Windows Performance Jump Start Q&A Logdownload.microsoft.com/download/F/1/5/F15B1471-7116... · Windows Performance Jump Start Q&A Log Live Event Date: January 23, 2014 Page 1 of

Windows Performance Jump Start

Q&A Log

Live Event Date: January 23, 2014 Page 1 of 16 DISCLAIMER: This information is provided to you for informational purposes only and is provided “as is.” Microsoft has not reviewed the information and it may contain inaccuracies. You bear the risk of using it. Microsoft makes no warranties, express or implied, as to the information.

06:36:13 PST Question: Hello from Australia! It's 12:30AM and this is my first live MVA; let's hope I can stay awake Answer: It's 6:35 AM here in Seattle, and I'm surprised I'm already awake!

06:36:52 PST Question: Hello from Philippines. Answer: Welcome!

06:37:04 PST Question: 25Min To Go..Waiting Answer: Should be a good one today!

06:38:10 PST Question: can software undergraduates gain from it ? Answer: We'll be focused more on IT pro issues today, but it's always good to learn how software impacts users.

06:38:17 PST Question: my first MVA session Answer: Thanks for joining!

06:38:25 PST Question: Hello From Utah Answer: Hi Jason!

06:39:09 PST Question: hello I am from pakistan and can receiving error loading stream Answer: You might try using the standard def stream (lower left of player) but if that doesn't work then we can assist

from the help tab

06:40:32 PST Question: Hello from -5 degrees York, PA Answer: Yikes!

06:41:43 PST Question: Hey from germany, any plans to run MVAs with MS staff from europe or asia for a better distributed

audience? Answer: We'd love to. Our plans just haven't come together yet.

06:42:07 PST Question: Hello all from Portugal... it's 14:37 here... Answer: Hi Bruno!

06:42:17 PST Question: and it's 3:37PM in Yaounde, CAMERRON Answer: Great to see you today!

06:42:30 PST Question: Hello everyone, Chas from the UK here. Answer: Welcome!

06:42:39 PST Question: Hello from India, this is my first MVA ready to get started! Answer: Glad you found us!

06:44:02 PST Question: good afternoon from EGYPT it's 4.38 PM now Answer: Hi Emad!


Q&A Log


06:44:10 PST Question: and it's 3:37PM in Yaounde, CAMERRON Answer: Hi!

06:45:04 PST Question: can i ask a question ? Answer: Yes, what can we answer for you?

06:45:19 PST Question: Hi from Minnesota -16 degrees with windchill -40 Answer: -40 is the same in both F and C

06:45:41 PST Question: Hello I'm from India, it's my 1st MVA session. Now 08:15 PM IST Answer: Welcome Prakash!

06:49:30 PST Question: Hey Matt, maintaining the performance of the servers has always been a challenge, I am a Sr. Server

Engineer and I look after the maintenance and prevent any downtime. I hope my job would be easier after this session. Answer: We'll be focused on Windows Client issues, but we've got some really smart people here to answer

questions, so I think we'll be able to help

06:50:20 PST Question: is there going to be a PDF guide for the session later Answer: You can download the slides from the FAQ now. You will get a transcript of the Q&A, and we'll have the

recordings on MVA in about 2 weeks

06:50:38 PST Question: Hello Matt, This is Aman from India. How are you???

Answer: I need another coffee It's early here in Seatle

06:50:55 PST Question: Hello from Montreal... -20C feels like -29C since is not particularly windy today Answer: Go Habs!

06:51:34 PST Question: Oh my goodness. People from all over the world. Springman from Boston, US @ 5 degree F

Answer: We usually see people from about 100 different countries

06:51:48 PST Question: Matt, the FAQ still says "coming soon" for the slides on my end Answer: Try refreshing your browser.

06:52:07 PST Question: Go Wings

Answer:

06:52:22 PST Question: Go Bruins! Answer: A few hockey fans here today!


Q&A Log


06:52:44 PST Question: Where can I enter the voucher code? Answer: There is a tab about halfway down the page on your MVA Dashboard

06:52:59 PST Question: Hey, will this be available as a course in MVA? Thanks. Answer: We will have it posted there in about 2 weeks

06:56:18 PST Question: after we finish the seminar ... can i have a certificate Answer: We don't give out certificates for attending our live courses. Sorry. But when we get the recording posted

you'll be able to work through the modules pretty quickly since you've already watched it. And you'll get a certificate for the recorded version.

06:57:08 PST Question: I guess Matt can't see me Answer: Sorry, there is a real flood of questions here in the moderator queue

06:57:29 PST Question: Good morning all. Matt are you one of the forum moderators?

Answer: Yes!

06:59:34 PST Question: Matt, do you have a link to the free Microsoft Press ebooks? Answer: You can get the Intro to Windows 8.1 here

http://blogs.msdn.com/b/microsoft_press/archive/2013/10/14/free-ebook-introducing-windows-8-1-for-it-professionals.aspx

07:01:03 PST Question: The slide that talks about getting the free Windows 8.1 Book for IT Professionals does not have the right

URL. When I used that URL it took me to a Framework Book Answer: Sorry about that. Here is the correct link http://blogs.msdn.com/b/microsoft_press/archive/2013/10/14/free-

ebook-introducing-windows-8-1-for-it-professionals.aspx

07:02:43 PST Question: Should I already see the video? Answer: We have started. Try refreshing your browser. If that doesn't work we can assist from the Help tab

07:03:36 PST Question: is there going to be a recording of this? Answer: We will have the recording available in about 2 weeks on MVA

07:04:05 PST Question: The link to the Free MSPress book http://aka.ms/MSPressEFSbS does not seem to point to the mentioned

book... Answer: Try this link instead http://blogs.msdn.com/b/microsoft_press/archive/2013/10/14/free-ebook-introducing-

windows-8-1-for-it-professionals.aspx

07:04:54 PST Question: Q: Can we use Windows as a RealTimeOS ? Like WinCE ? Answer: Hi Andre. No. is has not real-time architecture.

07:19:48 PST Question: Are these slides available for download? Answer: You can download them from the FAQ tab





http://aka.ms/MSPressEFSbS




Q&A Log


07:22:28 PST Question: Those are the slides i'm referring to. They do not match the slides being presented. It looks like Chell or

Milad updated them after sharing the older revision. Answer: Ah, that could be. We'll check with them at the break.

07:27:09 PST Question: What app is that? Answer: Bing Hey, its the Bing Recipe App.

07:27:21 PST Question: The Build presentation Chell just spoke of, where would these be at? Answer:

07:37:33 PST Question: Just want to be sure people can see me. If you can see this, please reply & Thanks!

Answer: Hi Dave, we can see you!

08:15:56 PST Question: is it true that windows limits each app memory, so that adding memory can only help so much? Answer: No. Most apps do not use all memory available for them, so Windows does not limit them.

08:21:55 PST Question: I thought 32bit apps had a 2GB limit? Answer: They may have 3GB limit if 4GT (4GB tuning) is turned on and 4 GB in 64-bit system. Rut the special

compiling of the app is needed.

08:27:19 PST Question: I was reviewing the info for this online class. Can anyone tell me if the ADK for Win 8.1 can be safely

installed on a Windows 7 device? Answer: Yes, the ADK is supported on Win7 and up

08:30:19 PST Question: I've downloaded the ADK for windows 8.1, how do I tell if I have the Windows Performance toolkit already

installed? Answer: Hey Brian, after installation, you should have a Windows Performance Analyzer entry in the start menu

among others or it should be present at the following location assuming you've accepted default paths.. c:\Program Files (x86)\Windows Kits\8.1\Windows Performance Toolkit\wpa.exe

08:31:07 PST Question: Boot process for Windows 7 and Windows 8 looks similar. Any comments? Answer: The fast boot in Windows 8 is turned off probably.

08:32:55 PST Question: Can someone post a link to the book to which he is refering? Windows Interal I think Answer: Windows internals. Look at Amazon, you'll find it easily.

08:37:04 PST Question: Highly recommend everyone the Windows Internals book. Super helpful for all IT Pros. Answer: http://shop.oreilly.com/product/0790145305930.do

08:39:02 PST Question: How fast is the standard boot process for a desktop PC? Answer: Hey Luis, thats a tough one, boot is a pretty complex scenario with dependencies on hardware and software

installed on the system, it involves multiple dependencies i.e. bios init, PNP enumeration , service startup etc.. If you're very interested in boot analysis, I'd recommend leveraging the ADK assessment and deployment kit which includes both the WPT and boot assessments that orchestrate boot tracing (which wpr also does) but also includes

http://shop.oreilly.com/product/0790145305930.do


Q&A Log


automated diagnostics and integrated visualizations in WPA via the Assessment activities graph which will provide a highly detailed analysis of boot on a system in test along with automated diagnostics showing processes and drivers on the system that are impacting boot.

08:40:53 PST Question: http://technet.microsoft.com/en-gb/sysinternals/bb963901.aspx for Webpage for Windows Internals Answer: http://shop.oreilly.com/product/0790145305930.do

08:41:20 PST Question: Is there any training for on how to use Xperf in depth on different scenarios for disk, memory etc.. , Any

docs will also will be helpful Answer:

08:41:33 PST Question: Any tool to monitor Boot performance of Windows Answer: Windows Performance Analysis Toolkit (WPT)

08:42:18 PST Question: am i the only one who sees a black screen here?

Are you using Internet Explorer?

08:43:11 PST Question: I'm using IE, I can see fine Answer: Thanks!

08:43:57 PST Question: I see everything just fine, using IE Answer: I think he just had a glitch!

08:46:04 PST Question: Are we going to see a demo of WPT today? Answer: Yes definitely, it sounds like that's up next which will include WPT

08:47:01 PST Question: I downloaded the tool kit can it be used with windows 7 Answer:

08:48:51 PST Question: I see the Windows Internals 6th edition only covers Windows Server 2008 R2 and Windows 7, curious

when 7th edition will be released.

Answer: Buy sixth edition. May be there never will be the 7th. autoring technical books is not profitable now

08:49:28 PST Question: Is Windows Assessment and Deployment Kit (Windows ADK) available for OS than Win8.1? Answer: Yes the ADK is supported on Win7 and up, no need to download a separate version, the one installer

should handle it all for you.

08:50:35 PST Question: I was playing about with the tool kit last week some stuff don't work saying only for windows 8 I am using

win7 do I need to install 1 for win7 some tests did work Answer:

08:52:40 PST Question: I tried to download ADK but did not Answer: Did yu use this link http://www.microsoft.com/fr-fr/download/details.aspx?id=39982 ?

http://technet.microsoft.com/en-gb/sysinternals/bb963901.aspx

http://shop.oreilly.com/product/0790145305930.do

http://www.microsoft.com/fr-fr/download/details.aspx?id=39982


Q&A Log


08:54:58 PST Question: I was wondering whether there is a way to instrument applications you've not built yourself? I don't think

that's really a supported scenario , but keep in mind that if you have access to symbols, you'll still be able to get stack level information for app's traced using the WPT, so you can still get great insight into what's going on / what methods are consuming CPU etc.

09:03:55 PST Question: Q: Is there a specific functionality that WPR provides that xperf on itself does not provide? Answer: WPR is intended as a replacement to xperf, simplified xml based profile management would be one plus, a

simple UI to configure tracing is another, and a 3rd is that it will allow users to easily collect stacks on managed applications.

09:05:26 PST Question: is it true you can't download xperf anymore?

No worries, xperf.exe is still included in the WPT.

09:07:08 PST Question: how do i download the WPT Answer: From the ADK http://www.microsoft.com/fr-fr/download/confirmation.aspx?id=39982

09:09:01 PST Question: Is this video Recorded? Answer: Hi the decks are in the FAQ

09:19:19 PST Question: Q: Which chart component was used in WPA ? Answer: WPA uses custom built WPF controls specifically built for WPA and visualization of large sets of data

09:20:34 PST Question: Is this restricted to win 7 and 8.. can we use on 2008R2 and 2012 Answer: Hi Minhaj, yes WPT can be used on server 2008R2 and 2012.

09:22:37 PST Question: Is there a WPR api? We would like to monitor multiple programs that are involved in a business process. Answer: Hi Sjuul, WPR api is documented here: http://msdn.microsoft.com/en-

us/library/windows/hardware/hh849526.aspx

09:30:14 PST Question: Is there a certain reports for selecting only certain data within a trace? Answer: Graphs and tables are broken up by resource as a start, and you can filter via right click too depending on

what you're trying to do

09:32:25 PST Question: Do we have overlapping feature as we had in xPerf Answer: No overlap is not supported in WPA, the team has had much focus on making it easy to manage your

graphs, show graphs only / tables only / both, or minimize along with drag-drop to rearrange so that hopefully you won't need to overlap graphs anymore. You also have tables that dynamically update as you pivot / zoom rather than having to snap a static summary table as you did in xperfview (not supported anymore)

09:35:54 PST Question: my comp just froze how ironic lol Answer: Oh no!

09:36:28 PST Question: Can we use the WPA to analyse the memory dumps captured during BSOD Answer: Hey Mohammad, you would like to use WinDBG for BSOD scenarios.

http://www.microsoft.com/fr-fr/download/confirmation.aspx?id=39982

http://msdn.microsoft.com/en-us/library/windows/hardware/hh849526.aspx



Q&A Log


09:36:44 PST Question: so you can't download xperfview? Answer: Correct, as of the latest 8.1 release of the WPT, xperfview is not included. It was for WIn8 only because the

team had not yet ported all capabilities over to WPA yet.

09:37:41 PST Question: is there a disk detail view in xpa? Answer: Yes there is - under the 'Storage' section in the graph explorer (pane to the left).

09:41:27 PST Question: can you explain I/o resources also

Answer: we will cover I/O resources soon

09:44:57 PST Question: Chell you make it look easy where is the best available documentation for full instructions/help/examples

for using this? Answer: There is documentation available on MSDN and also some video's up on channel 9 too that walk you

through some additional case studies in the Defrag Tools segment.

09:48:52 PST Question: Could you please add link to videos Answer: There are quite a few, this should get you started though - http://channel9.msdn.com/search?term=wpt

09:52:04 PST Question: Abhinav Sharma posted: > Quoted answer: There are quite a few, this should get you started though - http://channel9.msdn.com/search?term=wpt Answer: Here's a link on MSDN with some recent videos on modern application analysis

http://msdn.microsoft.com/en-us/windows/dn282269

10:07:40 PST Question: how did she get this profile again? Answer: [Profiles] -> [Apply] -> [Browse Catalog]

10:08:24 PST Question: According to system requirements for Windows Performance Recorder, you need Windows 8. I thought it

was mentioned that the Recorder can run on Windows XP and up? I am referencing the documentation here: http://msdn.microsoft.com/en-us/library/hh448115.aspx Answer: You can copy the binaries to Windows XP and build the trace.

10:17:00 PST Question: does this tool replace or compliment the use of logman and tasklist commands to find the provider and

then use the analytic and debug capabilities of event logs Answer: WPA/WPR are not currently scoped as a replacement to those tools, so yes, complimentary would be a

good way to think of it.

10:23:28 PST Question: WPT utilize ETW. So our logs are coming out of Event Tracing for Widnows. Answer: Also consider that when you're capturing a trace using WPR, stack level information is being included in the

trace to provide a richer analysis experience of what is taking place on the system. The logic built into the WPA internals also processes / correlates the ETW info of interest to display the key ETW data of interest in the graphs / tables.

10:38:38 PST Question: seems to me that WPR/WPA are a combination of the data available through ETW and sysinternals tools

(procmon, proc explorer)...would that be a fair description?

http://channel9.msdn.com/search?term=wpt

http://channel9.msdn.com/search?term=wpt

http://msdn.microsoft.com/en-us/windows/dn282269

http://msdn.microsoft.com/en-us/library/hh448115.aspx


Q&A Log


Answer: Well, the WPT gets one access to that category of data and more.. And a key difference would be that the

workflow for WPT tools is based on capturing all the info in an ETL trace allowing for deep offline analysis at a later time rather than real-time monitoring like sysinternals. Within Microsoft we find this workflow quite helpful for investigating complex issues spanning multiple feature teams and doing a-b comparisons/diffing of different configurations/ test passes.

10:44:42 PST Question: Can ETW sessions set up for boot analysis get orphaned? Is there a way to verify that there aren't any

ETW sessions hooked up to the boot process? Answer: That should not happen. If you wanted to confirm you could run wpr -status to see if anything is running.

10:47:11 PST Question: How do the presenters zoom in and out so easily? Answer: Looks like they're maybe using sysinternals zoomit which is a nice app and you can always use winkey ->

"+" too in a pinch

10:55:04 PST Question: I believe I have heard Mark Russinovich say in the past that you can point to the Net for on-the-fly loading

of Symbols instead having it locally. Is this a correct assumption? Answer: Hi Denny, look at http://msdn.microsoft.com/en-

us/library/windows/desktop/ee416588(v=vs.85).aspx#using_the_microsoft_symbol_server

10:55:18 PST Question: Why aren't Symbols loaded by default? Answer: It can take some time to load symbols, especially if you're pulling down all symbols off of a symbol server

and don't yet have a local symcache. Having said that, not all user scenarios require loading symbols (mostly used to access stack data) so WPA does not load them by default.

11:16:21 PST Question: Can we set up the WPR to queue up a set of Performance scenarios, and set their iterations? For

example, could we set up a recording to capture 10 iterations of the Reboot Cycle as we as Standby/Resume, and Hibernate/Resume? Or do all these jobs need to be manually selected and run, per Performance scenario? Answer: If you're looking to do large scale testing rather than ad-hoc investigations, you may want to look into using

the other features included in the ADK. The ADK includes boot assessments which use WPR/WPA and allow you to queue up assessments to run on a local system. If you want to go even larger scale than that across multiple systems, the ADK also includes Windows Assessment Services - Application to remotely manage settings, computers, images, and assessments in a lab environment where Windows Assessment Services is installed.This application can run on any computer with access to the server that is running Windows Assessment Services. http://msdn.microsoft.com/en-us/library/windows/hardware/hh825486.aspx

11:16:30 PST Question: Can you capture trace files directly to an external drive or usb key? Answer: Not using the UI (wprui.exe), but you can do that using the command line (wpr.exe) - see -recordtempto

option in 'wpr -help start'.

11:58:43 PST Question: How I get a 50 MVA Point from this event Answer: 50 MVA Points for this event! Visit http://aka.ms/MVA-Voucher Code: WinPerf (expires 2/24/2014)

12:02:56 PST Question: Are you back at 1 pm PST? Answer: Yes, back in a couple more minutes...

12:06:37 PST Question: When is the last session finished today...? Answer: Hi, around 2:00-2:30pm, PT

http://msdn.microsoft.com/en-us/library/windows/desktop/ee416588(v=vs.85).aspx#using_the_microsoft_symbol_server

http://msdn.microsoft.com/en-us/library/windows/desktop/ee416588(v=vs.85).aspx#using_the_microsoft_symbol_server


http://aka.ms/MVA-Voucher


Q&A Log


12:31:44 PST Question: What program is he using to draw on his desktop Answer: You can use the Magnifier in Windows. We also use Zoomit.

12:31:53 PST Question: What program is he using to draw on his desktop Answer: Download ZoomIt: http://technet.microsoft.com/en-us/sysinternals/bb897434.aspx

12:34:52 PST Question: I'm interested in i/o tracing during boot Answer: Milad will be spending about an hour on On/Off. I'm not positive that IO gets addressed - I'll ask at break.

12:34:59 PST Question: will this be available on the web if we need to go through this again ? Answer: Yes, please look for this in video-on-demand from the MVA site in approx. 2-3 weeks

12:35:34 PST Question: What is the URL for Symbols on Microsoft site? Answer: The symbols server? Or how to configure symbols?

12:37:14 PST Question: > Quoted question: What is the URL for Symbols on Microsoft site? > Quoted answer: The symbols server? Or how to configure symbols? Answer: WPA comes preconfigured to point to the public microsoft symbol server:

srvC:\Symbolshttp://msdl.microsoft.com/download/symbols;

12:37:31 PST Question: What about services? Can I trace applications running as a service in the backround too? Answer: Yup! If it's your own service, you'll get some basic info with first level triage and can get richer data with

custom instrumentation.

12:37:56 PST Question: is WPA only for desktops, can it also be used for servers? Answer: Yup! It can be used for servers as well.

12:39:26 PST Question: Can I review this course later? Answer: yes this jumpstart will be available on demand.

12:39:45 PST Question:

> Quoted question: Pedro > Quoted question: What is the URL for Symbols on Microsoft site? > Quoted answer: The symbols server? Or how to configure symbols? > Quoted answer: WPA comes preconfigured to point to the public microsoft symbol server:

srvC:\Symbolshttp://msdl.microsoft.com/download/symbols; Answer: To configure symbols or to point to additional locations, after you have opened a trace, click [Trace] ->

[Configure Symbol Paths]

12:40:01 PST Question: Symbols server Answer: http://msdl.microsoft.com/download/symbols Full details here: http://msdn.microsoft.com/en-

us/library/windows/desktop/ee416588(v=vs.85).aspx

http://technet.microsoft.com/en-us/sysinternals/bb897434.aspx

http://msdl.microsoft.com/download/symbols

http://msdl.microsoft.com/download/symbols

http://msdn.microsoft.com/en-us/library/windows/desktop/ee416588(v=vs.85).aspx

http://msdn.microsoft.com/en-us/library/windows/desktop/ee416588(v=vs.85).aspx


Q&A Log


12:42:19 PST Question: Does Windows Performance Recorder have to be installed on any workstation or server that's being

analyzed? Is there a way to run the Windows Performance Toolkit on a Windows 7 or 8 admin workstation in order to run the recorder on a remote machine? Answer: you can xcopy the install path to quickly use on another system to grab a trace but remotely driven tracing

on other systems is not supported.

12:43:24 PST Question: Is there a way to export the graph data if you wanted to provide it to a person that didn't have the tool for

viewing? Answer: The best view is a screenshot of the analysis tab but you can use the exporter to get a dump of the data. I'll

be showing how to do that later.

12:44:50 PST Question: Thanks Chris..but if I wanted to let say show my manager or a vendor my findings..like save to Excel or

something? Answer: If you right click in a table there will be a variety of options to copy the cell data which you could then paste

into excel to share with your manager

12:45:41 PST Question: where to start going for Premier Support Engineer career ?

Answer: Hey Janne, Just go on the Microsoft career portal and search for Global Business Support.

12:47:17 PST Question: Can you use the Windows Assessment Console to package a tack to run on Windows 7 machine? Answer: Nope. WAS is Window 8 and higher.

12:49:13 PST Question: I see that there will be a Windows store section... will be analised the issues regarding problems

accessingthe store through company proxy? Answer: We did not cover that. We looked at the performance analysis and how you see into the framework and

what the framework is doing on behalf of the app.

12:52:34 PST Question: can group policy prevent you from installing wpa? Answer: Yes you could use AppLocker in group policy for this purpose. It's under Security settings\application control

policies

12:54:04 PST Question: Q: Milad, how could you make the link between crypto32.dll and the virusscan solution in place? You

didn't really give an explanation how you identified the root cause Answer: Crypt32.dll is about Certificate and Cryptographic Messaging functions in the CryptoAPI. So this is exactly

all about AV etc.

12:55:05 PST Question: I appreciate knowing about the tools Windows has, but it looks like this course is aimed at developers

(programmers), rather than technicians or administrators. How useful will this information be to someone who cannot change the program code? Answer: I understand where you are coming from Richard as I am not a developer either. This tool is great for

Admins needing to pinpoint issues and narrow it down to the code or app with the issue. This can then be given to the developer or vendor of the app.

13:06:04 PST Question: wait - did I hear that right? all that delay was just from the user sitting there waiting before typing in their

password?


Q&A Log


Answer: Yes, that's what happened. And you were able to see it going through Generic Events graph. Milad is also

showing you how to see it in the stacks.

13:14:21 PST Question: As an Admin I can't disagree more with that Auto Logon idea... Answer: Of course real users shouldn't do autologon. This is more valid for auto analysis.

13:15:41 PST Question: Is there now or is there ever going to be a way to kill or disable startup apps through the toolkit? Answer: There is not now. Really we refrain from changing the user's machine. We help provide the answers and the

analysts/users need to take action.

13:17:04 PST Question: > Quoted question: Is there now or is there ever going to be a way to kill or disable startup apps through the toolkit? > Quoted answer: There is not now. Really we refrain from changing the user's machine. We help provide the answers and the analysts/users need to take action. Answer: If you use the WPT to find an issue and you just wanted to disable something sysinternals autoruns is a

great tool for that. http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

13:17:47 PST Question: Can't you just sort by duration? maybe filter top 3? Answer: Yes, you can but it is important to also make sure that you see the context of what else is happening on the

system.

13:26:49 PST Question: Chell, have I lost you too? Answer: I see your messages...

13:27:33 PST Question: Will you be giving us a trace or two and an analysis to look at? Answer: Yup! We'll be sharing after. You'll be able to follow along with the videos.

13:32:06 PST Question: I mean, how can you tell how long it takes from entering a password, to getting to an idle desktop? Answer: In the tools, you'll see the "Post Boot" phase in the Boot Phases graph. For that graph, you'll see the

duration + start and stop times.

13:33:33 PST Question: Can we use WPA tool for Slow logon as well ? Answer: Yup. We have a Performance Scenario in WPR for LogOn.

13:36:53 PST Question: Hi Chell. If we can use WPR and WPA for Slow logon, Do we have any doc explains how to do ? Answer: You can use WPT for slow logon, yes. We don't have a big article but you'll set the Performance Scenario in

WPR to Logon. Then you'll be able to use the approaches Milad has shared to analyze the trace.

13:37:52 PST Question: have been hunting down such time holdups as you describe "by hand" with process monitor. It would be a

handy tool in WPA to autofind such holdups? Real simple, just a list with the likely suspects. Answer: This is a great idea. We would like to help you all root cause performance issue faster and easier.

13:40:44 PST Question: maybe the assessment tool does something like that? only for win 8 though Answer: The ADK assessment work flow does include some assisted issue detection / processing of traces that

integrates with WPA. Issues

http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx


Q&A Log


The On/Off Transition Performance assessments perform advanced issue analysis and provide links to Windows® Performance Analyzer (WPA) to troubleshoot the issues that the assessments have identified. When WPA opens, additional details about disk activity or CPU activity might be available, depending on the type of issue. For more information about in-depth analysis issues and recommendations, see Common In-Depth Analysis Issues. From <http://msdn.microsoft.com/en-us/library/windows/hardware/hh825330.aspx>

13:41:38 PST Question: what was the gold line for? Answer: Gold bar allows you to define how you're going to group data in the tool.

13:45:33 PST Question: Milad, do you have a dedicated performance blog? Answer: https://www.facebook.com/milad.aslaner http://www.twitter.com/MiladPFE https://twitter.com/MEAGBS

https://www.facebook.com/MEAGBS

13:48:00 PST Question: Do you have to install WPT to get a trace on a machine? Can you just copy the correct files? Answer: You can copy over the folder and it contains everything needed to capture a trace without installing the full

toolkit.

13:48:05 PST Question: Thanks. I was looking on the wrong graph type...

Answer:

13:48:11 PST Question: IP v6 Answer: To clear up the supported OS version story for ADK assessments, the short answer is, it depends. Some

assessments are supported on Win7, while others are only WIn8 and up i.e. browsing performance or Windows Store App Performance You can find the details by viewing details for each assessment from this root page: http://msdn.microsoft.com/en-us/library/windows/hardware/hh825281.aspx The text you'll be looking for for each assessment looks like the following : You can run this assessment on the following operating systems: • Windows 7 • Windows 8

13:53:29 PST Question: When starting WPR, I get this message: "The Paging Executive is enabled on this system, which can lead

to incomplete stacks in traces. Press OK to disable this setting and close WPR." Is this normal Answer: Yeah, this is expected.

14:02:45 PST Question: As a follow-up to Ken's question, it would be nice if there was a button to re-enable PE again without

having to Bing an article with the registry key location. Answer: Ken / Paul K - I think this is what you're looking for to enabe / disable that configuration:

C:\Privates\latest>wpr.exe -disablepagingexecutive

Turns Disable Paging Executive settings On or Off

wpr -disablepagingexecutive {on/off}

14:05:07 PST Question: So, this tool is kind of a Task Manager / Process Explorer at a much more powerful level. Like that! Answer: Correct! WPT rocks for deep dive analysis. In Microsoft Global Business Support we use it everyday!

14:06:52 PST Question: Can I trace why a computer don't go in stand-by? Answer: Yes. You have to choose in performance scenario Standby.

14:07:25 PST


https://www.facebook.com/milad.aslaner

http://www.twitter.com/MiladPFE

https://twitter.com/MEAGBS

https://www.facebook.com/MEAGBS



Q&A Log


Question: Hi Milad, That link is for Windows SDK Answer: Before Windows 8 the WPT was part of the SDK.

14:10:19 PST Question: A situation I often find myself in, is to determine who called who while doing performance measurement.

An Example: how do I figure out who called the SVCHOST.EXE to get all data from Event log. One of the SVCHOST.EXE is the one responsible for reading the events on behalf of someone else. I had a situation where we saw CPU spike every 10 seconds. A closer look reviled that this was caused by the SVCHOST.EXE reading the whole application log, and this was done every 10 seconds. The hard ting was now to figure out how initiated the call to the Event log subsystem to get all these events every 10 seconds. Can we do that with WPT? Answer: Good question Ib. What u need to do is checking out the Process and Parent Process ID and follow which

process start which one.

14:11:06 PST Question: mark russinovich has done a few videos on hunting spyware Answer: Correct. Checkout: http://channel9.msdn.com/search?term=Malware+Hunting&type=Events

14:11:17 PST Question: Can I use it to determine if a device driver is faulty constantly calling an interrupt causing high cpu

utilization? Answer: Yes u can.

14:12:01 PST Question: AUTOMAGICALLY IS NOT A REAL WORD Answer: I will show you soon how Microsoft IT solved automated performance analysis. Stay tuned!

14:13:46 PST Question: This tool will make my life from time to time much more easier. Answer: Could not agree more! WPT really helps everyone who wants to solve Windows Performance issues. It just

rocks.

14:14:13 PST Question:

> Quoted question: Can I use it to determine if a device driver is faulty constantly calling an interrupt causing high cpu utilization? > Quoted answer: Yes u can. Answer: A good starting point for this would be - DPC and ISR Usage by Module, Stack preset - under the

computation -> CPU Usage (sampled) - KPI.

14:14:19 PST Question: Can you please share the Link for downloading WPR and WPA for Windows 7 systems? Answer: You can use latest WPA on win7 systems as well. So you can use win8 or win8.1 ADK on win7 systems

14:16:17 PST Question: @MilandCA . Talked to Andrew Richards (defragTools) his answer was: "It's a case where you need to

gather ETW events from the appropriate provider. Most of these are private though - so not much you can do outside of Microsoft." - is he right? Answer: In general to understand who is calling what executable you don't need more then first level triage.

14:17:13 PST Question: Milad. How can we use WPT to trace why W7 clients take a long time to collect an IP address from

DHCP? Answer: For this case Naljure I would go for Message Analyzer. What you would see in WPT is the DLL and

functions which are getting called and how long it takes. If you want to see that you need CPU Usage and drill into with stacks.

http://channel9.msdn.com/search?term=Malware+Hunting&type=Events


Q&A Log


14:18:10 PST Question: how did she get the comparative analysis tab? Answer: Window -> New Comparative Analysis View

14:18:41 PST Question: Milad, Is that first level triage a custom profile you created? Answer: Hey. First level triage is a new profile we added to WPT. So if you install the latest bit you will always have

it.

14:22:16 PST Question: If I'm capturing a shutdown issue where the system completely hangs and requires a hard power-off, will

that kill the trace or will it still get written to disk? Answer: This really depends. You might have some poritions already on the HDD. So checkout where you dump the

trace. In general if its a hang during shutdown you would go and check If you find a dump to troubleshooting with Windbg.

14:22:33 PST Question: Whats "Trace Rundown" part of the graph...? Answer: Once you've hit save trace that is when we'll show trace run down where we start unwinding all the stacks

to close out the tracing session and injecting all of the system info into the trace. We make the distinction since at this point there is increased load on the system due to this processing which can affect metrics.. This will also ensure that exporter that Chell is talking about will give you clean / correct data.

14:22:51 PST Question: Running ADKsetup to check for updated versions - getting a message I have to uninstall first? Is that

expected? Answer: ADK Setup doesn't check for the versions. So what you can do is going to "installed software" and check

the version there.

14:23:04 PST Question: Trace Rundown...? Answer: Trace Rundown indicates when WPR is stopping capturing the trace. Generally it means that you don't want

to look at the data in that portion of the trace.

14:24:46 PST Question: for paul k I would use process monitor boot logging for that Answer: Yep. That would also work. Great suggestion js2010.

14:29:21 PST Question: Is there anywhere I can get the recordings from if I missed some of the day? Answer: Yes, look for all 8 modules to be posted (video on demand, and PowerPoint decks) on the MVA site in

approx. 2-3 weeks.

14:29:56 PST Question: Where could I learn more about instrumentation? This is also my first exposure to symbols and symbol

server. Answer: Try searching for ETW Instrumentation. eg: http://msdn.microsoft.com/en-

us/library/windows/desktop/dd996930(v=vs.85).aspx

14:30:22 PST Question: Hi Milad .. Can you share some sample profiles which you guys have created for .. Like Boot, Slow logon,

etc. Answer: they are part of the latest WPT build. So just download the tool hehe.

14:33:44 PST Question: Can one generate a "Summary Performance Report" through WPA (like Resource Monitor) , or does

everything need to be created through the UI/interactively?

http://msdn.microsoft.com/en-us/library/windows/desktop/dd996930(v=vs.85).aspx

http://msdn.microsoft.com/en-us/library/windows/desktop/dd996930(v=vs.85).aspx


Q&A Log


Answer: Or, if you just want to programmatically extract the data from the tool as configured in the UI via a profile,

you can use the exporter to do this from the CMD line. Exporter uses a profile to determine what to extract. All depends on the scenario you're trying to enable.

14:34:11 PST Question: Hi Milad, a side question, if my computer hangs on booting up and I can't use wpr to record the trace.

What can I do then? Thanks. Answer: Hey, check If you find any memory dumps when you boot in system32.

14:34:45 PST Question: Milad Can you provide online IT job Answer: Check out http://careers.microsoft.com/ we are always looking for IT Pros to join our groups.

14:37:27 PST Question: Is it possible to record with WPR only 1 application (for example windows service) for long time (1 day)? Answer: Nope. It will long all activities. And u really wanna do that because it might be the case that there are some

dependencies.

14:43:33 PST Question: when will someone wrote a book on wpt?

Answer: We are working on that!

14:50:08 PST Question: when I try to do a comparison view nothing shows up in the pane, did I miss something? Answer: Do you have two traces open in the same session of WPA? Or maybe you need to drag over a graph from

Graph Explorer?

14:50:29 PST Question: is this the last module? Answer: Back in a minute or two

14:51:54 PST Question: yes I had two traces open Answer: You did window > new comparative analysis?

14:52:34 PST Question: At home now, playing on my xBox while I wait the next (last?) session. Answer: Yes, last session

14:53:05 PST Question: Why are my posts and query's not visible ?? Answer: We see this one!

14:58:14 PST Question: yes I had two traces open, still get nothing showing in comparison view Answer: It sounds like you just need to drag over a graph. So select your comparative analysis tab then select a

graph from graph explorer. That should show you a diffed table and the graph for the trace selected.

15:00:56 PST Question: oh duh, I should have been paying more attention! Answer: No problem Brian!

15:01:00 PST Question: got it now, that was the step I was missing, thanks! Answer: Great news!

http://careers.microsoft.com/


Q&A Log


15:01:27 PST Question: by store - I mean store in CM inventory Answer: Yeah this should work.

15:05:57 PST Question: So I got WPR on a DC LAN with 25 clients. How to make eg boot recordings of all machines? Answer: Hi Ola, the WPT (WPR/WPA) toolset is targeted for single machine workflows. If you're looking to

manage/test a lab of machines you should look into the ADK/WAS which uses assessments to schedule across multiple machines. The assessments use WPR tracing, hope that helps!

15:07:26 PST Question: how do you talk and chat at the same time? Answer: that's multi tasking hehe

15:08:13 PST Question: Milad, where can I find more about BootX? Answer: BootXRay will be available through Microsoft Premier Support soon. So in case you got a support

agreement just contact your Technical Account Manager.

15:14:21 PST Question: Seriousl question. During the boot up, do WinLogon initialisation and Explorer initialisation run sequentially

or concurrently? Answer: boot phases are always running sequentially.

15:16:57 PST Question: OK, so the Explorer init. won't start until WinLogon has finished. Thanks. Answer: Correct. Because the user has to type in his credentials and once that's happened explorer.exe kicks in with

Explorer Init phase.

Documents

Windows Performance Jump Start Q&A Logdownload.microsoft.com/download/F/1/5/F15B1471-7116... · Windows Performance Jump Start Q&A Log Live Event Date: January 23, 2014 Page 1 of