More often than not, we collect bigger trace files than we really need. Even though what we are interested in are just a few types of events from an event provider. Or other times, we want to see the call stacks of just a few events but not the rest from the event provider. Turning on the event provider with stacks without any filtering can result ...

Performance Monitor Unit (PMU) events are used to measure CPU performance and understand workloads CPU characterization. Windows provides a way to collect PMU events through Event Tracing for Windows (ETW). When combined with other ETW events, we can tell a lot more concrete story about the performance. I recently added “Recording Hardware performa...

This blog post explains EventProvider element in WPR profile and its child elements and attributes. Among many elements of the profile, EventProvider is the most used element and most configurable.

WPR supports configuring an autologger. Setting up the autologger and collecting the autologger trace is as easy as starting/stopping the trace. This article introduces how to start, stop, and cancel the autologger as well as export the autologger registry keys.

From time to time, I get questions about insufficient system resource error (0x800705aa) when starting the trace using WPR. The error can be frustrating, especially when there is enough memory and storage space left on the system. Some people try to solve the issue by increasing the system resources such as killing some apps and services. It does n...

In this post, I explained what the session name is in ETW and how to set the session name through WPR with the instancename option.

In this post, we enhance the simple custom profile for WPR by adding the system tracing session. Because kernel events provide critical information about processes, threads, modules, and more, collecting the system events greatly extends your ability to analyze traces and diagnose issues.

This is the first post in a multi-part series about authoring custom profiles for Windows Performance Recorder (WPR.) In a previous post, we have looked at how to start a trace with built-in profiles. The built-in profiles offer wide variety of preset profiles that we can use for different scenarios. There are built-in profiles for CPU usage, Ne...

In this post, we show how to start and stop the trace using WPR. The first step is doing 'wpr -help start'. The command parameters seems to be cryptic. We explain those parameters in detail with examples.

This is the first blog post about WPR. WPR is an acronym for Windows Performance Recorder. This post introduces list of acronyms that are used commonly performance tools, installation steps, the difference between WPR and WPRUI, and finally about the instance name and the error.