Saving Trace Unusually Long

[Michael Marcin]

It takes a very long time to save trace buffers on my work machine.

I'm using the most recent Feb 2 release of UIforETW.

Saving trace to disk...

The trace you have just captured "C:\Users\MICHAE~1.MAR\AppData\Local\Temp\kernel.etl" may contain personally identifiable information, including but not necessarily limited to paths to files accessed, paths to registry accessed and process names. Exact information depends on the events that were logged. Please be aware of this when sharing out this trace with other people.

The trace you have just captured "C:\Users\MICHAE~1.MAR\AppData\Local\Temp\user.etl" may contain personally identifiable information, including but not necessarily limited to paths to files accessed, paths to registry accessed and process names. Exact information depends on the events that were logged. Please be aware of this when sharing out this trace with other people.

Merging trace...

Merged Etl: C:\Users\michael.marcin\Documents\etwtraces\2016-03-07_21-02-58_michael.marcin.etl

Saving the trace took 740.3 s, which is unusually long. Please try metatrace.bat, and share your results on https://groups.google.com/forum/#!forum/uiforetw.

Merging the trace took 804.1s, which is unusually long. This is surprising because renaming of amcache.hve to avoid this worked. Please try metatrace.bat and share this on https://groups.google.com/forum/#!forum/uiforetw

Finished recording trace.

I ran the metatrace batch file.

It completed very quickly in comparison to saving in the UI (under a minute).

The metatrace.etl is about 800 megs.

I don't think I should post it in a public place as it contains some maybe sensitive information.

Here's the dxdiag system information in case it gives a clue.

------------------

System Information

------------------

Time of this report: 3/8/2016, 00:00:11

       Machine name: MMARCINDT01

   Operating System: Windows 7 Enterprise 64-bit (6.1, Build 7601) Service Pack 1 (7601.win7sp1_gdr.151230-0600)

           Language: English (Regional Setting: English)

System Manufacturer: Dell Inc.

       System Model: Precision T5610

               BIOS: BIOS Date: 04/29/14 23:04:21 Ver: A07.00 

          Processor: Intel(R) Xeon(R) CPU E5-2650 v2 @ 2.60GHz (32 CPUs), ~2.6GHz

             Memory: 24576MB RAM

Available OS Memory: 24520MB RAM

          Page File: 18636MB used, 30401MB available

        Windows Dir: C:\Windows

    DirectX Version: DirectX 11

DX Setup Parameters: Not found

   User DPI Setting: Using System DPI

 System DPI Setting: 96 DPI (100 percent)

    DWM DPI Scaling: Disabled

     DxDiag Version: 6.01.7601.17514 64bit Unicode

[Bruce Dawson]

Is this a corp machine? I have a suspicion that bit9 together with saving to a circular memory buffer is the problem.

If you save to a file instead of to a circular memory buffer then this problem should go away. That is the solution I have used, although I do miss the ability to have tracing running continuously. I think this is documented at go/etw. I could customize the warning but since this is a Google specific issue I'm not sure how to do that. Any thoughts?

--
You received this message because you are subscribed to the Google Groups "UIforETW" group.
To unsubscribe from this group and stop receiving emails from it, send an email to uiforetw+u...@googlegroups.com.
To post to this group, send email to uifo...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/uiforetw/bbefae73-a143-450f-9dc9-f87bfc5040b3%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

Bruce Dawson

[Michael Marcin]

It's my work desktop, it's running sophos antivirus.

I tried disabling all scanning and the problem persists.

I just realized that metatrace should be run while saving the UIforETW trace not while profiling the app I was profiling. Doh!

The metatrace gets really large really fast.

1.2 gigs while letting it run for just a few seconds during UIforETW saving

I also realized I can produce roughly the same behavior by starting and immediately saving the trace in the UI.

Merged Etl: C:\Users\michael.marcin\Documents\etwtraces\2016-03-08_01-02-21_michael.marcin.etl

Saving the trace took 129.1 s, which is unusually long. Please try metatrace.bat, and share your results on https://groups.google.com/forum/#!forum/uiforetw.

Finished recording trace.

Tracing to file instead of circular buffer is very fast.

Thanks for the workaround.

[Bruce Dawson]

I'm glad that saving to file works better. It is very frustrating that circular buffer saving is unusably slow. I sent several traces to Microsoft showing the problem but I never got any traction, and I think it is a Google specific problem. Pity. Maybe I'll try attacking it again some day.

To view this discussion on the web visit https://groups.google.com/d/msgid/uiforetw/4e3b3882-c0ee-4fac-b6f1-c53288c18823%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

Bruce Dawson

[Michael Marcin]

In case there's some confusion I'm at id Software not Google so I don't think it's a Google specific issue.

I managed to get the metatrace down to 20 megs 7zipped and I should have nothing sensitive captured.

I'm trying to go through IT to get clearance to send it out.

[Bruce Dawson]

Well - that is fascinating. I'd never seen this outside of Google before. I'll ping you off-list to see about getting a trace of the slow trace saving as this could be useful information.

--
You received this message because you are subscribed to the Google Groups "UIforETW" group.
To unsubscribe from this group and stop receiving emails from it, send an email to uiforetw+u...@googlegroups.com.
To post to this group, send email to uifo...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/uiforetw/cb4e6bf0-a36f-4638-843f-d3825a3ba91c%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

Bruce Dawson