Re: pfmon.exe tool - C / C++ / MFC Discussion Boards

George_George21-Jan-08 2:54

21-Jan-08 2:54

Thanks Judy,

I have met with two further issues.

1.

There is something like,

Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed

when I use -h -n to start my application using pfmon.exe, what is the issue? How to solve it?

2.

Here is a section of pfmon.log, I think it means there is a page fault in function RtlCreateTagHeap, right? What is the pow, +0x274, and +0x0000000000001C54 mean?

HARD: RtlCreateTagHeap+0x274 : pow+0x0000000000001C54

regards,
George

Re: pfmon.exe tool

JudyL_MD21-Jan-08 9:08

JudyL_MD

21-Jan-08 9:08

I don't know for sure but I'll take a guess or two

George_George wrote:
1.
There is something like,

Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed

I'd wager the program maintains an internal buffer that logs the faults and a seperate thread that outputs the buffer to the log file. This appears when faults are coming in faster than the output thread can empty the buffer.

George_George wrote:
2.
Here is a section of pfmon.log, I think it means there is a page fault in function RtlCreateTagHeap, right? What is the pow, +0x274, and +0x0000000000001C54 mean?

HARD: RtlCreateTagHeap+0x274 : pow+0x0000000000001C54

HARD: kind of fault
RtlCreateTagHeap+0x274: where fault occured - i.e. code address that caused the fault
pow+0x0000000000001C54: address of memory that was trying to be accessed

It shows as some_name+xxxx whenever that 3rd address is close enough or in the same segment as a function. Instead of just a raw address, you're getting the address relative to the start of a function.

Judy

Re: pfmon.exe tool

George_George21-Jan-08 19:36

George_George

21-Jan-08 19:36

Thanks Judy,

Great!

1.

JudyL_FL wrote:
I'd wager the program maintains an internal buffer that logs the faults and a seperate thread that outputs the buffer to the log file. This appears when faults are coming in faster than the output thread can empty the buffer.

Any ways or parameter to increase the internal buffer? Do you experienced the same issue?

2.

JudyL_FL wrote:
RtlCreateTagHeap+0x274: where fault occured - i.e. code address that caused the fault
pow+0x0000000000001C54: address of memory that was trying to be accessed

It shows as some_name+xxxx whenever that 3rd address is close enough or in the same segment as a function. Instead of just a raw address, you're getting the address relative to the start of a function.

So, RtlCreateTagHeap is the function name, and 0x274 is the offset from the RtlCreateTagHeap where the code in function RtlCreateTagHeap causes hard page fault?

But what is pow?

regards,
George

Re: pfmon.exe tool

JudyL_MD22-Jan-08 2:20

JudyL_MD

22-Jan-08 2:20

George_George wrote:
Any ways or parameter to increase the internal buffer? Do you experienced the same issue?

I doubt it - if it was a parameter, I think it would be listed in the /? screen. I don't particularly use the tool so I have very little experience with it.

George_George wrote:
So, RtlCreateTagHeap is the function name, and 0x274 is the offset from the RtlCreateTagHeap where the code in function RtlCreateTagHeap causes hard page fault?

Probably. Note that the address is relative to the closest "named" function. If it's inside a function without a name (as in a non-exported function in a DLL compiled in full-up release mode), it may be a raw address or an offset from the previous function.

George_George wrote:
But what is pow?

pow is a math function prototyped in <complex.h>. Again, this is a relative address. Pfmon is taking a stab at making the raw address more meaningful by listing it as an offset from the closest thing that has a name.

All these relative addresses become much more useless (yes, useless is not a typo) when you are dealing with optimized / release mode code since function names can be stripped out of the executable and code rearranged. If you're not careful, you can start digging through the wrong code. You really need to have a .MAP file when trying to correlate a relative address into your release-mode code.

Judy

Re: pfmon.exe tool

George_George22-Jan-08 16:14

George_George

22-Jan-08 16:14

Thanks Judy,

Do you think messages like this,

Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed

indicats a bug of my application or a bug/limit of pfmon.exe itself?

regards,
George

Re: pfmon.exe tool

JudyL_MD23-Jan-08 1:54

JudyL_MD

23-Jan-08 1:54

pfmon

Re: pfmon.exe tool

George_George23-Jan-08 2:18

George_George

23-Jan-08 2:18

Thanks Judy!

It is surprised to see we find a bug of pfmon.exe. Do you know any other tool to monitor soft and hard page fault separately? Smile | :)

regards,
George

Re: pfmon.exe tool

JudyL_MD23-Jan-08 2:34

JudyL_MD

23-Jan-08 2:34

George_George wrote:
bug of pfmon.exe

I wouldn't classify it as a bug. There is a limit to the size of their buffer and the target program is filling it faster than it can be emptied. The developers have made a choice regarding how much backlog to keep and how to handle the case when the backlog exceeds the buffer size. There's got to be a limit somewhere or else the program will eat all the memory if the input data rate is greater than output data rate. Do you get the same thing if you don't send the output to the log file? Disks are very slow, relatively speaking. It's a performance limitation, not a bug.

George_George wrote:
Do you know any other tool to monitor soft and hard page fault separately?

off the top of my head, no

Judy

Re: pfmon.exe tool

George_George23-Jan-08 2:43

George_George

23-Jan-08 2:43

Thanks for your patience and help on this thread, Judy!

My question is answered.

have a good day,
George

Re: pfmon.exe tool

Hamid_RT17-Jan-08 18:04

Hamid_RT

17-Jan-08 18:04

I didnt see this[^] link,but its about page fault.

Re: pfmon.exe tool

George_George17-Jan-08 19:08

George_George

17-Jan-08 19:08

Thanks Hamid,

But I do not think it relates to my question. Smile | :)

regards,
George

Re: pfmon.exe tool

Hamid_RT18-Jan-08 19:15

Hamid_RT

18-Jan-08 19:15

No again it wast about page fault,I guess maybe you want to read more info,ok! Wink | ;)

Re: pfmon.exe tool

George_George19-Jan-08 1:14

George_George

19-Jan-08 1:14

Hi Hamid,

I only need to use this tool to monitor page fault. Any ideas how to dump the number of soft and hard page fault into a file after long run of my application? Smile | :)

have a good weekend,
George

Re: pfmon.exe tool

Hamid_RT19-Jan-08 7:37

Hamid_RT

19-Jan-08 7:37

Does this[^] helpful?

Re: pfmon.exe tool

George_George19-Jan-08 22:18

George_George

19-Jan-08 22:18

Thanks Hamid,

This link contains information about download of this tool, but not too many information about how to use this tool.

regards,
George

Re: pfmon.exe tool

Hamid_RT20-Jan-08 3:59

Hamid_RT

20-Jan-08 3:59

See is this[^] helpfuls for you? Wink | ;)

Re: pfmon.exe tool

George_George20-Jan-08 4:07

George_George

20-Jan-08 4:07

Thanks Hamid,

I have read the article before. I have met with two issues.

1.

There is something like,

Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed
Warning: Page fault buffer has overflowed

when I use -h -n to start my application using pfmon.exe, what is the issue? How to solve it?

2.

Here is a section of pfmon.log, I think it means there is a page fault in function RtlCreateTagHeap, right? What is the pow, +0x274, and +0x0000000000001C54 mean?

HARD: RtlCreateTagHeap+0x274 : pow+0x0000000000001C54

regards,
George

Re: pfmon.exe tool

Hamid_RT20-Jan-08 7:24

Hamid_RT

20-Jan-08 7:24

OF course I believe its very difficult that we solve problem of page fault because for example see Find a memory leak that is bloating the Windows XP pagefile[^].

Re: pfmon.exe tool

George_George20-Jan-08 16:22

George_George

20-Jan-08 16:22

Thanks Hamid,

This page introduces how to use perfmon, but it could only see hard page fault. I want to use pfmon.exe to monitor both soft and hard page faults.

regards,
George

CreateProcessAsUser

dilip.kamalia17-Jan-08 3:33

dilip.kamalia

17-Jan-08 3:33

hi all,

I want to run .exe from service program in vista, which have run in user session insted of service session as session0.

I tried following code, but it fails at 'WTSQueryUserToken' function giving error : error number1314: A required privilege is not held by the client.

In MSDN I see that what I'm getting is the errorERROR_PRIVILEGE_NOT_HELD which means:The caller does not have theSE_TCB_NAME privilege. How can I set this previledge?

Here is my source:

HANDLE hTokenNew = NULL, hTokenDup = NULL;
HMODULE hmod = LoadLibrary("kernel32.dll");

PVOID proc = GetProcAddress(hmod, "WTSGetActiveConsoleSessionId");
DWORD dwSessionId = WTSGetActiveConsoleSessionId();

f(!WTSQueryUserToken(dwSessionId, &hTokenNew)){
ErrorExit("WTSQueryUserToken");
}

DuplicateTokenEx(hTokenNew,MAXIMUM_ALLOWED,NULL,SecurityIdentification,TokenPrimary,&hTokenDup);
WriteToFile("Calling lpfnCreateEnvironmentBlock");

ZeroMemory( &si, sizeof( STARTUPINFO ) );
si.cb = sizeof( STARTUPINFO );
si.lpDesktop = "winsta0\\default";

LPVOID pEnv = NULL;
DWORD dwCreationFlag = NORMAL_PRIORITY_CLASS | CREATE_NEW_CONSOLE;
HMODULE hModule = LoadLibrary("Userenv.dll");
if(hModule )
{

PVOID _imp_CreateEnvironmentBlock = GetProcAddress( hModule, "CreateEnvironmentBlock" );
if( _imp_CreateEnvironmentBlock != NULL )
{

if(CreateEnvironmentBlock(&pEnv, hTokenDup, FALSE))
{
WriteToFile("CreateEnvironmentBlock Ok");
dwCreationFlag |= CREATE_UNICODE_ENVIRONMENT;
}
else
{
pEnv = NULL;
}
}
}

ZeroMemory( &pi,sizeof(pi));

if ( !CreateProcessAsUser(
hTokenDup,
NULL,
"E:\\example.exe",
NULL,
NULL,
FALSE,
dwCreationFlag,
pEnv,
NULL,
&si,
&pi
) )
{
ErrorExit("CreareProcessAsUser");
return FALSE;
//goto RESTORE;
}

Please reply,

thanks in advance

Re: CreateProcessAsUser

Mark Salsbery17-Jan-08 7:34

Mark Salsbery

17-Jan-08 7:34

What account is the service running under?

Mark

Mark Salsbery
Microsoft MVP - Visual C++
Java | [Coffee]

Re: CreateProcessAsUser

dilip.kamalia17-Jan-08 18:56

dilip.kamalia

17-Jan-08 18:56

Hi Mark Salsbery

Service is running under system account, and i want example.exe to run under user account through that service, in vista.

Re: CreateProcessAsUser

Mark Salsbery18-Jan-08 8:01

Mark Salsbery

18-Jan-08 8:01

If it's the LocalSystem Account, then it should have the
SE_TCB_NAME privilege, and that privilege should be enabled.

It may not be enabled by default in Vista though, although I can't find
this documented.

Maybe try enabling the SE_TCB_NAME privilege...see:

Enabling and Disabling Privileges in C++[^]

Mark

Mark Salsbery
Microsoft MVP - Visual C++
Java | [Coffee]

changing background color DFC_CAPTION, DFCS_CAPTIONCLOSE

hari prasad sathpadi17-Jan-08 3:24

hari prasad sathpadi

17-Jan-08 3:24

I have used following function for drawing close button on my control bar.
But it is showing like a default windows close button.

dc.DrawFrameControl(m_rectClose, DFC_CAPTION, DFCS_CAPTIONCLOSE | DFCS_FLAT );

How can i draw minimize , restore and close buttons which should change its background.As i change the color of controlbar the background
color of close button also to be changed.

Can any one tell which is the best procedure?

Re: changing background color DFC_CAPTION, DFCS_CAPTIONCLOSE

James R. Twine17-Jan-08 4:18

James R. Twine

17-Jan-08 4:18

   Are you having problems because your application is themed, or because you are doing custom drawing of the GUI elements? If the former, see if using the DrawThemeEdge(...) function (and/or other Theme-related functions) helps you out.

   Otherwise you may have to draw the element manually.

   Peace!

-=- James
Please rate this message - let me know if I helped or not!<hr></hr>If you think it costs a lot to do it right, just wait until you find out how much it costs to do it wrong!
Remember that Professional Driver on Closed Course does not mean your Dumb Ass on a Public Road!
See DeleteFXPFiles

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.