Microsoft: Windows Performance Analyzer

Windows Performance Analysis is sometimes needed. Let me show you a tools that could help you. You know the probably the TaskManager, perfmon.exe and ProcessExplorer.exe

Another tool that is not so well known is WPA (Windows Performance Analyzer).
In Windows 7 this tool was called xperf

You need to install the Windows Performance Toolkit from the Windows Assessment and Deployment Kit (ADK)
http://www.microsoft.com/en-us/download/details.aspx?id=30652
When you have the Debug Tools installed on your client you are able to capture and view performance data

For capturing you don’t need to install anything on the host. It is enough to copy the files to a server, create the logs and do the analysis on your workstation.

Create the logs

Copy the directory “C:\Program Files (x86)\Windows Kits\8.0\Windows Performance Toolkit\” from your client to the server.
You can start the GUI with “WPRUI.exe”
The GUI will change a regkey and require a reboot before it works. It is needed to make sure that you get all the informations.
In my tests it was ok to ignore that and so I use the still existing xperf utility to create the logs.

echo "start xperf"
Xperf -on diag 

echo "press any key to stop xperf and generate file"
pause

xperf -d C:\temp\xperf-output.etl
echo logfile has been created

You can zoom in, look at detail views, filter, … just play around a bit. Depending on your performance issue you need to tell xperf what it should write into the logfile. “diag” is a good starting point. Look at this list:

#General
diag     PROC_THREAD+LOADER+DISK_IO+HARD_FAULTS+DPC+INTERRUPT+CSWITCH+PERF_COUNTER+COMPACT_CSWITCH
Base     PROC_THREAD+LOADER+DISK_IO+HARD_FAULTS+PROFILE+MEMINFO
Latency  PROC_THREAD+LOADER+DISK_IO+HARD_FAULTS+DPC+INTERRUPT+CSWITCH+PROFILE
FileIO   PROC_THREAD+LOADER+DISK_IO+HARD_FAULTS+FILE_IO+FILE_IO_INIT
Network  PROC_THREAD+LOADER+NETWORKTRACE

PROC_THREAD Process and Thread create/delete 
LOADER          Kernel and user mode Image Load/Unload events 
PROFILE         CPU Sample profile 
CSWITCH         Context Switch 
COMPACT_CSWITCH Compact Context Switch 
DISPATCHER      CPU Scheduler 
DPC             DPC Events 
INTERRUPT       Interrupt Events 
SYSCALL         System Calls 
PRIORITY        Priority Change Events 
ALPC            Advanced Local Procedure Call 
PERF_COUNTER    Process Performance Counters 
DISK_IO Disk    I/O 
DISK_IO_INIT    Disk I/O Initiation 
FILE_IO         File System Operation end times and results 
FILE_IO_INIT    File System operations (Create / Open / Close / Read / Write 
HARD_FAULTS     Hard Page Faults 
FILENAME        FileName (FileName create / delete / rundown) 
SPLIT_IO        Split I/O 
REGISTRY        Registry Tracing 
DRIVERS         Driver Events 
POWER           Power Management events 
NETWORKTRACE    Network Events (such as TCP / UDP send and receive) 
VIRT_ALLOC      Virtual Allocation reserve and release 
MEMINFO         Memory List Info 
ALL_FAULTS      All page faults

For a full list you can run

Xperf.exe -providers

So here are some common commands you can use to start the logging:

Overview:
xperf -on diag     

more details:
xperf -on diag+base+latency

a lot of details:
xperf -on diag+base+latency+cswitch+FileIO+Latency+DISK_IO+DISK_IO_INIT+SPLIT_IO+filename+registry+networktrace

storage:
xperf -on FileIO+Latency+DISK_IO+DISK_IO_INIT+SPLIT_IO

Analyze boot process

You can also look into the boot process of a machine.

Xbootmgr –trace boot –postBootDelay 60

The trace file will be located in the same directory as xbootmgr.
To stop the trace you need to run

Xbootmgr -remove

Another handy thing is that you can try to optimize your boot process

Xbootmgr -trace boot -prepsystem

It will boot your computer six times and it will try to optimize the startup process.
Every time you will get a etl file so you can compare them.

View the logs

To view the etl file you can use the old xperfview.exe or the new Windows Performance Analizer (wpa.exe)

This is only a short reference and should give you an overview.

Tagged , , ,