Writing a WPA Regions of Interest File

In my previuos article I wrote a very simple Windows Performance Recorder profile to enable a particular ETW Provider. After recording a trace, the next step is to open it up in Windows Performance Analyzer (WPA) to see what is going on. There can be a lot of events in a trace and so anything that can help with pattern detection is most welcome.

One nice feature in WPA (starting in Windows 8.1) is called Regions of Interest. This allows you to link any two events so that they appear together in the UI. For example, if you log at the start and end of a method, it is quite natural that you would want to link these events together so that you can easily figure out the duration of the method, what else happened on the system during that time period, etc…

Example: I want to know how much CPU time my HCKServiceValidation function takes. I instrument the function with events at the start and end. Next, I record a trace, open it up in WPA and add my Regions of Interest file. After adding a couple of graphs and filtering on my process,  I get something very cool — I can see that the HCKServiceValidation function took 0.12 seconds to run, and maxed out at about 25% CPU usage.

Function CPU Usage

The Regions of Interest file is quite simple. You need only define a couple of GUIDs, and then you can link events via their event IDs.

<?xml version='1.0' encoding='utf-8' standalone='yes'?>
<?Copyright (c) Microsoft Corporation. All rights reserved.?>
 <RegionRoot Guid="{934E499F-A064-4DA4-8D96-AAEF60E37F52}"
 Name="WHQL Region File Root"
 <Region Guid="{0EC1D460-B7C7-47F8-987C-6FA51DCA24BC}"
 FriendlyName="HCK Service Validation">
 <Event Provider="{7D0810B4-15F2-4D2F-9C88-C885B330D944}" Id="2" Version="0" />
 <Event Provider="{7D0810B4-15F2-4D2F-9C88-C885B330D944}" Id="3" Version="0" />

Once you open your trace in WPA, you can add your Regions of Interest file under Trace->Trace Properties.

Adding Regions of Interest File

If any of the configured regions show up in the trace, you will see an additional graph called System Activity->Regions of Interest, which is what I displayed above. More information on MSDN.

This entry was posted in Performance and tagged , . Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s