Re: pfmon.exe tool - C / C++ / MFC Discussion Boards

JudyL_MD17-Jan-08 5:43

17-Jan-08 5:43

It's normal mode shows both hard and soft faults. Just pass the name of the app you want to monitor as the first argument i.e. pfmon notepad. You did do pfmon /? at the command line, didn't you? The options look pretty straight-forward to me.

Judy

Re: pfmon.exe tool

George_George17-Jan-08 19:04

George_George

17-Jan-08 19:04

Thanks Judy,

I have typed pfmon notepad, no error messages and no notepad application is invoked to display. Shall I start notepad at first, then type pfmon notepad? Which is the correct way?

regards,
George

Re: pfmon.exe tool

JudyL_MD18-Jan-08 1:56

JudyL_MD

18-Jan-08 1:56

It works for me. I opened the command prompt, changed to the directory where pfmon.exe lives, typed pfmon notepad, and .... notepad launched and pfmon dumped lots of info to the command window. When I closed notepad, a summary appeared and pfmon terminated.

XP SP2

Judy

Re: pfmon.exe tool

George_George19-Jan-08 1:13

George_George

19-Jan-08 1:13

Thanks, Judy!

It works for my now! I previously used the wrong version pfmon.exe for x86 platform on my x64 desktop. There are a lot of information dumped to console, do you know how to dump result into file? I only interested in the number of soft and hard page faults after a long run of my application.

regards,
George

Re: pfmon.exe tool

JudyL_MD21-Jan-08 2:31

JudyL_MD

21-Jan-08 2:31

The same way you redirect console output from any command-line program:

foo.exe > outputfile.txt

Re: pfmon.exe tool

George_George21-Jan-08 2:54

George_George

21-Jan-08 2:54

Thanks Judy,

I have met with two further issues.

1.

There is something like,

Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed

when I use -h -n to start my application using pfmon.exe, what is the issue? How to solve it?

2.

Here is a section of pfmon.log, I think it means there is a page fault in function RtlCreateTagHeap, right? What is the pow, +0x274, and +0x0000000000001C54 mean?

HARD: RtlCreateTagHeap+0x274 : pow+0x0000000000001C54

regards,
George

Re: pfmon.exe tool

JudyL_MD21-Jan-08 9:08

JudyL_MD

21-Jan-08 9:08

I don't know for sure but I'll take a guess or two

George_George wrote:
1.
There is something like,

Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed

I'd wager the program maintains an internal buffer that logs the faults and a seperate thread that outputs the buffer to the log file. This appears when faults are coming in faster than the output thread can empty the buffer.

George_George wrote:
2.
Here is a section of pfmon.log, I think it means there is a page fault in function RtlCreateTagHeap, right? What is the pow, +0x274, and +0x0000000000001C54 mean?

HARD: RtlCreateTagHeap+0x274 : pow+0x0000000000001C54

HARD: kind of fault
RtlCreateTagHeap+0x274: where fault occured - i.e. code address that caused the fault
pow+0x0000000000001C54: address of memory that was trying to be accessed

It shows as some_name+xxxx whenever that 3rd address is close enough or in the same segment as a function. Instead of just a raw address, you're getting the address relative to the start of a function.

Judy

Re: pfmon.exe tool

George_George21-Jan-08 19:36

George_George

21-Jan-08 19:36

Thanks Judy,

Great!

1.

JudyL_FL wrote:
I'd wager the program maintains an internal buffer that logs the faults and a seperate thread that outputs the buffer to the log file. This appears when faults are coming in faster than the output thread can empty the buffer.

Any ways or parameter to increase the internal buffer? Do you experienced the same issue?

2.

JudyL_FL wrote:
RtlCreateTagHeap+0x274: where fault occured - i.e. code address that caused the fault
pow+0x0000000000001C54: address of memory that was trying to be accessed

It shows as some_name+xxxx whenever that 3rd address is close enough or in the same segment as a function. Instead of just a raw address, you're getting the address relative to the start of a function.

So, RtlCreateTagHeap is the function name, and 0x274 is the offset from the RtlCreateTagHeap where the code in function RtlCreateTagHeap causes hard page fault?

But what is pow?

regards,
George

Re: pfmon.exe tool

JudyL_MD22-Jan-08 2:20

JudyL_MD

22-Jan-08 2:20

George_George wrote:
Any ways or parameter to increase the internal buffer? Do you experienced the same issue?

I doubt it - if it was a parameter, I think it would be listed in the /? screen. I don't particularly use the tool so I have very little experience with it.

George_George wrote:
So, RtlCreateTagHeap is the function name, and 0x274 is the offset from the RtlCreateTagHeap where the code in function RtlCreateTagHeap causes hard page fault?

Probably. Note that the address is relative to the closest "named" function. If it's inside a function without a name (as in a non-exported function in a DLL compiled in full-up release mode), it may be a raw address or an offset from the previous function.

George_George wrote:
But what is pow?

pow is a math function prototyped in <complex.h>. Again, this is a relative address. Pfmon is taking a stab at making the raw address more meaningful by listing it as an offset from the closest thing that has a name.

All these relative addresses become much more useless (yes, useless is not a typo) when you are dealing with optimized / release mode code since function names can be stripped out of the executable and code rearranged. If you're not careful, you can start digging through the wrong code. You really need to have a .MAP file when trying to correlate a relative address into your release-mode code.

Judy

Re: pfmon.exe tool

George_George22-Jan-08 16:14

George_George

22-Jan-08 16:14

Thanks Judy,

Do you think messages like this,

Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed

indicats a bug of my application or a bug/limit of pfmon.exe itself?

regards,
George

Re: pfmon.exe tool

JudyL_MD23-Jan-08 1:54

JudyL_MD

23-Jan-08 1:54

pfmon

Re: pfmon.exe tool

George_George23-Jan-08 2:18

George_George

23-Jan-08 2:18

Thanks Judy!

It is surprised to see we find a bug of pfmon.exe. Do you know any other tool to monitor soft and hard page fault separately? Smile | :)

regards,
George

Re: pfmon.exe tool

JudyL_MD23-Jan-08 2:34

JudyL_MD

23-Jan-08 2:34

George_George wrote:
bug of pfmon.exe

I wouldn't classify it as a bug. There is a limit to the size of their buffer and the target program is filling it faster than it can be emptied. The developers have made a choice regarding how much backlog to keep and how to handle the case when the backlog exceeds the buffer size. There's got to be a limit somewhere or else the program will eat all the memory if the input data rate is greater than output data rate. Do you get the same thing if you don't send the output to the log file? Disks are very slow, relatively speaking. It's a performance limitation, not a bug.

George_George wrote:
Do you know any other tool to monitor soft and hard page fault separately?

off the top of my head, no

Judy

Re: pfmon.exe tool

George_George23-Jan-08 2:43

George_George

23-Jan-08 2:43

Thanks for your patience and help on this thread, Judy!

My question is answered.

have a good day,
George

Re: pfmon.exe tool

Hamid_RT17-Jan-08 18:04

Hamid_RT

17-Jan-08 18:04

I didnt see this[^] link,but its about page fault.

Re: pfmon.exe tool

George_George17-Jan-08 19:08

George_George

17-Jan-08 19:08

Thanks Hamid,

But I do not think it relates to my question. Smile | :)

regards,
George

Re: pfmon.exe tool

Hamid_RT18-Jan-08 19:15

Hamid_RT

18-Jan-08 19:15

No again it wast about page fault,I guess maybe you want to read more info,ok! Wink | ;)

Re: pfmon.exe tool

George_George19-Jan-08 1:14

George_George

19-Jan-08 1:14

Hi Hamid,

I only need to use this tool to monitor page fault. Any ideas how to dump the number of soft and hard page fault into a file after long run of my application? Smile | :)

have a good weekend,
George

Re: pfmon.exe tool

Hamid_RT19-Jan-08 7:37

Hamid_RT

19-Jan-08 7:37

Does this[^] helpful?

Re: pfmon.exe tool

George_George19-Jan-08 22:18

George_George

19-Jan-08 22:18

Thanks Hamid,

This link contains information about download of this tool, but not too many information about how to use this tool.

regards,
George

Re: pfmon.exe tool

Hamid_RT20-Jan-08 3:59

Hamid_RT

20-Jan-08 3:59

See is this[^] helpfuls for you? Wink | ;)

Re: pfmon.exe tool

George_George20-Jan-08 4:07

George_George

20-Jan-08 4:07

Thanks Hamid,

I have read the article before. I have met with two issues.

1.

There is something like,

Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed

when I use -h -n to start my application using pfmon.exe, what is the issue? How to solve it?

2.

Here is a section of pfmon.log, I think it means there is a page fault in function RtlCreateTagHeap, right? What is the pow, +0x274, and +0x0000000000001C54 mean?

HARD: RtlCreateTagHeap+0x274 : pow+0x0000000000001C54

regards,
George

Re: pfmon.exe tool

Hamid_RT20-Jan-08 7:24

Hamid_RT

20-Jan-08 7:24

OF course I believe its very difficult that we solve problem of page fault because for example see Find a memory leak that is bloating the Windows XP pagefile[^].

Re: pfmon.exe tool

George_George20-Jan-08 16:22

George_George

20-Jan-08 16:22

Thanks Hamid,

This page introduces how to use perfmon, but it could only see hard page fault. I want to use pfmon.exe to monitor both soft and hard page faults.

regards,
George

CreateProcessAsUser

dilip.kamalia17-Jan-08 3:33

dilip.kamalia

17-Jan-08 3:33

hi all,

I want to run .exe from service program in vista, which have run in user session insted of service session as session0.

I tried following code, but it fails at 'WTSQueryUserToken' function giving error : error number1314: A required privilege is not held by the client.

In MSDN I see that what I'm getting is the errorERROR_PRIVILEGE_NOT_HELD which means:The caller does not have theSE_TCB_NAME privilege. How can I set this previledge?

Here is my source:

HANDLE hTokenNew = NULL, hTokenDup = NULL;
HMODULE hmod = LoadLibrary("kernel32.dll");

PVOID proc = GetProcAddress(hmod, "WTSGetActiveConsoleSessionId");
DWORD dwSessionId = WTSGetActiveConsoleSessionId();

f(!WTSQueryUserToken(dwSessionId, &hTokenNew)){
ErrorExit("WTSQueryUserToken");
}

DuplicateTokenEx(hTokenNew,MAXIMUM_ALLOWED,NULL,SecurityIdentification,TokenPrimary,&hTokenDup);
WriteToFile("Calling lpfnCreateEnvironmentBlock");

ZeroMemory( &si, sizeof( STARTUPINFO ) );
si.cb = sizeof( STARTUPINFO );
si.lpDesktop = "winsta0\\default";

LPVOID pEnv = NULL;
DWORD dwCreationFlag = NORMAL_PRIORITY_CLASS | CREATE_NEW_CONSOLE;
HMODULE hModule = LoadLibrary("Userenv.dll");
if(hModule )
{

PVOID _imp_CreateEnvironmentBlock = GetProcAddress( hModule, "CreateEnvironmentBlock" );
if( _imp_CreateEnvironmentBlock != NULL )
{

if(CreateEnvironmentBlock(&pEnv, hTokenDup, FALSE))
{
WriteToFile("CreateEnvironmentBlock Ok");
dwCreationFlag |= CREATE_UNICODE_ENVIRONMENT;
}
else
{
pEnv = NULL;
}
}
}

ZeroMemory( &pi,sizeof(pi));

if ( !CreateProcessAsUser(
hTokenDup,
NULL,
"E:\\example.exe",
NULL,
NULL,
FALSE,
dwCreationFlag,
pEnv,
NULL,
&si,
&pi
) )
{
ErrorExit("CreareProcessAsUser");
return FALSE;
//goto RESTORE;
}

Please reply,

thanks in advance

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.