whose name contains a substring that matches the regular expression. So, for example, the regular expression "mfc" matches any file containing the string "mfc"—not just the DLLs, but also files like "mfcuix.hlp" and "MFC Tracer" (a shortcut).

.

The period (.) matches any character. For example, "ie." matches both "ie5" and "ie6". To match an ordinary period, you use the backslash. For example, "\.ini" matches ".ini".

*

The asterisk (*) matches zero or more occurrences of the preceding character. For example, ".*" matches any string of characters, and “.*\.dll” matches all DLLs.

^

The caret (^) matches the beginning of a string. For example, "^reg" matches any string that begins with "reg".

$

The dollar sign ($) matches the end of a string. For example, "ini$" matches any string that ends with "ini". And while "\.ini" matches both "runlog.ini" and "foo.init", "\.ini$" matches only files with a ".ini" extension.

[ ]

Matches a range of characters. For example, "[A-Za-z0-9]" matches any alphanumeric character. "[0-9]*" matches zero or more digits. If the first character is the caret (^), the expression matches any character not in the range. For example [^AB^] matches any character except A, B and the caret itself.

\

Used to escape special characters. For example, "\." matches a period (.) and "\$" matches a dollar sign ($).

Examples

To look for all files that have a .DLL extension:
  1. In the File Name box, type the regular expression “.*\.DLL”.
  2. Click Add with regular expression.
To look for all files in a specific folder:
  1. In the File Name box, type the regular expression “.*\..*”.
  2. Click Add with regular expression.
To look for all files that have a .DLL extension in the Windows system directory:
  1. In the Variables list, click the WinSysDir variable.
  2. In the File Name box, type the regular expression “.*\.DLL”.
  3. Click Add with regular expression.
To look for all files that have a .DLL extension in the Windows system directory and its subfolders:
  1. In the Variables list, click the WinSysDir variable.
  2. Click the Include subfolders check box
  3. In the File Name box, type the regular expression “.*\.DLL”.
  4. Click Add with regular expression.
To look for all files that have a .DLL extension in a subfolder of the Windows system directory:
  1. In the Variables list, click the WinSysDir variable.
  2. In the File Name box, type the regular expression “aSubFolderName\.*\.DLL”.
  3. Click Add with regular expression.

System Resources

Diagnostics can collect a wide variety of information about the configuration of a computer:

To collect system resource information:
  1. In the profile tree, click System Resources.
  2. Select the check boxes for the information you want to collect. Clear the check boxes for information you don’t want to collect.
  3. To select just one or two check boxes under Operating System or System Resources, clear the top-level check box. This clears all check boxes so you can then select the check boxes you want.

    By default, the Network Neighborhood check box (under System Resources) is cleared. Do not select this check box for large networks because. auditing can take a substantial time.

    The system resource information collected by Diagnostics depends on the version of Windows installed. For example, Display Fonts information is collected on Windows 95 and 98, but not on Windows NT or 2000. If Diagnostics does not collect the system resource information you need, use Windows Management Instrumentation (WMI) to collect the required information. See Auditing with Windows Management Instrumentation.

Auditing Files

A profile includes a list of application files that you want to audit. To include files in a profile, you can:

When you audit a file, Diagnostics collects information for all instances of the file found on the computer. Use variables in the file name to collect information for only one specific instance of the file.

To add files:
  1. In the profile tree, click Files.
  2. Click Add.
  3. Locate the folder containing the files you want to add.
  4. Add the files you want to audit:
  5. To add specific files, select the files.

    To add all files whose names match a regular expression, type the regular expression in the File Name box.

  6. If you have defined a variable to represent the location of the files, then in the Variables list, click the variable that represents the location of the files.
  7. If you selected the files, click Add. If you typed a regular expression in the File Name box, click Add with regular expression.
To use a variable to represent the location of the files:

In the Variables list, click the variable.

Note that if you use a variable and regular expressions, you do not have to locate the actual folder containing the files.

To search subfolders for the files:

Click the Include Subfolders check box.

To include files in a profile even if they do not exist on your computer:

Type the file names in the File Name box.

To search network drives and CDROMs:

By default, Diagnostics searches for files on the local hard drives of a user's machine. If you want Diagnostics to also search network or CD-ROM drives by default, set Include Network Drives and Include CDROMS to True in the Audit Preferences.

To add DLL dependencies:
  1. Add a DLL to the profile, click it, and then click Properties.
  2. Click the DLL Dependencies tab to browse the hierarchy of DLLs that your application DLL depends on.
  3. Click Add All to add all the required DLLs to the list at the bottom of the dialog, or click Add Selected Item to add just the selected DLL.
  4. Click OK to add the DLLs to the profile.

Collecting File Version Information

The File Version Information audit preference determines how much file version information is collected during an audit. Setting this attribute to Minimal or Normal reduces the amount of memory and time required to audit files. It also reduces the size of the audit reports, so they load and compare faster.

Minimal

extracts FileVersionProp, FileDescriptionProp, and LegalCopyrightProp.

Normal

extracts the Minimal information plus: CompanyName, InternalName, OriginalFileName, Productname, and ProductVersion.

Full

extracts Normal and Minimal information plus: Comments, FileVersion (not the same as the one above), ProductVersion (not the same as the one above), TradeMarks, PrivateBuild, SpecialBuild, fileFlagsMask, FileFlags, Os, Type, SubType, Translations, and TranslationsCharset.

Auditing ActiveX Controls

A profile can include a list of ActiveX controls (.OCX) and self-registered files (.OCX or .DLL) to audit. For example, you can set up a profile to check that a DLL is registered correctly.

For each ActiveX control listed in the profile, an audit report includes the CLSID and TypeLib information found in the registry, as well as general and file version information.

To add ActiveX controls to a profile:
  1. In the profile tree, click ActiveX Controls and then click Add.
  2. In the Add ActiveX Controls dialog, select the files you want to add and click Add. You can also type the name of a file in the File Name box.

Auditing Registry Keys and Entries

A profile can include a list of registry keys and values to collect during an audit.

Adding Keys and Values

If you add a registry key, Diagnostics adds all values and subkeys under that key, and selects the key. If you add a registry value, Diagnostics adds just the value and selects it.

Selecting Keys and Values

During an audit, Diagnostics gets the selected keys and values. To select a key or value, click the check box for the key or value.

For each selected key, Diagnostics gets all values entered in the registry for the key. If the Recursive Registry Scan audit preference is True, Diagnostics gets all subkeys and values under that key.

Only selected keys and values can be repaired.

Synchronizing

Synchronizing allows you to add missing subkeys and values. For example, after manually adding a single subkey, you may decide you want all the subkeys at the same level. To do this, click the parent key and then click Synchronize.

After you synchronize, you must select the keys and values you want to audit.

Before and After Synchronizing a Key

Restricting Keys

To prevent users from selecting keys such as HKEY_LOCAL_MACHINE\Software and all their subkeys and values, you can build a list of restricted keys. Restricted keys cannot be added or selected.

The list of restricted keys is stored in the file ProfViewer.ini, which you can find in the Diagnostics installation folder.

Auditing Shortcuts

A profile can include a list of shortcuts (.LNK files) to check. For example, you can set up a profile to check that a shortcut exists and that it points to the correct target.

For each shortcut listed in the profile, an audit report includes shortcut properties such as the shortcut's target, arguments, and working directory.

To add shortcuts to a profile:
  1. In the profile tree, click Shortcuts and then click Add.
  2. In the Add Shortcuts dialog, select the shortcut files you want to add and click Add.

You can use variables such as Common Start Menu to represent the location of the shortcut. In the Variables list, click a variable. Click Add to add the shortcut files.

Copying Files

A profile can include a list of files to retrieve during an audit. These files can be text files or binary files.

Unless you use a variable to specify the exact location of the file to copy, Diagnostics copies all occurrences of the file it finds on the computer. Therefore, it is strongly recommended to use variables when specifying files to copy.

Attaching Copied Files

Binary files are always attached to audit reports. And by default, ASCII files are also attached to audit reports (so the audit report contains only a reference to the copied files, which are stored externally in the file system).

Attaching the copied files reduces the size of the audit report and reduces the amount of time required to load the report into Diagnostics Console. It also allows you to use the application associated with the file type to open or edit the file.

You can include copied ASCII files in the audit report file by setting the Attach Copied Files attribute to False. Including copied files in an audit allows you to automatically compare them when you compare audit reports.

However, including copied files increases the size of the audit report and the time required to load the report into Diagnostics Console. It also means you cannot open the file in another application (such as Notepad).

If you are retrieving copies of large files, attach them to the audit report.

Auditing with Windows Management Instrumentation

Windows Management Instrumentation (WMI) is the Microsoft implementation of Web-Based Enterprise Management (WBEM), which is an industry initiative to develop a standard technology for accessing management information. Such management information includes information on the state of system memory, networks, devices, and other information on client status. WMI offers a powerful set of base services that include query-based information retrieval and event notification.

WMI is supported on Windows 2000, XP, and Me, and available as an optional install for Windows 95 OSR 2, 98, and NT4 SP5.

WMI Components

An application profile can specify a list of WMI components and their properties to audit. To customize the WMI information audited, you can:

To customize the WMI Components list, you can:

Editing WMI Category Properties

Display name

Caption of the WMI category (referred to as a namespace).

Namespace

Specifies the server path of the namespace.

Editing WMI Component Properties

Display name

Caption of the WMI component.

Query Associators

If True, Diagnostics audits all associated WMI objects.

WMI SQL

SQL statement that specifies what information to retrieve. You can change the name and the value of the WMI SQL property. You can also add new SQL statements for the same object.

For example, to query the NT event log for errors only and separate the result of each query under three different categories: Application Errors, Security Errors and System Errors:

  1. Rename the default WMI SQL to "Application Errors" and modify the SQL statement to:
  2. SELECT * FROM Win32_NTLogEvent WHERE 
    LogFile = "Application" AND Type = "Error" 
    
  3. Add a WMI SQL property and rename it to "Security Errors". Set the WMI SQL statement to:
  4. SELECT * FROM Win32_NTLogEvent WHERE 
    LogFile = "Security" AND Type = "Error" 
    
  5. Add a WMI SQL property and rename it to "System Errors". Set the WMI SQL statement to:
  6. SELECT * FROM Win32_NTLogEvent WHERE 
    LogFile = "System" AND Type = "Error"  
    

For Diagnostics to audit a WMI Component and return information about the component, you must provide at least one WMI SQL property for the component.

Customizing the WMI Components List

To audit a WMI object not listed in the factory default list, you use the Customize feature to first add it to the list.

To add a new component to the list:
  1. Click Customize.
  2. In the Customize dialog, click the check box for component you want to add.
  3. Click Add.
  4. You can change the display name of the object to a more user-friendly name by entering the new name in the Display Name column. (Objects prefixed with a '*', are objects containing a modified Display Name.)

To add several objects at once, hold down the CTRL key and then click each object you want to select. Hold down the SHIFT key to select a range of files. Click Add to add the selected objects.

To add a new category you must edit the UserWMI.INI file and add it under the [Namespaces] section.

To remove a component or category from the list:

Click a WMI component or category and then click Remove. You cannot remove any of the factory default WMI Objects from the list.

WMI INI File Format

The list of WMI categories and components displayed in Diagnostics is defined by the MqWMI.INI and UserWMI.INI files.

If you edit the INI files manually, you must follow to the file format described below so that Diagnostics can load these files. Categories (namespaces) must be added manually to the UserWMI.INI file following the format outlined below. To add a category, you must add an entry under the [Namespaces] section:

Category (Namespace) entry:

[Namespaces]namespace=type:
display name:namespace server path 

where type can have two possible values:

For example:

[Namespaces]CIMV2=0:Win32 Environment:
\\.\root\cimv2 

To add a category's component list, you must add object (class) entries under its corresponding namespace section:

Component (Class) entry:

[namespace]class name=type:
displayname:SQLstatement 

For example:

[CIMV2]Win32_DMAChannel=0:DMA 
Channel:SELECT * FROM
Win32_DMAChannelWin32_IRQResource=0:IRQ 
Resources:SELECT * FROM 
Win32_IRQResourceStoppedManualServices=
1:Stopped Manual 
Services:SELECT * FROM Win32_Service WHERE 
StartMode = "Manual" AND State = "Stopped" 

StoppedManualServices is an example of a custom class that you can add that adheres to the format guidelines.

Auditing Database Information

The Diagnostics/db install option extends the auditing capabilities of Diagnostics to include database configuration information and database content. Diagnostics/db can collect information for any ODBC-compliant database such as Oracle, Microsoft SQL Server, and Microsoft Access.

Due to the nature of how ODBC is implemented, (multiple layers of programs and drivers communicating with each other), troubleshooting can be a challenge.

With Diagnostics/db, when an ODBC call fails, you no longer need to spend hours trying to determine whether it is a problem with client libraries, or a net protocol mismatch, or even a database engine not running, Diagnostics/db can collect all the information required to perform a proper diagnosis in minutes.

ODBC Database Configuration

Diagnostics steps you through the process of specifying what to collect about a user's ODBC installation. The ODBC configuration information is grouped into categories:

System DSNs

Data Source Name, registry security, description, system database, ODBC driver, User, DSN configuration settings, and more.

User DSNs

Data Source Name, registry security, description, system database, ODBC driver, User, DSN configuration settings, and more.

File DSNs

Data Source Name, and file information (location, size, attributes).

ODBC Drivers

File version information (file name, location, file version, attributes, and more), API level, ODBC driver version, SQL level, and more.

Database Connection Information

Diagnostics/db can retrieve data from any database table a user has access to read. The Database Connection Editor provides three ways to retrieve data from a database:

By selecting tables

Diagnostics returns the content of the selected tables.

By selecting stored procedures

Diagnostics returns the result of running the stored procedure.

By specifying an SQL statement

Diagnostics returns the result of running the SQL statement.

With Database Connection Information, you can add new connections and edit or remove existing connections.

To add a database connection:
  1. In the Database Connections dialog, click Add.
  2. The Database Connection Editor opens to allow you to create a new Database Connection.

  3. In the Type list, click the type of connection.
  4. For an ODBC connection, click Browse and then click the type of DSN.
User DSN

Click a user DSN and click OK.

System DSN

Click a system DSN (if any) and click OK.

File DSN

In the Look in Drive list click a drive, then click a file DSN and click OK.

SQL Server

Enter the names of the SQL server and the database, a user ID and password, and then click OK. You can use variables in any of the fields.

No DSN

Enter a connection string that will open the database. For example:

DRIVER=SQL Server;SERVER=YourServer;
UID=YourLogonName;PWD=YourPassword;
APP=Microsoft®Access;WSID=YOURMACHINE;
DATABASE=YOURDATABASE) 

You can use variables in the connection string.

Selecting Data to Collect

You can select the data to be collected from the connection as Tables, Procedures and SQL Statements.

To select tables:
To select procedures:
To enter SQL statements:
  1. Under SQL Statements, click Add to add a query to your connection.
  2. Under Edit SQL Statement, type a name and SQL statement (for example: Select * from tblAttachments).
  3. You can use variables in the SQL statement.

  4. Click Test to view the results of your query in your default Web browser.
  5. When you are satisfied with the query, click Apply.

You can add more SQL Statements to your connection, and edit or remove existing ones.

Collecting Diagnostics for IIS

You can collect information about the Web sites, virtual directories, FTP sites, and SMTP servers on an IIS Web server.

To collect IIS diagnostics:
  1. In the profile tree (Details view), click Audit Preferences.
  2. In the Value list of the Internet Information Server attribute, click True.

Collecting Security Information

You can collect files, shares, and registry security information.

To collect security information:
  1. In the profile tree (Details view), under Audit Preferences, click Security.
  2. Set the Include File Security, Include Registry Security, or Include Share Security attribute to True.

Vector Logo
Vector Networks
http://www.vector-networks.com
Voice: +44 (0) 1827 67333
Fax: +44 (0) 1827 67068
info@vector-networks.co.uk
TOCPREVNEXTINDEX