Windows 10: TraceProcessor version 0.2.0 is now available

Brink · Aug 7, 2019

TraceProcessor version 0.2.0 is now available on NuGet with the following package ID:

Microsoft.Windows.EventTracing.Processing.All

This release contains minor feature additions and bug fixes since version 0.1.0. (A full changelog is below).

There are a couple of project settings we recommend using with TraceProcessor:

We recommend running exes as 64-bit. The Visual Studio default for a new C# console application is Any CPU with Prefer 32-bit checked. Trace processing can be memory-intensive, especially with larger traces, and we recommend changing Platform target to x64 (or unchecking Prefer 32-bit) in exes that use TraceProcessor. To change these settings, see the Build tab under Properties for the project. To change these settings for all configurations, ensure that the Configuration dropdown is set to All Configurations, rather than the default of the current configuration only.

We also suggest using NuGet with the newer-style PackageReference mode rather than the older packages.config mode. To change the default for new projects, see Tools, NuGet Package Manager, Package Manager Settings, Package Management, Default package management format.

TraceProcessor supports loading symbols and getting stacks from several data sources. The following console application looks at CPU samples and outputs the estimated duration that a specific function was running (based on the trace’s statistical sampling of CPU usage):

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59 using Microsoft.Windows.EventTracing;
using Microsoft.Windows.EventTracing.Cpu;
using Microsoft.Windows.EventTracing.Symbols;
using System;
using System.Collections.Generic;

class Program
{
static void Main(string[] args)
{
if (args.Length != 3)
{
Console.Error.WriteLine("Usage: GetCpuSampleDuration.exe <trace.etl> <imageName> <functionName>");
return;
}

string tracePath = args[0];
string imageName = args[1];
string functionName = args[2];

Dictionary<string, Duration> matchDurationByCommandLine = new Dictionary<string, Duration>();

using (ITraceProcessor trace = TraceProcessor.Create(tracePath))
{
IPendingResult<ISymbolDataSource> pendingSymbolData = trace.UseSymbols();
IPendingResult<ICpuSampleDataSource> pendingCpuSamplingData = trace.UseCpuSamplingData();

trace.Process();

ISymbolDataSource symbolData = pendingSymbolData.Result;
ICpuSampleDataSource cpuSamplingData = pendingCpuSamplingData.Result;

symbolData.LoadSymbolsForConsoleAsync(SymCachePath.Automatic, SymbolPath.Automatic).GetAwaiter().GetResult();
Console.WriteLine();

IThreadStackPattern pattern = AnalyzerThreadStackPattern.Parse($"{imageName}!{functionName}");

foreach (ICpuSample sample in cpuSamplingData.Samples)
{
if (sample.Stack != null && sample.Stack.Matches(pattern))
{
string commandLine = sample.Process.CommandLine;

if (!matchDurationByCommandLine.ContainsKey(commandLine))
{
matchDurationByCommandLine.Add(commandLine, Duration.Zero);
}

matchDurationByCommandLine[commandLine] += sample.Weight;
}
}
}

foreach (string commandLine in matchDurationByCommandLine.Keys)
{
Console.WriteLine($"{commandLine}: {matchDurationByCommandLine[commandLine]}");
}
}
}
Running this program produces output similar to the following:

Code: C:\GetCpuSampleDuration\bin\Debug\> GetCpuSampleDuration.exe C:\boot.etl user32.dll LoadImageInternal 0.0% (0 of 1165; 0 loaded) <snip> 100.0% (1165 of 1165; 791 loaded) wininit.exe: 15.99 ms C:\Windows\Explorer.EXE: 5 ms winlogon.exe: 20.15 ms “C:\Users\AdminUAC\AppData\Local\Microsoft\OneDrive\OneDrive.exe” /background: 2.09 ms
Click to expand...

(Output details will vary depending on the trace).

Internally, TraceProcessor uses the SymCache format, which is a cache of some of the data stored in a PDB. When loading symbols, TraceProcessor requires specifying a location to use for these SymCache files (a SymCache path) and supports optionally specifying a SymbolPath to access PDBs. When a SymbolPath is provided, TraceProcessor will create SymCache files out of PDB files as needed, and subsequent processing of the same data can use the SymCache files directly for better performance.

The full changelog for version 0.2.0 is as follows:

Breaking Changes

Multiple Timestamp properties are now TraceTimestamp instead (which implicitly converts to the former Timestamp return type).

When a trace containing lost events is processed and AllowLostEvents was not set to true, a new TraceLostEventsException is thrown.

New Data Exposed

ISymbolDataSource now exposes Pdbs. This list contains every PDB that LoadSymbols is capable of loading for the trace.

IDiskActivity now exposes StorportDriverDiskServiceDuration and IORateData.

IMappedFileLifetime and IPageFileSectionLifetime now expose CreateStacks and DeleteStacks.

UseContextSwitchData and trace.UseReadyThreadData are now available individually rather than only as part of trace.UseCpuSchedulingData.

Last Branch Record (LBR) data has been added and is available via trace.UseLastBranchRecordData.

EventContext now provides access to original trace timestamp values.

IEnergyEstimationInterval now exposes ConsumerId.

Bug Fixes

A NullReferenceException inside of ICpuThreadActivity.WaitingDuration has been fixed.

An InvalidOperationException inside of Stack Tags has been fixed.

An InvalidOperationException inside of multiple file and registry path related properties has been fixed.

A handle leak inside of TraceProcessor.Create has been fixed.

A hang inside of ISymbolDataSource.LoadSymbolsAsync has been fixed.

Support for loading local PDB files and transcoding them into symcache files has been fixed.

Disks that were not mounted when the trace was recorded will now result in an IDisk that will throw on access to most properties instead of returning zeroes. Use the new IDisk.HasData property to check this condition before accessing these properties. This pattern is similar to how IPartition already functions.

A COMException in IDiskActivityDataSource.GetUsagePercentages has been fixed.

Other

IImageWeakKey has been deprecated as it can contain inaccurate data. IImage.Timestamp and IImage.Size should be used instead.

OriginalImageName has been deprecated as it can contain inaccurate data. IImage.OriginalFileName should be used instead.

Most primitive data types (Timestamp, FrequencyValue, etc) now implement IComparable.

A new setting, SuppressFirstTimeSetupMessage, has been added to TraceProcessorSettings. When set to true, the message regarding our first time setup process running will be suppressed.

SymbolPath and SymCachePath now include static helpers for generating commonly used paths.

As before, if you find these packages useful, we would love to hear from you, and we welcome your feedback. For questions using this package, you can post on StackOverflow with the tag .net-traceprocessing, and feedback can also be sent via email to L: [email protected].

[/quote]
Source: TraceProcessor 0.2.0 - Windows Developer Blog

:)

Pinscher · Aug 7, 2019

Raid 0 help

Hi all, I've followed the IRST raid installation directions and I have created myself a Raid 0 volume. Rapid storage confirms my successful migration from a system disc to a raid 0 array. I'm also able to select it as my boot device in BIOS, but what I don't understand is why it is not listed in my Drives under my computer

In fact, my computer still lists my original C: drive with the original capacity. I feel as if I've miss an important step here and I'm unsure how to proceed.

malware · Aug 7, 2019

Intel Updates Core 2 Quad Q9550 to E-0 Stepping

We continue our Monday news list with another Intel story that brings to our attention information concerning the company and more specificly its 2.83GHz Core 2 Quad Q9550 chips that will move from the current C-1 to the newer E-0 stepping. The updated chips will start selling on August 22nd, featuring the following changes:

New SSpec and MM numbers for the converting products

CPUID will change from 0x10677 to 0x1067A

Package change to Halide free package

Apart from that, the new stepping CPUs will not include any other changes. Of course, like most new stepping parts a BIOS update will be needed.

Product Change Notification 108663 - 00

Source: TechConnect Magazine

malware · Aug 7, 2019

Intel Core 2 Duo E8400/E8500 and Xeon E3110 Moving to E-0 Stepping Next Month

After moving all 45nm Xeon DP quad core processors from the C-O to the E-0 stepping, Intel announced today that three more 45nm processors will also be upgraded to E-0. The two desktop Core 2 Duo E8400 and E8500 plus the server Xeon E3110 CPUs will all be updated to the E-0 stepping next month. Changes that will come with the E-0 stepping include:

- CPUID will change from 0x10676 to 0x1067A
- Power Status Indicator (PSI) is supported
- PECI implementation change
- New instructions added - XSAVE/XRSTOR
- New ISA extension for save/restoring context of x87, SSE, and future processor state
- New feature added - ACNT2
- Improved mechanism for determining processor utilization. To be used for more efficient P-state determination.
- Package change to Halide free package

The E-0 processors will not require any BIOS updates. They'll be easily recognisable by the new sSpec numbers: SLB9J for E8400, SLB9K for E8500 and SLB9C for E3110.

Source: TechConnect Magazine, HARDSPELL

Windows 10: TraceProcessor version 0.2.0 is now available

TraceProcessor version 0.2.0 is now available

TraceProcessor version 0.2.0 is now available

TraceProcessor version 0.2.0 is now available

TraceProcessor version 0.2.0 is now available - Similar Threads - TraceProcessor version available

0% available plugged in but not charging

0% available plugged in but not charging

0% available plugged in but not charging

battery shows 0% available plugged in

battery shows 0% available plugged in

Asphalt 9 and error: Transaction Failed error 0-0-2-0--6008

Transaction Failed Error 0-0-2--8

Srttrial.txt 0×0 error

Transaction Failed error 0-0-2-0--6008