I cannot get the WPR/WPA to show anything other than <unknown> in the Thread Activity Tag column.

I'm using standard profiles CPU+GeneralProfile+XAMLActivity+XAMLApplication.

Are there any special switches that I need to pass to WPR or do I need to do something with gflags? Something else?

HI,

why did the trace rundown truncate my CPU sample data as shown below?

Ah_Chao|| MCSE,VCP,EMCSAe

Hi,

I collected a ETW trace through WPR, after that, I opened the trace with WPA, but there is a big Trace Rundown shown for every graph, what caused this and how to avoid it?

Ah_Chao|| MCSE,VCP,EMCSAe

Hello All,

I get the error "Most likely ran out of memory during load" whenever I try to analyze a trace taken from GPUview using the command 

gpuview Merged.etl

I have also tried setting limit with gpuview /l 3 Merged.etl but it still don't work.

Any idea how to solve this error.

Hi,

I am trying to figure out a way to check when the Explorer Init phase is ending for user sessions logging in to Windows. Anybody knows how Windows actually decide when the Explorer Init phase has ended? I can't rely on Xperf logs since that should be part of a real-time monitoring solution

Regards,

Yoni 

Hello All,

I am looking for some documentation source where dumpfile.xml is explained in detail which we get from converting etl file using tracerpt command. Till now I have only found glimpses of it online. Please let me know if anyone knows about the right place to find it.

Thanks

Hi all,

I'm new in WPA.

My app uses Direct3D to perform camera filter issues.

Besides, I found it can test Video glitch in WPR.

So, how can I analyse my app using it? (Can Video glitch in WPR help to test camera performance?)

Thanks a million.

Nick

at WPA of Win8.1, when I open Window menu I see in the Diagnostic console the message:

Error: There was an error loading Local Preferences from C:\Users\George\AppData\Local\Windows Performance Analyzer\Preferences.xml. Exception: System.IO.FileNotFoundException: ?????? ???????? ???????????? ?? ???????????? ?????? ?????????????? 'C:\Users\George\AppData\Local\Windows Performance Analyzer\Preferences.xml'.
?????????? ??????????????: 'C:\Users\George\AppData\Local\Windows Performance Analyzer\Preferences.xml'
   ???? System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
   ???? System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)
   ???? System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy)
   ???? System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)
   ???? Microsoft.Performance.Shell.RecentFiles.RecentFileService.TryLoadMruLists()

all items at the Window menu apart from Diagnostic console and Details are disabled

Microsoft MVP J# 2004-2010, Borland Spirit of Delphi 2001

Hi,

I'm now having serious I/O performance issue. I saw large gap (milliseconds) between IO Time and Disk Service Time. How to understand this gap? Is there any resource could tell the meaning of the column in WPA? thanks!

Ah_Chao|| MCSE,VCP,EMCSAe

Hi all.  We have a custom wdm USB audio driver that I'd like to profile.  I'm most interested in the URB completion processing code which runs at IRQL_DISPATCH.  I run an app that uses the driver, but I don't seem to be able to isolate the driver's usage statistics.  I understand that calls to / from the driver may be from several different processes including the system process.  Is there a way to group all of the activity for just my driver (module) ?

Hi,

There seems to be a strange issue in Windows Performance Recorder, where it might not load the profile file specified on the command line. To reproduce the problem:

1. Copy SampleWPRControlProfiles.wprp from the installation directory of Windows Performance Toolkit somewhere else e.g. c:\test (this dir will be used in subsequent steps).

2. Introduce an error to the copied profile file (e.g. duplicate a closing tag of one of the elements).

3. Open command prompt as Administrator and navigate to c:\test

4. In the command prompt run 'wpr -start SampleWPRControlProfiles.wprp'.

The problem: Step 4 should produce an error message, but instead the recording is started correctly.

Some additional tests:

I

1. Stop the recording started in step 4 above ('wpr -stop blah.etl').

2. Rename the profile file in c:\test to sample.wprp

3. Run 'wpr -start sample.wprp' in the command prompt

Result:

Now wpr correctly prints error message about incorrect XML format

II

1. Still with copy of profile called sample.wprp run 'wpr -start SampleWPRControlProfiles.wprp' in the command prompt

Result:

Correct error about file not found is displayed.

III

1. Rename the profile file in c:\test to SampleWPRControlProfiles.wprp

2. Rename the original sample profile from the installation directory to _SampleWPRControlProfiles.wprp

3. Run 'wpr -start SampleWPRControlProfiles.wprp' in the command prompt

Result:

Now wpr correctly prints error message about incorrect XML format

So it seems that WPR checks the current working directory when determining whether a profile file exists, but when it comes to loading a profile it first searches the installation directory. So if a profile file with the same name exists in both places the one from the installation directory is loaded (which is very confusing).

I hope this is the right forum to raise this issue as there isn't a forum dedicated to Assessment and Deployment Kit ADK. Please do let me know if there is a better place for this thread and I will move it there.

Also please let me know if you have any questions,

Thanks,

Hi, everyone.

Recently, I'm triying to write a file system minifilter driver to intercept some I/O operations like "IRP_MJ_CREATE" to do some trace logging. I wrote a windows service which is to be enabled at system startup and load the minifilter driver. However, after I installed my minifilter driver, My windows cannot startup. It's stuck doing "startup repair". My platform is windows 7 build 7601, windows kits 6.9.9200.16384.

Here is my DriverEntry function

NTSTATUS
DriverEntry (
    __in PDRIVER_OBJECT DriverObject,
    __in PUNICODE_STRING RegistryPath
    )
{
    NTSTATUS status;
    PSECURITY_DESCRIPTOR sd;
    OBJECT_ATTRIBUTES oa;
    UNICODE_STRING uniString;		//for communication port name
	UNICODE_STRING uniEventName;

    UNREFERENCED_PARAMETER( RegistryPath );

	DbgPrint (" hpp DriverObject base addr :  %X \n",(ULONG)DriverObject->DriverStart);
    DbgPrint (" hpp DriverObject DriverSize : %u  \n",DriverObject->DriverSize);

	thisDriInfo.DriverStart=DriverObject->DriverStart;
	thisDriInfo.DriverSize=DriverObject->DriverSize;

	ExInitializeFastMutex( &LogMutex );

	InitializeListHead( &OutputBufferList );
    KeInitializeSpinLock( &OutputBufferLock );

	MaxRecordsToAllocate = DEFAULT_MAX_RECORDS_TO_ALLOCATE;
	RecordsAllocated = 0;

	ExInitializeNPagedLookasideList( &FreeBufferList,
                                         NULL,
                                         NULL,
                                         0,
                                         RECORD_SIZE,
                                         SPY_TAG,
                                         0 );



    //
    //  Register with FltMgr to tell it our callback routines
    //

	KdPrint(("hpp-----MzfFile-----DriverEntry---\n "));

    status = FltRegisterFilter( DriverObject,
                                &FilterRegistration,&gFilterHandle );

    ASSERT( NT_SUCCESS( status ) );

    if (NT_SUCCESS( status )) {

        //
        //  Start filtering i/o
        //

        status = FltStartFiltering( gFilterHandle );

        if (!NT_SUCCESS( status )) {

            FltUnregisterFilter( gFilterHandle );
        }
    }

	//Communication Port
    status  = FltBuildDefaultSecurityDescriptor( &sd, FLT_PORT_ALL_ACCESS );

    if (!NT_SUCCESS( status )) {
       	goto final;
    }


    status  = FltBuildDefaultSecurityDescriptor( &sd, FLT_PORT_ALL_ACCESS );

    if (!NT_SUCCESS( status )) {
        goto final;
    }


    RtlInitUnicodeString( &uniString, MINISPY_PORT_NAME );

    InitializeObjectAttributes( &oa,&uniString,
                                OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE,
                                NULL,
                                sd );

    status = FltCreateCommunicationPort( gFilterHandle,
                                         &gServerPort,&oa,
                                         NULL,
                                         NPMiniConnect,
                                         NPMiniDisconnect,
                                         NPMiniMessage,
                                         1 );

    FltFreeSecurityDescriptor( sd );

    if (!NT_SUCCESS( status )) {
        goto final;
    }

	RtlInitUnicodeString(&uniEventName, EVENT_NAME);
	//pEvent = IoCreateNotificationEvent(&uniEventName, &gEventHandle);
	//if (pEvent != NULL)
	//{
		//KeClearEvent(pEvent);
	//}
	//ExInitializeFastMutex( &LogMutex );
	//CurrentLog = ExAllocatePool( NonPagedPool, sizeof(*CurrentLog) );
    //if( !CurrentLog ) {

        //return STATUS_INSUFFICIENT_RESOURCES;
		//goto final;
    //}
	//CurrentLog->Len  = 0;
    //CurrentLog->Next = NULL;
    NumLog = 1;
	//DebugLogNum=0;

final :

    if (!NT_SUCCESS( status ) ) {

         if (NULL != gServerPort) {
             FltCloseCommunicationPort( gServerPort );
         }

         if (NULL != gFilterHandle) {
             FltUnregisterFilter( gFilterHandle );
         }
		//if(!CurrentLog){
			//不需要处理， 因为进入这里面的话说明还没初始化成功就挂了
		//}
		ExDeleteNPagedLookasideList( &FreeBufferList );

    }

	KdPrint(("hpp-----MzfFile-----DriverEntry--end-\n "));
    return status;
}

And this is my major I/O event process function:

FLT_POSTOP_CALLBACK_STATUS
PtPostOperationPassThrough (
    _Inout_ PFLT_CALLBACK_DATA Data,
    _In_ PCFLT_RELATED_OBJECTS FltObjects,
    _In_opt_ PVOID CompletionContext,
    _In_ FLT_POST_OPERATION_FLAGS Flags
    )
/*++

Routine Description:

    This routine is the post-operation completion routine for this
    miniFilter.

    This is non-pageable because it may be called at DPC level.

Arguments:

    Data - Pointer to the filter callbackData that is passed to us.

    FltObjects - Pointer to the FLT_RELATED_OBJECTS data structure containing
        opaque handles to this filter, instance, its associated volume and
        file object.

    CompletionContext - The completion context set in the pre-operation routine.

    Flags - Denotes whether the completion is successful or is being drained.

Return Value:

    The return value is the status of the operation.
FilemonHookRoutine
--*/
{


	PFLT_FILE_NAME_INFORMATION    FNameInfo;
	NTSTATUS                      Status;

	CHAR                attributeString[ERRORLEN];
    CHAR                optionString[ERRORLEN];
	CHAR                fileName[MAXPATHLEN] = "";
	CHAR                volumeName[MAXPATHLEN] = "";
	//CHAR                fileAttr[500] = "";


	UNICODE_STRING 		DosName;
	CHAR 				pathName[MAXPATHLEN] = "";

    UNREFERENCED_PARAMETER( FltObjects );
    UNREFERENCED_PARAMETER( CompletionContext );
    UNREFERENCED_PARAMETER( Flags );

    //这部分先预留
	/***
    if(  Data->Iopb->MajorFunction == IRP_MJ_CREATE  ) {

        //
        // Clear any existing fileobject/name association stored in the
        // hash table
        //
        //FilemonFreeHashEntry( FileObject );
        //createPath = TRUE;

    } else if( currentIrpStack->MajorFunction == IRP_MJ_CLOSE ) {

        //
        // We treat close as a special case of create for name querying
        // since calling into NTFS during a close can result in a deadlock.
        //
        //createPath = TRUE;

    } else if( currentIrpStack->MajorFunction == IRP_MJ_CLEANUP &&
               FileObject->Flags & FO_STREAM_FILE ) {

        //
        // Treat cleanup of stream file objects as special create case, because
        // querying them causes NTFS to screwup on NT 4
        //


    } else {

        //createPath = FALSE;
    }

	GETPATHNAME( createPath );

***/

	//DbgPrint(("hpp---------PtPostOperationPassThrough-111-\n"));

	//分析一下这个判断是否通用
	if ( !NT_SUCCESS( Data->IoStatus.Status ) || ( STATUS_REPARSE == Data->IoStatus.Status ) )
    {
	//DbgPrint(("hpp---------PtPostOperationPassThrough-22-\n"));
     //return FLT_POSTOP_FINISHED_PROCESSING;
    }


	Status = FltGetFileNameInformation( Data,
                                      FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT,
                                        &FNameInfo );

	    // If we could not get the name information then exit
    if (!NT_SUCCESS( Status ))
    {
	 //DbgPrint(("hpp---------PtPostOperationPassThrough-333-\n"));
     return FLT_POSTOP_FINISHED_PROCESSING;
    }



	Status = FltParseFileNameInformation( FNameInfo );
	// If we could not get the name information then exit
    if (!NT_SUCCESS( Status ))
    {
	 //DbgPrint(("hpp---------PtPostOperationPassThrough-333---11-\n"));
     return FLT_POSTOP_FINISHED_PROCESSING;
    }

	if (!NPUnicodeStringToChar(&FNameInfo->Name, fileName)){
		DbgPrint(("hpp----- NPUnicodeStringToChar-- -\n"));
		return FLT_POSTOP_FINISHED_PROCESSING;
	}

	if (!NPUnicodeStringToChar(&FNameInfo->Volume, volumeName)){
		DbgPrint(("hpp----- NPUnicodeStringToChar-- -\n"));
		return FLT_POSTOP_FINISHED_PROCESSING;
	}



	if (! FilterVolumeDeviceNameToDosName(&FNameInfo->Volume,&DosName)){
		DbgPrint(("hpp----- NPUnicodeStringToChar-- -\n"));
		return FLT_POSTOP_FINISHED_PROCESSING;
	}


	if (!NPUnicodeStringToChar(&DosName, pathName)){
		DbgPrint(("hpp----- NPUnicodeStringToChar-- -\n"));
		return FLT_POSTOP_FINISHED_PROCESSING;
	}

	//getFullFileName(pathName,fileName);

	strcat_s(pathName,MAXPATHLEN,fileName+strlen(volumeName));

	switch( Data->Iopb->MajorFunction ) {

     case IRP_MJ_CREATE:
		/**
		DbgPrint("hpp IRP_MJ_CREATE\t%s\tAttributes: %s Options:%s\n",
                                         pathName,
                                       CreateAttributesString( Data->Iopb->Parameters.Create.FileAttributes,
                                                               attributeString ),
                                       CreateOptionsString( Data->Iopb->Parameters.Create.Options,
                                                            optionString ));
															**/
		LogRecord("hpp IRP_MJ_CREATE\tbegin\\%s\\end\tAttributes: %s Options:%s\n",
                                         pathName,
                                       CreateAttributesString( Data->Iopb->Parameters.Create.FileAttributes,
                                                               attributeString ),
                                       CreateOptionsString( Data->Iopb->Parameters.Create.Options,
                                                            optionString ));


            // If its an open-by-id we free the hash entry now so that on the next access to
            // the file we'll pick up the file's real name.
            // //这里是预留的代码
            // if( currentIrpStack->Parameters.Create.Options & FILE_OPEN_BY_FILE_ID ) {

                // FilemonFreeHashEntry( FileObject );
            // }


		break;
	case IRP_MJ_READ :
		LogRecord("hpp IRP_MJ_READ begin\\%s\\end\n",pathName  );
		break;
	case IRP_MJ_WRITE:
		LogRecord("hpp IRP_MJ_WRITE begin\\%s\\end \n",pathName  );
		//DbgPrint(("hpp IRP_MJ_WRITE\n"));
		break;
	case IRP_MJ_QUERY_INFORMATION :
		LogRecord("hpp IRP_MJ_QUERY_INFORMATION begin\\%s\\end \n",pathName  );
		//DbgPrint(("hpp IRP_MJ_QUERY_INFORMATION\n"));
		break;
	case IRP_MJ_SET_INFORMATION :
		if (Data->Iopb->Parameters.SetFileInformation.FileInformationClass == FileDispositionInformation){
			//strcpy(fileAttr,"FileDispositionInformation");
			LogRecord(" hpp IRP_MJ_SET_INFORMATION begin\\%s\\end FileDispositionInformation ",pathName );
		}else if (Data->Iopb->Parameters.SetFileInformation.FileInformationClass ==FileRenameInformation){
			//strcpy(fileAttr,"FileRenameInformation");
			LogRecord(" hpp IRP_MJ_SET_INFORMATION begin\\%s\\end FileRenameInformation",pathName );
		}else{
			//strcpy(fileAttr,"Any");
			LogRecord(" hpp IRP_MJ_SET_INFORMATION begin\\%s\\end Any",pathName );
		}

		break;
	case IRP_MJ_QUERY_EA :
		LogRecord("hpp IRP_MJ_QUERY_EA  begin\\%s\\end  \n",pathName  );
		//DbgPrint(("hpp IRP_MJ_QUERY_EA\n"));
		break;
	case IRP_MJ_SET_EA :
		LogRecord("hpp IRP_MJ_SET_EA  begin\\%s\\end  \n",pathName  );
		break;
	 case IRP_MJ_QUERY_VOLUME_INFORMATION:
		LogRecord("hpp IRP_MJ_QUERY_VOLUME_INFORMATION\tbegin\\%s\\end\t%s",
                                       pathName,
                                       VolumeInformation[Data->Iopb->Parameters.QueryVolumeInformation.FsInformationClass] );
		 break;
	 case IRP_MJ_SET_VOLUME_INFORMATION :
		  LogRecord("%hpp IRP_MJ_SET_VOLUME_INFORMATION begin\\%s\\end",
                                        pathName);
                                       // VolumeInformation[Data->Iopb->Parameters.QueryVolumeInformation.FsInformationClass] );
		 break;
	case IRP_MJ_DIRECTORY_CONTROL :
		switch( Data->Iopb->MinorFunction ) {
            case IRP_MN_NOTIFY_CHANGE_DIRECTORY:
                    LogRecord("hpp IRP_MJ_DIRECTORY_CONTROL begin\\%s\\end Change Notify",      pathName);
                break;
			default:
                    LogRecord("hpp IRP_MJ_DIRECTORY_CONTROL begin\\%s\\end",  pathName);
                break;
            }
		break;
	case IRP_MJ_FILE_SYSTEM_CONTROL :
		LogRecord("hpp IRP_MJ_FILE_SYSTEM_CONTROL begin\\%s\\end\n",   fileName);
		break;
 	case  IRP_MJ_DEVICE_CONTROL:
		LogRecord("hpp IRP_MJ_DEVICE_CONTROL begin\\%s\\end \n",   fileName);
		break;
	case IRP_MJ_INTERNAL_DEVICE_CONTROL :
		LogRecord("hpp IRP_MJ_INTERNAL_DEVICE_CONTROL begin\\%s\\end\n",   fileName);
		break;
	case IRP_MJ_CLEANUP :
		LogRecord("hpp IRP_MJ_CLEANUP begin\\%s\\end\n",   fileName);
		break;
	case IRP_MJ_QUERY_QUOTA :
		LogRecord("hpp IRP_MJ_QUERY_QUOTA begin\\%s\\end \n",   fileName);
		break;
	case IRP_MJ_SET_QUOTA :
		LogRecord("hpp IRP_MJ_SET_QUOTA begin\\%s\\end \n",   fileName);
		break;
	case IRP_MJ_CLOSE :
		LogRecord("hpp IRP_MJ_CLOSE begin\\%s\\end \n",   fileName);
		break;

	default:
		break;
	}
	//DbgPrint("hpp---------PtPostOperationPassThrough-444-\n");
    return FLT_POSTOP_FINISHED_PROCESSING;
}

Please help me, thank you

Hi.

I was afraid of asking this, as I know I'll get barked at, but am keen enough now to risk ridicule.

WPT is really awesome, but is limited to PDBs in its symbol lookup. In seeking symbols for proprietary apps; WPA uses dbghelp to successfully load the proprietary non-PDBs, but the WPA GUI is not willing to utilize them.

I understand this may never be implemented for political reasons. Are there any plans to expand WPA beyond PDB restriction?

Lovely toolkit otherwise.

Thanks.

WPA v6.3.9600.16384

The following WPR cmd line fails to generate an etl in the results directory:

wpr.exe -start "GeneralProfile" -onoffscenario Hibernate -filemode -numIterations 3 -onoffresultspath <some-directory-path>

Executing the same command (with same results directory path) except changing the scenario to FastStartup or RebootCycle does generate the etl. Using WPRUI with hibernate or standby scenario successfully generates an etl.

If I specify a temp folder in the WPR cmdline using -recordtempto option, I see two etl files during tracing which disappear on trace completion.

Any ideas why this behavior occurs?

Hi Expert,

Currently we migrated to tracelog.exe from logman to create etw log session, listen to our service providers to trace down events to disk. The reason why we switch to tracelog.exe is to support independent trace session which is a new feature on the windows server 2012 R2. And tracelog.exe expose an -independent option to set this trace mode while logman doesn't support. But we found issue is the *.etl log files generated by tracelog.exe doesn't include manifest info which is different from logman. Is there a way let tracelog to include manifest?

The command i use to start trace session is:

tracelog -start EtwTrace -guid providers.txt -f %traceOutputPath%\%logNamePrefix%_%d.etl -b 64 -independent -newfile 2 -flag 0 -level 255 -ft 1

What i would like to achieve is to get an overview of performance in terms of my applications business domain (Think of a graph of my_operations per second, my_operations queue depth, my_operations for my_job_x(jobname), my_operations start-time, my_operation end-time, etc.)

Currently i find myself first graphing my business domain performance data and then in WPA try to find back where my business domain performance relates to the standard WPR generated performance data. It would be great if this could be combined in a single tool with a single overview.

We are running a Win 2008 R2 server on an Hyper-V host. When I run "xperf" on the server and look at the data in Windows Performance Analyzer (Version 6.3.9600.16384) using the "CPU Usage (Precise)" view, I see that the CPU Usage of many processes is below Zero (in other words: negative). Is this a bug in WPA, or is it tied to the fact that the server is running in Hyper-V? What am I missing here?

WPT is a really great toolkit, but what currently missing for me is that when viewing stack traces, there is no way to know from which exactly offset in a function the next function was called (e.g. when there are several possible places which call the same function). WPA definitely knows this information, but does not show it to us.

Actually it would be even more cool if it let us view local variables and function parameters for a frame in a stack trace!

Hello,

I can't use the WPR except for scenario "general". I've got an error message when i want to capture reboot steps :

I launch the tool, it restarts the system, i fill my credentials, WPR display "Boot trace in progress" window. But when it seems to try to write the ETL file, it shows following message : "Specified file not found error 0x80070002" (it's a translation, my system UI isn't in english!).

I tried to change the target path without success. When i use "general" scenario and "Standby", no error message, the file is present and can be open in WPA. Not with Boot or RebootCycle.

I tried to use WPR in command with same result.

Is someone encountered this kind of issue ? Any ideas ?

Thanks in advance,

Regards