Windows sysinternals

114 Part II Usage Guide
Displaying Profiling Events
The four classes of events that Procmon displays by default—registry, file system, network,
and process activity—represent operations initiated by processes on the computer. The fifth
event class, profiling events, includes artificial events periodically generated by Procmon itself
(except for Debug Output Profiling events, described in the “Injecting Debug Output into
Procmon Traces” section later in this chapter). Profiling events are not displayed by default,
but they can be displayed by toggling the Show Profiling Events icon on the toolbar.
Process Profiling events are generated for every process on the computer once per second.
Each event captures the user-mode and kernel-mode CPU time charged to the process since
it started, the private bytes currently allocated by the process, and the working set consumed
by the process. The Duration attribute for Process Profiling events is fixed at 0.
Unlike with Process Profiling events, the data captured by Thread Profiling events is not
cumulative. When enabled, Thread Profiling events capture the amount of user-mode and
kernel-mode CPU time and the number of context switches since the thread’s previous profiling
event. The Duration attribute reports the sum of the user-mode and kernel-mode CPU
time, and it can be used in a filter rule to help identify CPU spikes. Thread Profiling events are
created only for threads that had at least one context switch during the polling interval, not
for threads in the Idle process.
Process Profiling events are always generated once per second. Thread Profiling events are
not generated by default, but they can be enabled with the Thread Profiling Options dialog
box (shown in Figure 4-7), which you access by choosing Profiling Events from the Options
menu. When Generate Thread Profiling Events is selected, Procmon generates Thread
Profiling events either once per second or ten times per second, according to the period
chosen in the Options dialog box.
Important Enabling Thread Profiling capture is a potentially expensive option that should be
used only when necessary.
FIGURE 4-7 The Thread Profiling Options dialog box.
www.it-ebooks.info