itoleck / WindowsPerformance

Various Windows Performance files, scripts, settings and documents
MIT License
31 stars 10 forks source link

Answer key for trace; HighCPUUsageEasy.etl #11

Open itoleck opened 1 year ago

itoleck commented 1 year ago

Scenario:

A user sees in Task Manager that the CPUs are busy even though not many applications are installed on the system.

Analysis:

For CPU analysis, the number of processors available in Windows needs to be known as the CPU Usage, % Weight column can only be deciphered when the number of CPUs are known.
HighCPUUsageEasy1

There are 8 CPUs available. *These may be Hyperthreading cores, Normal cores, P cores, E cores; aka logical CPUs.

In the Trace Statistics table you can view all of the trace providers that were captured in the trace file (.etl). Notice that the PerfInfo provider was captured with the Sampled Profile events. This indicates that the CPU usage was sampled while the trace was running (Default 1ms sample time. Can be set before trace with wpr.exe -setprofint <#>) Example. Basic CPU usage information is available in the trace.

Also notice that the StackWalk provider is not available in the trace; which means that more detailed information about the stack functions for the process's threads are not available.
HighCPUUsageEasy2

Add the Graph Explorer->Computation->CPU Usage (Sampled) graph to an analysis window. Make sure the columns are sorted by the % Weight column in decsending order. The Idle (0) process should be first in the list. The Idle process is an idle loop in the Windows kernel that just waits while there are no other threads to run. This can be ignored, or you can right-click->Filter Out Selection on the row to remove it from the view.

The next process is cpustres.exe (7072). The number in parenthises is the process ID(PID). This process is consuming 24.94 % Weight. Since the machine has 8 CPUs, the weight of 1 CPU at full speed processing is 12.5%, so cpustres.exe is utilizing about 2 CPUs worth of processing. The threads that are processing may be running on 1 or more CPUs. This can be viewed by adding the CPU column to the view.
HighCPUUsageEasy3

You can see that the cpustres.exe process is utilizing all of the CPUs to do work. This is good behavior for multi-threaded applications.

Remediation:

Shut down the cpustres.exe process to save CPU resources.