Obtain the following information:
- The steps to replicate the issue
- Frequency of the issue
- Number of machines affected
- Differences between affected and non-affected machines
- Role of affected machine (e.g. gateway server, etc.)
- Customer scenario
- Any recent hardware or software changes
- System information (winmsd or msinfo32)
- System and application event log (from the Event Viewer)
- Impact of the issue to the customer
- Any VPN or firewall software installed
- IP address(es) of the affected machine(s)
- Registry dump of HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\NSC (not applicable to CFW 1.2/1.25)
- !PfwDump.txt file (run "TmPfw.exe dump"; not applicable to CFW 1.2/1.25)
- If possible, VMware image of the affected machine that can be used to reproduce this issue
Blue Screen of Death (BSOD issues)
- Obtain complete memory dump (preferred) or kernel memory dump.
- If a conflict with a third party driver has been identified, obtain information on the third party software, the installation package and the license, if possible.
- If using a special OS version, obtain the relevant symbol files.
System hang issues
- Obtain information on CPU usage and the processes which use the most CPU.
- Generate the complete memory dump at the time of hang.
- If a conflict with a third party driver has been identified, obtain information on the third party software, the installation package and the license, if possible.
Performance issues
- Obtain accurate numbers to demonstrate that the performance goes down because of CFW/NSC.
- Generate the complete memory dump at the time when performance goes down, if possible.
- Obtain information for comparison of performance between starting the CFW/NSC service and stopping it.
Installation issues
- Enable the detailed driver installation log.
- Uninstall the product (OfficeScan or PC-cillin Internet Security).
- Restart the system.
- Collect system information using winmsd or msinfo32.
- Obtain the setupapi.log file in the %WinDir% directory.
IP stack corruption issues
- Enable the detailed driver installation log.
- Uninstall the product (OfficeScan or PC-cillin Internet Security).
- Restart the system.
- Use winmsd or msinfo32 to export system information and check if the IP stack is back.
- Install the product (OfficeScan or PC-cillin Internet Security).
- Restart the system.
- Use winmsd or msinfo32 to export system information and check if the IP stack is back.
- Obtain the setupapi.log file in the %WinDir% directory and the system information files.
Loss of all network connections (not applicable in CFW 1.2/1.25)
- Enable the tmcfw, tmpfw, tmtdi, and tmproxy log.
- Enable wireshark to capture all network packets.
- Stop the Personal Firewall Service and check if the issue persists.
- Disable tmcfw and check if the issue persists.
- Stop tmproxy and check if the issue persists.
- Disable tmtdi and check if the issue persists.
- Note down the step where the issue gets resolved.
- Collect all log files, setupapi.log file in the %WinDir% directory.
Loss of network connection on a specific program or application (not applicable in CFW 1.2/1.25)
- Enable the tmcfw, tmpfw, tmtdi, and tmproxy log.
- Enable wireshark to capture all network packets.
- Stop the Personal Firewall Service and check if the issue persists.
- Disable tmcfw and check if the issue persists.
- Stop tmproxy and check if the issue persists.
- Disable tmtdi and check if the issue persists.
- Note down the step where the issue gets resolved.
- Collect all log files, setupapi.log file in the %WinDir% directory.
- Obtain information on the affected program (e.g. program name, version, network protocol used, ports used, etc.)
Memory leak issues
- Obtain complete memory dump (preferred) or kernel memory dump.
- Obtain the poolmon.log.
Changing the memory dump type to "Complete memory dump"
- Go to Control Panel > System.
- On the Advanced tab, under Startup and Recovery,click Settings.
- Under "Write debugging information", select "Complete Memory Dump".
Manually generating the memory dump file
Refer to the following Microsoft KB article: Windows feature lets you generate a memory dump file by using the keyboard
Getting system information files
Run "winmsd" or "msinfo32".
Getting the poolmon.log
- Use Gflags.exe to enable pool tagging in Windows XP (restart required).
- Run "poolmon" to get the poolmon log.
Enabling the CFW 1.2/1.25 log
- Set the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\CFW
Value: DebugCtrl (REG_DWORD)
Data: 0x111 - Restart the system.
- Collect the C:\cfw_log.txt file.
Enabling the NSC log
TmCFW log:
- Set the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tmcfw\Parameters
Value: DebugCtrl (REG_DWORD)
Data: 0xffffffff - Restart the system.
- Collect the C:\cfw_log.txt file.
TmTDI log:
- Set the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tmtdi\Parameters
Value: Debug (REG_DWORD)
Data: 1 - Restart the system.
- Collect the C:\tdi_log.txt file.
TmPfw log:
- Open the TmPfw.ini file in the product installation directory.
- Add the following section:
[debug]
debug_on=yes
debug_level=90
log_path=c:\tmpfw.log - Restart the Personal Firewall Service.
- Collect the C:\tmpfw.log file.
TmProxy log:
- Open the TmProxy.ini file in the product installation directory.
- Add the following section:
[debug]
debug_on=yes
debug_level=90
log_path=c:\tmproxy.log - Restart the Proxy Service.
- Collect the C:\tmproxy.log file.
Enabling detailed driver installation log
- Open the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup registry subkey.
- If the LogLevel entry does not exist, create the following:
Value: LogLevel (REG_DWORD)
Data: 0x0000ffff - Collect the %WinDir%\setupapi.log file.
Starting or stopping the NSC service (not applicable in CFW 1.2/1.25)
Personal Firewall Service:
Stop command: net stop tmpfw
Start command: net start tmpfw
Proxy Service:
Stop command: net stop tmproxy
Start command: net start tmproxy
Enabling or disabling the NSC drivers
Disable:
- Set the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tmcfw\Parameters
Value: ActionCtrl (REG_DWORD)
Data: 1 - Restart the system.
Enable:
- Delete the ActionCtrl value in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tmcfw\Parameters key.
- Restart the system.