Managing the System Registry Hive on Windows Server 2003 and Windows Server 2008 Integrity Systems Published: November 2009 Edition: 1.
Table of Contents About This Document.........................................................................................................5 Intended Audience.................................................................................................................................5 Typographic Conventions......................................................................................................................5 Technical Review.............................................................
List of Figures 1 2 3 4 5 6 7 8 9 10 11 12 4 System Hive ControlSet structure...................................................................................................7 Select Key values.............................................................................................................................8 RegEdit Export screen.....................................................................................................................
About This Document This white paper provides an explanation of the system registry hive and its limitations, and gives some methods for managing those limitations. The opinions in this document may suit some environments more than others. Intended Audience This document is intended for system architects and administrators responsible for managing HP Integrity servers.
Technical Review Introduction The Windows Server 2003 and Windows Server 2008 operating systems have a system registry hive size limitation of 32 MB (for all Service Packs). For most customer configurations, it is unlikely this limit will ever be reached. But in certain circumstances, particularly for customers with large configurations or numbers of SAN disks using multipath MPIO technology, the 32 MB limit is reachable, and can cause the system to fail to boot when restarted.
known failed ControlSet. For the purposes of this document, the CurrentControlSet key is considered an exact replica or alias of one of the other ControlSets, and does not consume any System hive space. The other important key to note is the Select key, as shown in Figure 2. Figure 2 Select Key values In the Select key, the Current and LastKnownGood subkey values are critically important. In Figure 2 you can see the values for both are “1”.
its true size. Figure 3 shows the correct options for saving the System hive. Note the highlighted fields. Figure 3 RegEdit Export screen In the example above, a new file is created called CompactedRegFile. Now, by examining the file system, the size difference between the SYSTEM and CompactedRegFile files can be determined. Figure 4 shows the output of a directory listing.
Causes of Increasing System Hive Size When Windows Server 2003 for Itanium-based Systems was first released, the System hive limit was set to 32 MB by design. This was not changed with the release of Windows Server 2008 for Itanium-based Systems (although it was increased in Windows Server 2008 R2 for Itanium-based Systems). At the inception of Windows Server 2003, Microsoft also introduced a new technology called Multipath I/O (MPIO).
in the Recovery section of this document. While no such hotfix exists for Windows Server 2003, the same result can also be achieved for that operating system. Of these two operating systems, the hive limit is more likely reached in those running Windows Server 2008, mainly because these are newer installations and tend to run the latest software products.
Once the appropriate shell loads, a Command Prompt option becomes available. Figure 5 shows this option in the Windows Preinstallation Environment (the HP Reinstall Media DVD), while Figure 6 shows it in the Windows Recovery Environment.
1. At the command prompt, type regedit and press Enter to run RegEdit. NOTE: This does not load the desired system registry hive, but the registry of the WinPE environment instead. 2. 3. To load the system registry hive, select the HKEY_LOCAL_MACHINE key in the left pane of the RegEdit window by clicking on it. This should highlight that key only. Select File → Load Hive. If the Load Hive option is greyed out, then the HKEY_LOCAL_MACHINE key was not highlighted correctly in the previous step.
Once the target System hive registry is loaded, the method for recovery is different, depending on the operating system: • For Windows Server 2003, see the section: “Recovery Specifics: Windows Server 2003” (page 14). • For Windows Server 2008, see the section: “ Recovery Specifics: Windows Server 2008” (page 15). Recovery Specifics: Windows Server 2003 Recovery in Windows Server 2003 is slightly different from Windows Server 2008, given there is no hotfix to assist.
6. 7. and selecting File → Unload Hive. When the Hive unloads, all changes are automatically saved. Reboot the system. Further deletion of any redundant ControlSet(s) may be necessary at this time. If removal of unnecessary ControlSet(s) is difficult due to complex permissions, then contact Microsoft Support Services, since they can assist in deleting them fully. Since the system is now managing only one ControlSet (despite a second one existing), there will be no additions to the unused ControlSet.
Hotfix KB973817 provides a replacement for Reg.exe that enables compression of the hive and allows the hive's true size to be ascertained from the command line (the graphical utility RegEdit already has this functionality). NOTE: Neither of these hotfixes can be installed on systems running Windows Server 2003 or Windows Server 2008 R2. 5. Perform the steps described in the section, “Creating a Pseudo LastKnownGood System Registry Hive for Windows Server 2003 and Windows Server 2008” (page 16).
Figure 8 General tab 4. In the Triggers tab, change the following settings: • Begin the task: change to “At startup” Also select the following check boxes: • Delay Task for: 1 Minute The Triggers tab is not available on the Windows Server 2003 Task Scheduler, in which case the script must be run at startup. The task is delayed for 60 seconds in Windows Server 2008 to give the system more time to get into a running state.
Figure 9 Triggers tab 18
5. In the Actions tab, change the following settings: • Action: change to “Start a program” • Program/script: change to “lkg.cmd” When finished, the Actions tab should look like this: Figure 10 Actions tab Administrator credentials must be supplied when the Task is added. No reboot is necessary for this task and it will take effect at the next reboot. To confirm the settings and script were created properly, perform a test reboot and confirm that the file system.lkg exists.
Proactive Avoidance This section provides information on how to avoid the System hive 32 MB limit as well as how to install the HP Registry Monitor Service, which provides alerts when the limit is near. Checking Disk Infrastructure Typically the biggest contributor to hive usage is the amount of disks and number of paths to those disks. Administrators should know how many disks and paths a system has, and it's also a good idea to check how many are in the Registry, since a number of stale paths may exist.
an average of approximately three to four paths are presented to each disk. The reality is that some disks may have 32 paths and some may have only 2, giving an average that is not very indicative. What should be very clear here is that for 156 drives to have 787 volumes, something is definitely wrong. Either a number of disks have been deleted and represented, or another program is creating volumes.
event, and logs an Error message in the Windows System Event Log if the System hive approaches its maximum limit. The next few sections explain the Service’s capabilities and how to configure it for more advanced scenarios. Installing the HP Registry Monitor Service The Registry Monitor Service is shipped as part of a larger Management Agent Package (either SNMP Agents 6.2.1, or WBEM Providers 6.5).
Figure 12 Error message Default configuration of the thresholds, the time the System hive is checked, and the frequency of checking should be suitable for most configurations. However, if the System hive is checked and the file size is already over 24 MB, the service has to do some extra work to check the internal Hive size. As a result, the Registry is locked for a few seconds during this process.
Deciding Whether to Implement a Single ControlSet strategy Deploying a single ControlSet strategy (described in section, “System Recovery” (page 11)), can immediately reclaim approximately half the System hive space. You should deploy a single ControlSet strategy if the HP Registry Monitor Service has posted an Error message to the Windows System Event Log (similar to Figure 12), as the Hive is nearing its limit.
