Questions

How do I read what is happening during Log Off / Restart / Shut Down?

+
0 Votes
Locked

How do I read what is happening during Log Off / Restart / Shut Down?

JADavis9
My pc has been wearing me out needing to hit the same 12 End Nows every time I log off or restart. Is there an easy way to record or read what is happening in the background that keeps it from shutting down? I have a very clean pc with a pretty recent clean install of Windows XP and Office 2003 and my programs and all available software and driver updates were just done. Read my bio for more info - it is all in there about this tablet pc. I only use this one pc and it is always here on my desk at home. It has rarely ever been out of the house and it hasn't been out of the house in 3+ years.
Maybe some hardware piece is failing? I don't know but I've gotta get this figured out on this Motion Computing LE1600 tablet.
  • +
    0 Votes
    seanferd

    msconfig

    See the boot.ini tab. Check the boxes noguiboot, sos, and bootlog. Reboot. Bootlog is found in the root of the C: drive. Copy and rename these if you want to refer to them as the bootlog is overwritten each time.

    You can also try play with the Selective Startup options on the General tab. Independently of the above test, of course.

    Have you looked at the event logs? Run box: eventvwr.msc

    Now, if you have to kill processes at each startup/shutdown, start looking for malware. What tasks are these which you must force to end? Those will be your biggest hint. Are they normal and expected processes?

    edit to add: http://support.microsoft.com/kb/833721 , an explanation of the boot options.

    +
    0 Votes
    JADavis9

    Seanferd - I'm not sure what to look at on the event logs you mention. Can you tell me where to look on it and what to look for?
    By the way, I don't think I have any malware issues since I did a clean install pretty recently and started over on this pc. The tasks that I am forced to end are normal. I swear that I had made a list of them, but I can't find it to give you the list right now. Trust me, they are normal stuff like keyboard software, backup software, password/fingerprint reader software, explorer.exe etc.

    +
    0 Votes
    gechurch

    I agree with seanferds suggestions; you should try them first. In particular msconfig (or better, download Autoruns by Sysinternals/Microsoft). Also check your memory/CPU usage. Closing 12 programs down sounds excessive. Whenever I've seen this many programs not responding its been because the system is way under-resourced. Normally adding more RAM fixes the issue. (Note: I started looking at your bio to see if the specs of your tablet are underpowered. In your 364 word bio I saw no mention of your tablet specs. As a rule if you are asking others for help, it's really bad form to expect them to do the groundwork of finding out info like this.... copy the info into your post instead).

    Occasionally this won't solve the problem though. There is a free tool from Microsoft called Xperf that gives you more info. You tell it to run and where to put a log file, then you restart and load the log file into xperf. It gives you a graphical representation of what was going on during shutdown (or startup if you choose), and shows how long Windows was waiting for each program. As an example, to log shutdown you might run:
    xbootmgr -trace shutdown -noPrepReboot -traceFlags BASE+CSWITCH+DRIVERS+POWER -resultPath C:\BootTrace

    One other note - there is a registry setting you can change that tells Windows XP not to wait for programs at shutdown. By default it asks each running program to shutdown and it will wait, indefinitely if needed, until the program has cleanly shut down before Windows will shutdown. The registry key changes this behaviour so it gives each program a set amount of time to close, and if it takes too long it will force shutdown anyway.

    +
    0 Votes
    JADavis9

    Sean. Thanks for this tip on Xperf. I just found it even though you gave it to me a long time ago. I'm gonna do it right now and report back.

    +
    0 Votes
    Strayer

    I had that for a time and now I don't.
    This won't be helpful, but it was one program or another that didn't close completely and so at shutdown, the program would close. There can be more than one program that does that.
    I write down everything I do on computers. I won't remember if I don't.
    The other answers are better.
    I didn't do anything to stop the end program.
    I have XP pro.

    +
    0 Votes
    JADavis9

    So I couldn't install it. Is there anything like it for my Windows XP tablet?

    +
    0 Votes
    gechurch

    Ah, that's right. It's been ages since I've used it, so I forgot about this.

    The command line I gave does work on XP, but the GUI used to analyse the resultant log file won't run; you need a Vista/Win7 PC for that.

    +
    0 Votes
    seanferd

    You can make it even more verbose:
    http://support.microsoft.com/kb/325376

    In event logs, look for errors. Make it easy on yourself by clearing the logs. Then shut down, reboot, and immediately look at the logs.

    +
    0 Votes
    JADavis9

    I'm sorry, but I know nothing about event logs or clearing them. Can you tell me what to do Sean?

    +
    0 Votes
    gechurch

    @Jadavis9

    Right-click on a log file (usually you want Application and System) and choose to clear log.

    Tracking down these sorts of problems can be a real pain. If you aren't overly familiar with clearing event logs and the like I'd suggest taking your PC in to a local IT shop. They should be able to sort it out fairly quickly. I also wouldn't recommend going down the xperf track for the same reason - I've always found it to be a confusing tool to use.

    +
    0 Votes
    JADavis9

    which isn't in the Windows Server 2003 family (I don't think, or is it?).
    I took the steps listed in that article to enable it On a stand-alone computer or single computer

    +
    0 Votes
    JADavis9

    It seemed to be slowing down my Windows log in and while it was logging in, I would see some weird note under my User ID saying Executing C:\Windows\system32\wlnotify.dll ...
    I researched that text and it told me that was related to the verbose thing so I disabled the verbose thing.

    +
    0 Votes
    shane s

    it sounds like your power supply is failing

    +
    0 Votes
    gechurch

    There's little chance of this. Hardware problems by their nature cause random behaviour (for example, whatever program happens to be loaded when a bad page of RAM is used, or when the CPU overheats will crash). This sounds like a repeatable error; every time he logs off he sees the same behaviour. This is very likely to be a software issue.

    +
    1 Votes
    dave

    I had a problem once with workstation hangs at shutdown. It was a component in McAfee virus scan and this app forced the applet to close. It also creates an entry in the Event Viewer. A bandaid fix, but it may help.

    +
    0 Votes
    JADavis9

    Shane, you said "it sounds like your power supply is failing". How would I know if my power supply has any intermittent issues, since it seems to me to be working good all the time? My tablet has been in a stand on my desk most of its life - maybe 5 years. I've only taken it with me in a case a few times several years ago. It charges fine as far as I know, but it is always running on 110v and plugged in.
    I've disabled quite a few StartUp tasks using Ccleaner's Tools > Startup with help from some guys at http://answers.microsoft.com/en-us/windows/forum/windows_xp-performance/12-end-nows-at-every-log-off-or-restart/2cc7069e-90ff-4a72-9d07-f3c4685ff52a and my pc has now really started to behave better than I can even remember it behaving when it was new! I can restart it or log off now with either only a couple of End Nows and sometimes with none at all!

  • +
    0 Votes
    seanferd

    msconfig

    See the boot.ini tab. Check the boxes noguiboot, sos, and bootlog. Reboot. Bootlog is found in the root of the C: drive. Copy and rename these if you want to refer to them as the bootlog is overwritten each time.

    You can also try play with the Selective Startup options on the General tab. Independently of the above test, of course.

    Have you looked at the event logs? Run box: eventvwr.msc

    Now, if you have to kill processes at each startup/shutdown, start looking for malware. What tasks are these which you must force to end? Those will be your biggest hint. Are they normal and expected processes?

    edit to add: http://support.microsoft.com/kb/833721 , an explanation of the boot options.

    +
    0 Votes
    JADavis9

    Seanferd - I'm not sure what to look at on the event logs you mention. Can you tell me where to look on it and what to look for?
    By the way, I don't think I have any malware issues since I did a clean install pretty recently and started over on this pc. The tasks that I am forced to end are normal. I swear that I had made a list of them, but I can't find it to give you the list right now. Trust me, they are normal stuff like keyboard software, backup software, password/fingerprint reader software, explorer.exe etc.

    +
    0 Votes
    gechurch

    I agree with seanferds suggestions; you should try them first. In particular msconfig (or better, download Autoruns by Sysinternals/Microsoft). Also check your memory/CPU usage. Closing 12 programs down sounds excessive. Whenever I've seen this many programs not responding its been because the system is way under-resourced. Normally adding more RAM fixes the issue. (Note: I started looking at your bio to see if the specs of your tablet are underpowered. In your 364 word bio I saw no mention of your tablet specs. As a rule if you are asking others for help, it's really bad form to expect them to do the groundwork of finding out info like this.... copy the info into your post instead).

    Occasionally this won't solve the problem though. There is a free tool from Microsoft called Xperf that gives you more info. You tell it to run and where to put a log file, then you restart and load the log file into xperf. It gives you a graphical representation of what was going on during shutdown (or startup if you choose), and shows how long Windows was waiting for each program. As an example, to log shutdown you might run:
    xbootmgr -trace shutdown -noPrepReboot -traceFlags BASE+CSWITCH+DRIVERS+POWER -resultPath C:\BootTrace

    One other note - there is a registry setting you can change that tells Windows XP not to wait for programs at shutdown. By default it asks each running program to shutdown and it will wait, indefinitely if needed, until the program has cleanly shut down before Windows will shutdown. The registry key changes this behaviour so it gives each program a set amount of time to close, and if it takes too long it will force shutdown anyway.

    +
    0 Votes
    JADavis9

    Sean. Thanks for this tip on Xperf. I just found it even though you gave it to me a long time ago. I'm gonna do it right now and report back.

    +
    0 Votes
    Strayer

    I had that for a time and now I don't.
    This won't be helpful, but it was one program or another that didn't close completely and so at shutdown, the program would close. There can be more than one program that does that.
    I write down everything I do on computers. I won't remember if I don't.
    The other answers are better.
    I didn't do anything to stop the end program.
    I have XP pro.

    +
    0 Votes
    JADavis9

    So I couldn't install it. Is there anything like it for my Windows XP tablet?

    +
    0 Votes
    gechurch

    Ah, that's right. It's been ages since I've used it, so I forgot about this.

    The command line I gave does work on XP, but the GUI used to analyse the resultant log file won't run; you need a Vista/Win7 PC for that.

    +
    0 Votes
    seanferd

    You can make it even more verbose:
    http://support.microsoft.com/kb/325376

    In event logs, look for errors. Make it easy on yourself by clearing the logs. Then shut down, reboot, and immediately look at the logs.

    +
    0 Votes
    JADavis9

    I'm sorry, but I know nothing about event logs or clearing them. Can you tell me what to do Sean?

    +
    0 Votes
    gechurch

    @Jadavis9

    Right-click on a log file (usually you want Application and System) and choose to clear log.

    Tracking down these sorts of problems can be a real pain. If you aren't overly familiar with clearing event logs and the like I'd suggest taking your PC in to a local IT shop. They should be able to sort it out fairly quickly. I also wouldn't recommend going down the xperf track for the same reason - I've always found it to be a confusing tool to use.

    +
    0 Votes
    JADavis9

    which isn't in the Windows Server 2003 family (I don't think, or is it?).
    I took the steps listed in that article to enable it On a stand-alone computer or single computer

    +
    0 Votes
    JADavis9

    It seemed to be slowing down my Windows log in and while it was logging in, I would see some weird note under my User ID saying Executing C:\Windows\system32\wlnotify.dll ...
    I researched that text and it told me that was related to the verbose thing so I disabled the verbose thing.

    +
    0 Votes
    shane s

    it sounds like your power supply is failing

    +
    0 Votes
    gechurch

    There's little chance of this. Hardware problems by their nature cause random behaviour (for example, whatever program happens to be loaded when a bad page of RAM is used, or when the CPU overheats will crash). This sounds like a repeatable error; every time he logs off he sees the same behaviour. This is very likely to be a software issue.

    +
    1 Votes
    dave

    I had a problem once with workstation hangs at shutdown. It was a component in McAfee virus scan and this app forced the applet to close. It also creates an entry in the Event Viewer. A bandaid fix, but it may help.

    +
    0 Votes
    JADavis9

    Shane, you said "it sounds like your power supply is failing". How would I know if my power supply has any intermittent issues, since it seems to me to be working good all the time? My tablet has been in a stand on my desk most of its life - maybe 5 years. I've only taken it with me in a case a few times several years ago. It charges fine as far as I know, but it is always running on 110v and plugged in.
    I've disabled quite a few StartUp tasks using Ccleaner's Tools > Startup with help from some guys at http://answers.microsoft.com/en-us/windows/forum/windows_xp-performance/12-end-nows-at-every-log-off-or-restart/2cc7069e-90ff-4a72-9d07-f3c4685ff52a and my pc has now really started to behave better than I can even remember it behaving when it was new! I can restart it or log off now with either only a couple of End Nows and sometimes with none at all!