|
It's normal mode shows both hard and soft faults. Just pass the name of the app you want to monitor as the first argument i.e. pfmon notepad. You did do pfmon /? at the command line, didn't you? The options look pretty straight-forward to me.
Judy
|
|
|
|
|
Thanks Judy,
I have typed pfmon notepad, no error messages and no notepad application is invoked to display. Shall I start notepad at first, then type pfmon notepad? Which is the correct way?
regards,
George
|
|
|
|
|
It works for me. I opened the command prompt, changed to the directory where pfmon.exe lives, typed pfmon notepad , and .... notepad launched and pfmon dumped lots of info to the command window. When I closed notepad, a summary appeared and pfmon terminated.
XP SP2
Judy
|
|
|
|
|
Thanks, Judy!
It works for my now! I previously used the wrong version pfmon.exe for x86 platform on my x64 desktop. There are a lot of information dumped to console, do you know how to dump result into file? I only interested in the number of soft and hard page faults after a long run of my application.
regards,
George
|
|
|
|
|
The same way you redirect console output from any command-line program:
foo.exe > outputfile.txt
|
|
|
|
|
Thanks Judy,
I have met with two further issues.
1.
There is something like,
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
when I use -h -n to start my application using pfmon.exe, what is the issue? How to solve it?
2.
Here is a section of pfmon.log, I think it means there is a page fault in function RtlCreateTagHeap, right? What is the pow, +0x274, and +0x0000000000001C54 mean?
HARD: RtlCreateTagHeap+0x274 : pow+0x0000000000001C54
regards,
George
|
|
|
|
|
I don't know for sure but I'll take a guess or two
George_George wrote: 1.
There is something like,
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
I'd wager the program maintains an internal buffer that logs the faults and a seperate thread that outputs the buffer to the log file. This appears when faults are coming in faster than the output thread can empty the buffer.
George_George wrote: 2.
Here is a section of pfmon.log, I think it means there is a page fault in function RtlCreateTagHeap, right? What is the pow, +0x274, and +0x0000000000001C54 mean?
HARD: RtlCreateTagHeap+0x274 : pow+0x0000000000001C54
HARD: kind of fault
RtlCreateTagHeap+0x274: where fault occured - i.e. code address that caused the fault
pow+0x0000000000001C54: address of memory that was trying to be accessed
It shows as some_name+xxxx whenever that 3rd address is close enough or in the same segment as a function. Instead of just a raw address, you're getting the address relative to the start of a function.
Judy
|
|
|
|
|
Thanks Judy,
Great!
1.
JudyL_FL wrote: I'd wager the program maintains an internal buffer that logs the faults and a seperate thread that outputs the buffer to the log file. This appears when faults are coming in faster than the output thread can empty the buffer.
Any ways or parameter to increase the internal buffer? Do you experienced the same issue?
2.
JudyL_FL wrote: RtlCreateTagHeap+0x274: where fault occured - i.e. code address that caused the fault
pow+0x0000000000001C54: address of memory that was trying to be accessed
It shows as some_name+xxxx whenever that 3rd address is close enough or in the same segment as a function. Instead of just a raw address, you're getting the address relative to the start of a function.
So, RtlCreateTagHeap is the function name, and 0x274 is the offset from the RtlCreateTagHeap where the code in function RtlCreateTagHeap causes hard page fault?
But what is pow?
regards,
George
|
|
|
|
|
George_George wrote: Any ways or parameter to increase the internal buffer? Do you experienced the same issue?
I doubt it - if it was a parameter, I think it would be listed in the /? screen. I don't particularly use the tool so I have very little experience with it.
George_George wrote: So, RtlCreateTagHeap is the function name, and 0x274 is the offset from the RtlCreateTagHeap where the code in function RtlCreateTagHeap causes hard page fault?
Probably. Note that the address is relative to the closest "named" function. If it's inside a function without a name (as in a non-exported function in a DLL compiled in full-up release mode), it may be a raw address or an offset from the previous function.
George_George wrote: But what is pow?
pow is a math function prototyped in <complex.h>. Again, this is a relative address. Pfmon is taking a stab at making the raw address more meaningful by listing it as an offset from the closest thing that has a name.
All these relative addresses become much more useless (yes, useless is not a typo) when you are dealing with optimized / release mode code since function names can be stripped out of the executable and code rearranged. If you're not careful, you can start digging through the wrong code. You really need to have a .MAP file when trying to correlate a relative address into your release-mode code.
Judy
|
|
|
|
|
Thanks Judy,
Do you think messages like this,
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
indicats a bug of my application or a bug/limit of pfmon.exe itself?
regards,
George
|
|
|
|
|
|
Thanks Judy!
It is surprised to see we find a bug of pfmon.exe. Do you know any other tool to monitor soft and hard page fault separately?
regards,
George
|
|
|
|
|
George_George wrote: bug of pfmon.exe
I wouldn't classify it as a bug. There is a limit to the size of their buffer and the target program is filling it faster than it can be emptied. The developers have made a choice regarding how much backlog to keep and how to handle the case when the backlog exceeds the buffer size. There's got to be a limit somewhere or else the program will eat all the memory if the input data rate is greater than output data rate. Do you get the same thing if you don't send the output to the log file? Disks are very slow, relatively speaking. It's a performance limitation, not a bug.
George_George wrote: Do you know any other tool to monitor soft and hard page fault separately?
off the top of my head, no
Judy
|
|
|
|
|
Thanks for your patience and help on this thread, Judy!
My question is answered.
have a good day,
George
|
|
|
|
|
I didnt see this[^] link,but its about page fault.
|
|
|
|
|
Thanks Hamid,
But I do not think it relates to my question.
regards,
George
|
|
|
|
|
No again it wast about page fault,I guess maybe you want to read more info,ok!
|
|
|
|
|
Hi Hamid,
I only need to use this tool to monitor page fault. Any ideas how to dump the number of soft and hard page fault into a file after long run of my application?
have a good weekend,
George
|
|
|
|
|
|
Thanks Hamid,
This link contains information about download of this tool, but not too many information about how to use this tool.
regards,
George
|
|
|
|
|
See is this[^] helpfuls for you?
|
|
|
|
|
Thanks Hamid,
I have read the article before. I have met with two issues.
1.
There is something like,
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
when I use -h -n to start my application using pfmon.exe, what is the issue? How to solve it?
2.
Here is a section of pfmon.log, I think it means there is a page fault in function RtlCreateTagHeap, right? What is the pow, +0x274, and +0x0000000000001C54 mean?
HARD: RtlCreateTagHeap+0x274 : pow+0x0000000000001C54
regards,
George
|
|
|
|
|
|
Thanks Hamid,
This page introduces how to use perfmon, but it could only see hard page fault. I want to use pfmon.exe to monitor both soft and hard page faults.
regards,
George
|
|
|
|
|
hi all,
I want to run .exe from service program in vista, which have run in user session insted of service session as session0.
I tried following code, but it fails at 'WTSQueryUserToken' function giving error : error number1314: A required privilege is not held by the client.
In MSDN I see that what I'm getting is the errorERROR_PRIVILEGE_NOT_HELD which means:The caller does not have theSE_TCB_NAME privilege. How can I set this previledge?
Here is my source:
HANDLE hTokenNew = NULL, hTokenDup = NULL;
HMODULE hmod = LoadLibrary("kernel32.dll");
PVOID proc = GetProcAddress(hmod, "WTSGetActiveConsoleSessionId");
DWORD dwSessionId = WTSGetActiveConsoleSessionId();
f(!WTSQueryUserToken(dwSessionId, &hTokenNew)){
ErrorExit("WTSQueryUserToken");
}
DuplicateTokenEx(hTokenNew,MAXIMUM_ALLOWED,NULL,SecurityIdentification,TokenPrimary,&hTokenDup);
WriteToFile("Calling lpfnCreateEnvironmentBlock");
ZeroMemory( &si, sizeof( STARTUPINFO ) );
si.cb = sizeof( STARTUPINFO );
si.lpDesktop = "winsta0\\default";
LPVOID pEnv = NULL;
DWORD dwCreationFlag = NORMAL_PRIORITY_CLASS | CREATE_NEW_CONSOLE;
HMODULE hModule = LoadLibrary("Userenv.dll");
if(hModule )
{
PVOID _imp_CreateEnvironmentBlock = GetProcAddress( hModule, "CreateEnvironmentBlock" );
if( _imp_CreateEnvironmentBlock != NULL )
{
if(CreateEnvironmentBlock(&pEnv, hTokenDup, FALSE))
{
WriteToFile("CreateEnvironmentBlock Ok");
dwCreationFlag |= CREATE_UNICODE_ENVIRONMENT;
}
else
{
pEnv = NULL;
}
}
}
ZeroMemory( &pi,sizeof(pi));
if ( !CreateProcessAsUser(
hTokenDup,
NULL,
"E:\\example.exe",
NULL,
NULL,
FALSE,
dwCreationFlag,
pEnv,
NULL,
&si,
&pi
) )
{
ErrorExit("CreareProcessAsUser");
return FALSE;
//goto RESTORE;
}
Please reply,
thanks in advance
|
|
|
|
|