R01.07.01.01 · 任务小类

性能、存储与日志诊断

Performance, storage & log diagnosis

Identify the process, disk hog or log error behind a slowdown or crash and remedy it.

20 条本项目编写的提案 · 分类 v1.1 · 新增基准运行 0 次。下方验证方式与部分得分规则是设计，不是执行结果。

典型应用: Activity Monitor · Task Manager · Console · Event Viewer
小类 GUI 需求标签: HY · 混合

任务提案 · 20

展开查看完整原文与建议检查方式；两种界面均保留提案英文原文。

R01.07.01.01-T01 Kill a CPU-hogging helper tree and disable its startup entry in Task Manager

原始指令

The Windows 11 VM is sluggish. A seeded synthetic process `updsvc_helper.exe` (spawned by `updsvc.exe`) keeps two cores at 100%. Using Task Manager, end the whole process tree, disable `Contoso Updater` in the Startup apps tab, and write the culprit's image name and PID (as shown before ending it) to `C:\Users\agent\Desktop\culprit.txt`. Leave every other seeded process running.

平台: win · Windows
应用: Task Manager
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: click · 指向与点击 nav · 平移 / 缩放 / 滚动 vis · 视觉判断
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 2 / 5

建议验证方式

No updsvc*.exe alive; StartupApproved\Run value for Contoso Updater has disabled flag 03; culprit.txt PID equals the seeded PID logged at setup; 5 decoy processes still alive. taskkill/Stop-Process use is read from the PowerShell/Sysmon log and scored 0 for the GUI milestone.

建议部分得分

40% correct process tree ended (decoys alive); 30% startup entry disabled; 30% culprit.txt name+PID exact

R01.07.01.01-T02 Find a memory-leaking app with Activity Monitor and capture a process sample

原始指令

On the macOS VM, memory pressure is red. One of four seeded background apps (`PhotoIndexer`, `SyncAgent`, `ClipKeeper`, `MetaScan`) leaks ~40 MB/min. Using Activity Monitor, identify it, use View > Sample Process and save the sample to `~/Desktop/leak_sample.txt`, then Force Quit only that app. Write its name to `~/Desktop/leaker.txt`.

平台: mac · macOS
应用: Activity Monitor
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 nav · 平移 / 缩放 / 滚动 vis · 视觉判断
工作产物: WP12 · 答案 / 决策
条件: 未声明
提案难度: 2 / 5

建议验证方式

leaker.txt equals seeded leaker; leak_sample.txt header lists that process name and its PID; leaker not running, other three alive. eslogger exec events detect a CLI bypass (/usr/bin/sample, kill or killall run by the agent), which voids the sample milestone.

建议部分得分

40% correct leaker named; 30% Activity Monitor sample file for the right PID; 30% only leaker quit

R01.07.01.01-T03 Triage an app crash in Event Viewer and save a reusable custom view

原始指令

`LedgerPro.exe` crashes on launch. In Event Viewer, find the newest Application Error (ID 1000) for it and record faulting module, exception code and module version in `C:\triage\crash.json` (keys module, code, version). Then create a custom view named `CrashTriage` that shows Event IDs 1000 and 1026 from the Application log for the last 24 hours, error level only.

平台: win · Windows
应用: Event Viewer
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: click · 指向与点击 nav · 平移 / 缩放 / 滚动 type · 文字与表单
工作产物: WP12 · 答案 / 决策
条件: 未声明
提案难度: 3 / 5

建议验证方式

crash.json fields equal the eventcreate-seeded values (latest of 6 seeded crashes, decoys from other apps). %ProgramData%\Microsoft\Event Viewer\Views\*.xml with name CrashTriage has a QueryList selecting Level=2, EventID 1000 or 1026, timediff 86400000.

建议部分得分

50% crash.json exact (newest event, right app); 30% custom view exists with correct IDs; 20% level and 24 h window right

R01.07.01.01-T04 Stop a crash-looping LaunchAgent found through Console logs

原始指令

A user LaunchAgent `com.example.syncd` respawns every 10 s and floods the log. Using Console (streaming or log archive), identify the error that makes it exit, repair the agent's plist in `~/Library/LaunchAgents/` (the fix is in the plist, not the binary) and reload it so it stays running. Record the original error line in `~/Desktop/syncd_error.txt`.

平台: mac · macOS
应用: Console · Terminal
交互表面: desk · 桌面 GUI term · 终端
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: nav · 平移 / 缩放 / 滚动 vis · 视觉判断 code · 代码与命令
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

`launchctl print gui/501/com.example.syncd` shows state running, runs==1 over a 120 s window, last exit 0; ProgramArguments points to the existing binary; syncd_error.txt contains the seeded 'No such file' message substring. Binary hash unchanged.

建议部分得分

30% error line identified; 40% plist repaired with valid path; 30% agent stable for 120 s

R01.07.01.01-T05 Free 25 GB on a full Windows C: drive without touching user documents

原始指令

C: has under 2 GB free. Seeded culprits include a runaway log folder, old crash dumps, Delivery Optimization cache, and a 12 GB `.vhdx` in Downloads that IT says is disposable; user videos and Documents must stay. Using Storage settings, Disk Cleanup or TreeSize Free, reclaim at least 25 GB. Write each deleted path and size to `C:\triage\freed.csv`.

平台: win · Windows
应用: Storage settings · Disk Cleanup · TreeSize Free
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 nav · 平移 / 缩放 / 滚动 vis · 视觉判断
工作产物: WP08 · 应用 / 系统状态
条件: risk · 高风险 / 不可逆
提案难度: 4 / 5

建议验证方式

Free space on C: >= 27 GB; SHA-256 of all files under Users\*\Videos and Documents unchanged; no system file in the WinSxS/ProgramFiles manifest removed; freed.csv paths exist in the seeded-junk list and sizes within 5%.

建议部分得分

40% free-space threshold met; 40% zero protected files lost; 20% freed.csv accurate

R01.07.01.01-T06 Shrink macOS 'System Data' by clearing snapshots and developer caches

原始指令

Storage settings show 70 GB of System Data on the Mac VM. Seeded causes: three Time Machine local snapshots, 28 GB of Xcode DerivedData, two unused iOS simulator runtimes, and a 6 GB log in `/Library/Logs/Contoso`. Free at least 40 GB using System Settings > Storage, Finder and Xcode's Settings > Platforms. Do not touch `~/Documents` or `~/Pictures`.

平台: mac · macOS
应用: System Settings · Finder · Xcode
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 nav · 平移 / 缩放 / 滚动 vis · 视觉判断
工作产物: WP08 · 应用 / 系统状态
条件: risk · 高风险 / 不可逆
提案难度: 4 / 5

建议验证方式

df shows >= 40 GB more free than baseline; tmutil listlocalsnapshots / returns none; xcrun simctl runtime list lacks the two seeded runtimes; hashes of Documents and Pictures unchanged; the active simulator runtime still present.

建议部分得分

30% snapshots gone; 30% DerivedData and runtimes removed; 20% threshold met; 20% protected data intact

R01.07.01.01-T07 Pinpoint the process and file behind heavy disk I/O in Resource Monitor

原始指令

Users report that File Explorer stalls every few seconds. Open Resource Monitor's Disk tab and find which process writes the most and the exact file it hammers. Save `C:\triage\disk.json` with keys `process`, `pid`, `file`, and `write_Bps` (average write bytes/s over 30 s as displayed). Do not stop the process.

平台: win · Windows
应用: Resource Monitor
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: nav · 平移 / 缩放 / 滚动 vis · 视觉判断 click · 指向与点击
工作产物: WP12 · 答案 / 决策
条件: 未声明
提案难度: 3 / 5

建议验证方式

process, pid and file match the seeded writer (C:\ProgramData\Contoso\cache\idx.tmp) among 3 decoy writers; write_Bps within ±25% of the writer's configured rate; writer still alive.

建议部分得分

40% process+PID; 40% exact file path; 20% rate within tolerance

R01.07.01.01-T08 Use Reliability Monitor to find the update that started a crash streak

原始指令

Since some day last month, `FieldNotes.exe` crashes daily. Using Reliability Monitor, find the first day it crashed and the Windows/app update installed immediately before that. Write `C:\triage\reliability.json` with keys `first_crash_date` (YYYY-MM-DD), `preceding_update` (KB number or product name) and `crash_count_30d`.

平台: win · Windows
应用: Reliability Monitor
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: nav · 平移 / 缩放 / 滚动 vis · 视觉判断 click · 指向与点击
工作产物: WP12 · 答案 / 决策
条件: 未声明
提案难度: 3 / 5

建议验证方式

All three values equal the seeded reliability records (synthetic RacEvents + MsiInstaller events seeded with backdated timestamps). Exact date and update string; count exact.

建议部分得分

35% first crash date; 35% preceding update; 30% 30-day crash count

R01.07.01.01-T09 Build and run a Performance Monitor data collector set for a slow-boot report

原始指令

Create a user-defined Data Collector Set named `SlowBoot` in Performance Monitor with counters `\Processor(_Total)\% Processor Time`, `\PhysicalDisk(_Total)\Avg. Disk sec/Read` and `\Memory\Available MBytes`, 5-second interval, output to `C:\PerfLogs\SlowBoot`. Run it for 2 minutes, stop it, and keep the generated report.

平台: win · Windows
应用: Performance Monitor
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 nav · 平移 / 缩放 / 滚动 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

`logman query SlowBoot` lists exactly the 3 counters, SampleInterval 00:00:05, RootPath as given; a .blg in that path spans 110-140 s with those counters (relog -q). Creation by logman is detected in the command log and fails the GUI milestone (see control pair T10).

建议部分得分

40% set configured with right counters; 30% interval and path; 30% .blg from a 2-minute run

R01.07.01.01-T10 Control pair of T04: repair a crash-looping systemd user service from the journal

原始指令

Control pair of T04 on Ubuntu. The user service `syncd.service` restarts every 10 s. Using journalctl and systemctl only, find the error, fix the unit file in `~/.config/systemd/user/` (the binary is fine), reload and confirm it stays active. Write the original error line to `~/syncd_error.txt`.

平台: lin · Linux
应用: journalctl · systemctl
交互表面: term · 终端
GUI 需求 · 任务设定: CL · CLI 足够
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: code · 代码与命令 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 2 / 5

建议验证方式

`systemctl --user show syncd -p NRestarts` stays constant over 120 s and ActiveState=active; ExecStart path valid; syncd_error.txt contains the seeded message; binary hash unchanged.

建议部分得分

30% error identified; 40% unit fixed; 30% stable 120 s

R01.07.01.01-T11 Stop Spotlight from re-indexing a build folder that pins the CPU

原始指令

`mds_stores` keeps one core busy. Using Activity Monitor, confirm the indexer is the cause; using Console or Activity Monitor's Open Files, find which folder it is indexing. Add that folder (and only it) to Spotlight's Privacy exclusion list in System Settings. Note the folder in `~/Desktop/indexed.txt`.

平台: mac · macOS
应用: Activity Monitor · System Settings · Console
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: click · 指向与点击 nav · 平移 / 缩放 / 滚动 vis · 视觉判断
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

indexed.txt equals the seeded churn folder (~/Builds/nightly, which rewrites 5k files/min); Spotlight exclusions (VolumeConfiguration.plist Exclusions) contain exactly that path added; mds_stores average CPU < 10% over 60 s afterwards. eslogger exec/file events detect mdutil runs or direct writes to VolumeConfiguration.plist, which fail the task (e.g. `mdutil -i off` on the volume).

建议部分得分

30% cause confirmed and folder found; 50% exclusion added for that path only; 20% CPU below threshold

R01.07.01.01-T12 Apply a startup-apps policy in Task Manager to cut boot time

原始指令

The PDF `C:\input\startup_policy.pdf` lists which startup items are allowed on lab PCs. In Task Manager's Startup apps tab, disable every enabled item not on the allowed list and enable any allowed item that is currently disabled. Do not uninstall anything.

平台: win · Windows
应用: Task Manager
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: click · 指向与点击 vis · 视觉判断
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 2 / 5

建议验证方式

StartupApproved Run/StartupFolder values: every allowed item enabled (02), every other of the 11 seeded items disabled (03); Uninstall keys unchanged. Registry edits made outside Task Manager are detected by Procmon writer image != Taskmgr.exe.

建议部分得分

50% non-allowed items disabled; 30% allowed items enabled; 20% nothing uninstalled

R01.07.01.01-T13 Fix a nightly Task Scheduler job that fails with 0x80070002

原始指令

The task `\Contoso\NightlyExport` shows Last Run Result 0x80070002. Using Task Scheduler's History tab and Event Viewer, find why it fails, fix the task (not the script), run it once on demand, and confirm success. The export script lives somewhere under `C:\Ops`.

平台: win · Windows
应用: Task Scheduler · Event Viewer
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 nav · 平移 / 缩放 / 滚动 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

Task XML action path/working directory point to the real script; LastTaskResult 0x0 after an on-demand run; export output file created with today's timestamp; script hash unchanged; trigger and principal unchanged.

建议部分得分

30% cause identified (wrong path/start-in); 40% task action fixed; 30% on-demand run succeeds

R01.07.01.01-T14 Summarize three app crash reports from Console into a triage table

原始指令

Console > Crash Reports contains three `.ips` reports for `Inkwell.app` from different days. For each, record date, exception type, crashed thread number, and top symbolicated frame of the crashed thread in `~/Desktop/triage.csv` (header `date,exception,thread,top_frame`). Then state in `~/Desktop/verdict.txt` whether all three share one root cause (yes/no).

平台: mac · macOS
应用: Console
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: nav · 平移 / 缩放 / 滚动 vis · 视觉判断 type · 文字与表单
工作产物: WP02 · 记录 / 表格
条件: 未声明
提案难度: 3 / 5

建议验证方式

triage.csv rows equal the seeded .ips fields (exact exception type, thread index, frame symbol); verdict equals the seeded truth (two share a frame, one differs -> 'no'). Order-insensitive row match.

建议部分得分

60% rows correct (one third per row); 20% header/format; 20% verdict

R01.07.01.01-T15 Find which shared-svchost service leaks handles and restart only it

原始指令

Handle count of one `svchost.exe` climbs by thousands per hour. It hosts three seeded synthetic services (`CtxIndex`, `CtxPolicy`, `CtxBeacon`). Using Task Manager details/services tabs, Resource Monitor or Process Explorer, determine which service leaks, write its name to `C:\triage\leak.txt`, and restart only that service.

平台: win · Windows
应用: Task Manager · Process Explorer · Services
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: nav · 平移 / 缩放 / 滚动 vis · 视觉判断 click · 指向与点击
工作产物: WP12 · 答案 / 决策
条件: 未声明
提案难度: 4 / 5

建议验证方式

leak.txt equals the seeded leaker; its service start time is after task start; the other two services' start times are unchanged; svchost not killed (no unexpected service restarts in System log 7036 events).

建议部分得分

50% correct service identified; 30% only it restarted; 20% no collateral restarts

R01.07.01.01-T16 Find the process locking a file and release it without killing system processes

原始指令

Deleting `D:\Exports\q3_export.lock` fails with 'file in use'. Use Process Explorer's Find Handle or Resource Monitor's Associated Handles to find the holder, close that application gracefully (File > Exit, not End Task), then delete the lock file. Write holder name and PID to `C:\triage\holder.txt`.

平台: win · Windows
应用: Process Explorer · Resource Monitor
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: nav · 平移 / 缩放 / 滚动 click · 指向与点击 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

Lock file deleted; holder.txt equals the seeded holder (a tray app among 2 decoy apps holding other files); holder exited with code 0 via its own shutdown hook (seeded app logs 'clean exit'); no other process terminated.

建议部分得分

40% correct holder; 40% graceful exit (clean-exit log line); 20% file deleted

R01.07.01.01-T17 Restore a slow Mac to baseline across login items, background tasks and disk

原始指令

A user's Mac is slow after a week of installs. Targets: idle CPU < 15% over 2 minutes, at least 20 GB free, and Login Items & Extensions matching `~/Desktop/allowed_login_items.txt`. Seeded causes include a runaway background item, two unapproved login items, a 25 GB disposable cache and a stuck Photos analysis. Fix it and write `~/Desktop/report.md` listing each cause and the action taken.

平台: mac · macOS
应用: Activity Monitor · System Settings · Finder
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: click · 指向与点击 nav · 平移 / 缩放 / 滚动 vis · 视觉判断
工作产物: WP08 · 应用 / 系统状态
条件: long · 长流程 risk · 高风险 / 不可逆
提案难度: 5 / 5

建议验证方式

Sampled idle CPU < 15% over 120 s; df free >= 20 GB; sfltool dumpbtm login/background items equal the allowed list; user data hashes unchanged; report.md names all 4 seeded causes (string match on item ids).

建议部分得分

25% CPU target; 25% disk target; 30% login items exact; 20% report covers causes

R01.07.01.01-T18 Identify the boot-delaying driver from a Windows Performance Analyzer trace

原始指令

`C:\input\boot.etl` is a boot trace captured with WPR. Open it in Windows Performance Analyzer, find which driver or service contributes the largest delay in the Boot Phases / Generic Events graphs, and write `C:\triage\boot.json` with keys `culprit`, `phase`, `delay_ms`. Then set that (synthetic, non-critical) service to Manual start.

平台: win · Windows
应用: Windows Performance Analyzer · Services
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: nav · 平移 / 缩放 / 滚动 vis · 视觉判断 click · 指向与点击 drag · 拖放
工作产物: WP12 · 答案 / 决策
条件: 未声明
提案难度: 5 / 5

建议验证方式

culprit and phase equal the seeded injected delay (ContosoFilter, PostBoot); delay_ms within ±10% of 18,000; service StartType Manual. xperf, tracerpt and wpaexporter are removed from the VM, and Sysmon plus PowerShell script-block logging detect any other parser (e.g. Get-WinEvent on boot.etl), voiding the culprit/phase milestones.

建议部分得分

50% culprit; 20% phase; 15% delay value; 15% service set to Manual

R01.07.01.01-T19 Mine a unified log archive for an intermittent sync failure

原始指令

Open `~/Desktop/input/sync.logarchive` (24 h) in Console. The app `com.example.drive` fails to sync intermittently. Determine the error domain and code behind the failures, the timestamp of the first occurrence, and the total number of failure events. Write `~/Desktop/sync.json` with keys `domain`, `code`, `first_seen`, `count`.

平台: mac · macOS
应用: Console · log
交互表面: desk · 桌面 GUI term · 终端
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: nav · 平移 / 缩放 / 滚动 vis · 视觉判断 type · 文字与表单
工作产物: WP12 · 答案 / 决策
条件: 未声明
提案难度: 4 / 5

建议验证方式

Values equal the seeded injected events among ~400k unrelated lines and a decoy error with a different code; first_seen within 1 s; count exact. Either Console search or `log show --predicate` is accepted.

建议部分得分

30% domain+code; 30% first_seen; 40% exact count

R01.07.01.01-T20 Triage a blue-screen minidump in WinDbg and disable the faulting test driver

原始指令

The VM bugchecked twice. Open `C:\Windows\Minidump\101426-01.dmp` in WinDbg, run the analysis, and record bugcheck code, faulting module and the first non-OS stack frame in `C:\triage\bsod.json`. The faulting module is a synthetic test driver; disable its service so it no longer loads, and reboot once to confirm no new dump appears.

平台: win · Windows
应用: WinDbg · Services
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: type · 文字与表单 nav · 平移 / 缩放 / 滚动 vis · 视觉判断
工作产物: WP12 · 答案 / 决策
条件: risk · 高风险 / 不可逆
提案难度: 5 / 5

建议验证方式

bsod.json bugcheck, module and frame equal the seeded crash (testdrv.sys, 0xD1); HKLM\...\Services\testdrv Start=4; after reboot, no new minidump and System log shows no testdrv load. Other drivers' Start values unchanged.

建议部分得分

30% bugcheck code; 30% module and frame; 25% driver disabled; 15% clean reboot

已有研究映射

以下沿用研究目录中的基准与小类映射，不是逐题标注、执行记录或产品背书。

同工作流族的小类

R01.07.01.02 网络与应用配置修复