[MagicAndre1981]

you haven't used the correct commands I posted. the file doesn't contain any useful data. Don't run LatancyMon and xperf the same time.

[doveman]

I did

xperf -on latency -stackwalk profile

and after seeing problems in LatencyMon

xperf -d DPC_Interrupt.etl

how can I know when "the high DPC and Interrupt usage occurs" if I don't run LatencyMon?

[MagicAndre1981]

don't run LatancyMon the same time. run an older ProcExpl version (12.04) or ProcessHacker with NetWork/Disk IO tracing disabled.

[doveman]

MagicAndre1981, on 20 January 2012 - 11:27 AM, said:

don't run LatancyMon the same time. run an older ProcExpl version (12.04) or ProcessHacker with NetWork/Disk IO tracing disabled.

OK, but how do I identify high ISR or DPC execution time or high kernel latency with ProcExpl? This is what I'm seeing:



And what commands do you want me to run to make the trace if the ones I posted from your original post are no good?

[MagicAndre1981]

doveman, on 20 January 2012 - 02:19 PM, said:

OK, but how do I identify high ISR or DPC execution time or high kernel latency with ProcExpl?

look for high CPU usage of the nodes DPC/Interrupt. If you see this, run the command inside ProcExp with File->Run (CTRL+R) when you see the high CPU usage.

[doveman]

MagicAndre1981, on 20 January 2012 - 04:25 PM, said:

look for high CPU usage of the nodes DPC/Interrupt. If you see this, run the command inside ProcExp with File->Run (CTRL+R) when you see the high CPU usage.

OK, thanks.

EDIT: Actually that doesn't seem practical, as firstly ProcExp doesn't report high usage, so I'd have to sit staring at it for ages trying to catch a spike and also even if the CPU usage doesn't go high, I'm still seeing excessively high kernel latency and/or DPC and latency execution times in LatencyMon.

This post has been edited by doveman: 21 January 2012 - 06:16 AM

[MagicAndre1981]

yes, Procexp shows high usage f you have it. As I said, you can't run t programs side by side which use ETW to capture data. This is a Windows limitation.

[doveman]

MagicAndre1981, on 21 January 2012 - 09:09 AM, said:

yes, Procexp shows high usage f you have it. As I said, you can't run t programs side by side which use ETW to capture data. This is a Windows limitation.

Oh well, looks like I'll have to try and work this out on my own. The ataport.sys does seem much better now, but I uninstalled some software as well so I'm not sure what fixed that. Really only ndis.sys and netbt.sys are too high (0.43ms) for my liking now. The next highest are USBPORT.sys 0.25ms, CLASSPNP.SYS 0.22ms, ntoskrnl.exe 0.18ms with everything else under 0.09ms

This post has been edited by doveman: 21 January 2012 - 10:38 AM

[MagicAndre1981]

the values you have are ok. Do you have any issues (audio, video drops)?

[doveman]

MagicAndre1981, on 21 January 2012 - 12:11 PM, said:

the values you have are ok. Do you have any issues (audio, video drops)?

I think things are OK at the moment. I get brief breaks in sound with TV (which aren't replicated if I rewind and play that section again) but I don't think it's a latency issue as it doesn't happen when watching movie files. Cutscenes in games are OK now, but I still get quite a bit of brief freezing / stuttering when actually playing the game, but I guess it could just be the game loading data and something I have to put up with.

I was just a bit bothered by ndis.sys and netbt.sys as they used to be much lower, and I'd like to use VMware workstation but last time I tried it, these two (and tcpip.sys) went much higher and I had bad video / audio problems again.

[MagicAndre1981]

Ask the VMWare support if they can fix the nigh ndis/tcpip.sys spikes when using VMWare workstation.

[doveman]

MagicAndre1981, on 23 January 2012 - 09:54 AM, said:

Ask the VMWare support if they can fix the nigh ndis/tcpip.sys spikes when using VMWare workstation.

Yeah I have, they're looking into it.

[doveman]

Dammit, ataport.sys just spiked to 2.86ms. Highest kernel latency is 858us.

[MagicAndre1981]

have you now made a trace which can be used or do you still run LatencyMon the same time?

[doveman]

MagicAndre1981, on 24 January 2012 - 05:25 AM, said:

have you now made a trace which can be used or do you still run LatencyMon the same time?

No, there's no way for me to tell when the latency or ISR or DPC execution time goes too high without running LatencyMon, so it's impossible for me to know when to make a trace.

The ataport.sys spike seems to have been linked to Truecrypt and hasn't reoccured since I closed that. ndis.sys is higher than ever though now at 0.69ms (netbt.sys is at 0.1ms and tcpip.sys is at 0.26ms) and the highest kernel latency is on the edge at 906us.

[MagicAndre1981]

Run this command in background:

xperf -on latency -stackwalk profile -buffersize 1024 -MaxFile 256 -FileMode Circular && timeout -1 && xperf -d DPC_Interrupt.etl

and do your normal work (DON'T RUN LATENCYMON!!!!!!!!!!!) If you have issues (drops), go to the CMD prompt and press a key to dump the data into the file. The file is limited to 256MB, so it should capture the last few minutes so that it includes the required data.

[doveman]

MagicAndre1981, on 24 January 2012 - 07:11 AM, said:

Run this command in background:

xperf -on latency -stackwalk profile -buffersize 1024 -MaxFile 256 -FileMode Circular && timeout -1 && xperf -d DPC_Interrupt.etl

and do your normal work (DON'T RUN LATENCYMON!!!!!!!!!!!) If you have issues (drops), go to the CMD prompt and press a key to dump the data into the file. The file is limited to 256MB, so it should capture the last few minutes so that it includes the required data.

Thanks, but I get the following error trying to run that command, even though DPC_Interrupt.etl doesn't already exist!

"xperf: error: NT Kernel Logger: Cannot create a file when that file already exists. (0xb7)."

[MagicAndre1981]

you get this error because you run again a tool which use ETW (Process Explorer, Process Hacker, resource Monitor). You must use Process Explorer 12.04 because this is the last version which doesn't use ETW.

[doveman]

MagicAndre1981, on 25 January 2012 - 12:26 PM, said:

you get this error because you run again a tool which use ETW (Process Explorer, Process Hacker, resource Monitor). You must use Process Explorer 12.04 because this is the last version which doesn't use ETW.

No you're wrong. I'm wasn't running any of those tools.

[MagicAndre1981]

which other tools do you run? one of them is also using ETW.