sporadic performance issues -and XPerf on Windows 7, how to get Network related data? RRS feed

  • Question

  • Hi, I'm 'playing' around with Xperf and the command line because we have (sporadic but too often) performance issues on a location, especially with a program which use large data files (e.g. 9 GB) from a network share.

    The users have Windows 7 machines with >48 core CPUs, 64 GB Ram, SSDs and sometimes the computers are (reported) completely stuck while working but the task manager do not show any suspicious activity. So the hardware should not be the bottleneck.

    Because the responsible persons, who administrate the network, stated "it's all ok with our environment" - every time they do this - then I tried to catch the reason with Xperf.
    Unfortunately the program do not show the network data to me. With a newer version I can monitor only newer Windows versions - then the "connections" data analytic is shown but how to get this in Windows 7?
    I also tried the WPRUI.exe

    an light overview about the config: Windows 7, user is not administrator, Antivirus is enabled, other hooking applications (like SSO, FireEye) are disabled.
    I have added a task in the task scheduler who check periodically a specific directory - if the dir is found then the xperf trace will start. This was necessary because I wanted to have the opportunity for the user to start and stop the traces for himself without contacting the support. The user can create/ delete this 'special' folder (or file).

    If the folder exist then this is fired:
    "%~dp0psexec.exe" -accepteula -d -s -i 0 "%~dp0xperf.exe" -on latency+Networktrace -stackwalk Profile+CSwitch+ThreadCreate+ReadyThread -BufferSize 1024 -MinBuffers 256 -MaxBuffers 256 -MaxFile 512 -FileMode Circular -start usersession -on Microsoft-Windows-Win32k

    after 2 minutes I write down the data to a file:
    "%~dp0psexec.exe" -accepteula -s -i 0 "%~dp0xperf.exe" -stop usersession -stop -d "!LOGPATH!\LOGFILE_!COUNTER!.etl"

    This actions run in a loop until the user will remove the start folder. Later I can collect the data folder with the user information when the issue occurred.

    In the data file I saw the specific application with high "MsgCheck Delay" and "Input Delay" in the "UI Delays by Process, Type" view. Also I can analyze other data which were collected but I miss the "Connection" view like seen on a Windows 10 computer.

    I write here because members like Andre Ziegler have given many useful advises to other questions and I hope for input or a "different sight" to my view. Maybe a different idea to "hunt down"/ "set up a trap" for the sporadic occurring issue is given.
    With the data collection I shoot in all directions because I can't reproduce the issue and if the issue occurred then I want data where to filter out.

    just an additional info, later I saw on an affected machine:

    The network share use DFS and sometime the drive almost "freeze" when just browsing through. This do not happen every time and is not reproducible but I believe this will be the same reason for the program with these large data files.
    This is the reason to point out to the share and how the share is accessed and not the computer configuration but I want to proof this.
    In the past I already found the share was listed different (without FQDN) in the DFS but I do not know what I can check further on the client side, related to the share.
    I also configured an ProcMon Trace in a loop with the same conditions (task, user controlled) but right now I did not got qualified data to analyze. The users do not help (or not able to help) like expected ...

    Any 'input' is appreciated (and I hope you'll understand my English).

    Friday, August 25, 2017 5:36 PM

All replies

  • Hi,

    Have you tried network monitor? If not, please try it.

    Microsoft Network Monitor 3.4 (archive)


    In addition, you can also feedback this issue.

    Best Regards,


    Please remember to mark the replies as answers if they help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Proposed as answer by Tony_Tao Wednesday, September 6, 2017 6:17 AM
    Monday, August 28, 2017 2:32 AM