Here is a quick introduction to how to gather a simple trace on Windows 7 Professional and the different analysis we can get.
InstallationObviously, you will need a Windows 7 Professional host. I installed it in a Linux KVM virtual machine, with 20GB of storage and with two CPUs emulated, with all default options.
First, .NET framework 4 has to be installed, required to install tracing tools bundled with Windows SDK.
In summary, you need to install:
Get a traceTo start tracing, open a console in administration mode, as shown in the following screen shot.
We create a trace directory for our experiments, and start and stop a simple trace with tracelog, as shown in the following screen shot. While tracing, you can start programs to create some activity on the system. I started IE and did some random browsing.
The trace file output is set with "-f" option. If a lot of events occurs, some events can be lost. If such a thing occur, increase the buffers size with "-b" option. Other options are there for some extra trace events, refer to help for more information. To give an idea of the disk requirement, I got a trace of about 20MB for a minute of tracing under light load. The trace file can hence become very big.
If the user doesn't have enough privileges for tracing, the following error message will be raised. Make sure the console is launched as administrator.
C:\trace>tracelog -f kernel.etl -start
Setting log file to: C:\trace\kernel.etl
Could not start logger: NT Kernel Logger
Operation Status: 5L
Access is denied.
Analyze the traceLaunch xperfview to start the Windows Performance Analyzer. Then, load the trace kernel.etl obtained previously. Here is what it looks like.
|Disk access graph and CPU usage according to time and process in xperfview.|
|Process life graph and page faults by process according to time in xperfview.|
|Offset of disk access to detect system-wide bad seek behavior.|
|Summary of events count obtained from tracerpt|
The tracerpt utility outputs reports from a trace file, one is the count of all events and the report in HTML gives the statistics for the whole trace by subsystem. Here is an example of report.html generated with tracerpt.