Andrew Richards

Back to Profile: windev


  • Defrag Tools: #12 - TaskMgr and ResMon

    @dentaku: Windows Performance Toolkit is the answer. It records the function and duration of every DPC. You can get the win8 version in the ADK - it now has a UI application for the capture. Capture the box and then view the ETL file in wpa.exe.

    If you need help, email We are not covering xperf in the next 5wks at least.

  • Defrag Tools: #10 - ProcDump - Triggers

    Yep, you sure can. You will need to use the PID as there will be more than one w3wp:

    Procdump -ma -e 1 -f outofmemory <pid> c:\dumps

  • Defrag Tools: #8 - Mark Russinovich

    @SteffenZeidler: Use the ETW and Tooltip32 APIs to get this data.

  • Defrag Tools: #8 - Mark Russinovich

    @SteffenZeidler: each core has a thread for idle processing. These are represented by PID 0 (which doesn't really exist). The threads consume working set as the threads need to be paged in to work.

    Process Explorer has history support. New history columns were added about a year ago. Instead of being numbers they are graphs. There is no explicit api that gives you the history. The closest thing is being an ETW consumer and polling the system with the tooltip32 API.

    ProcDump is designed to not change the state of the target. If you wrote your own MiniDumpCallback DLL (-d <dll>) you might be able to force the flush of the ETW buffers  - it'd only work if the target didn't needed to execute any of it's threads (as they will be all suspended).

  • Defrag Tools: #8 - Mark Russinovich

    @StanS: There are a few more and then on to non-Mark tools.

  • Defrag Tools: #8 - Mark Russinovich

    @C64: Visual Studio 2008 SP1 is used to compile the tools so that the tools use MSVCRT v9.0 - which is shipped with Windows XP/Windows 2003.

  • Defrag Tools: #8 - Mark Russinovich

    @RyanRies: 6th edition Part 2 RTMed today, so it will be printed and available soon.

  • Defrag Tools: #8 - Mark Russinovich

    @siodmy: We are going to do a big series on xPerf which will cover logging for all applications.  I'll add Logparser to the list of applications to be covered in a future episode.

  • Defrag Tools: #7 - VMMap

    @Roger: They all come from the Microsoft Company Store (the shop on Redmond campus, as opposed to the retail shops we now have). You'll have to come visit campus!

  • Defrag Tools: #6 - RAMMap

    @James G: I use a vhd for the show and it only runs during taping (so I don't add features to the install without you seeing it). The next time I prepare for a show, I'll make sure to give it some time to do the updates. Can't set a bad example can I!

    The show will be weekly for at least another ~10 weeks based on the current episode recording schedule. We tape a few at a time if it is the same topic.

    Next is vmmap, then we have a special edition, then inbox tools. After that in a yet to be decided order is 3+ on Windows Performance Toolkit, 2+ on Procdump, 4+ on Debugging Tools for Windows, Network Monitor, Fiddler and PsTools. In the maybe bucket is audio, video, printing and device troubleshooting (1 each). We will also probably do a live show on Channel 9 Live at Build.

    Lots and lots of shows to watch!  If your favorite tool isn't in that list, drop us an email at or write a comment and we'll add it to the list or move it forward.

  • Defrag Tools: #5 - Autoruns and MSConfig

    @Debojyoti: xPerf (WPT) profiling can help you here.  We'll go over this in detail on a future episode but the gist is:

    xperf -on Diag+Latency -stackwalk Profile+CSwitch+ReadyThread+ThreadCreate -BufferSize 1024 -MinBuffers 256 -MaxBuffers 256 -MaxFile 256 -FileMode Circular

    echo Press a key when you want to stop...
    xperf -stop -d result.etl

    Look at the result.etl with xperfview.exe

  • Defrag Tools: #6 - RAMMap

    @siodmy: The repurposed of 0-4 is expected. It is the 5-7 that matter. You are getting enough memory pressure on 5 (1.6Gb -- x8 reused) to raise interest at least. Adding a few gigs will definitely help in those times - its not critical though.