Getting approximate CPU load from a memory dump?

WINDBG
1

To explain a recent crash I have, it seems that there would have had to be a process swap and the process didn’t get to run again for nearly a minute (allowing a buffer to wrap). That seems unlikely, but the process was running at low priority, so I’m looking for something to support or shoot down the theory.

Is there some way to tease out some information along those lines from a memory.dmp? Such as recent amount of time the process ran, or % CPU load recently, or something along those lines? Clearly, I’m not going to find the % CPU graph sitting around, but I’m hoping that there’s some detailed process information that might help me.

Thanks!

2

You may get some Information by dumping the ETHREAD / KTHREAD structure. The symbolic @$thread register points to the ETHREAD / KTHREAD of the current selected Thread.

examples:
dt @$thread nt!_ETHREAD
dt @$thread nt!_KTHREAD

or with evaluator:
?? @$thread->Cid

You will not get %CPU, but you can get UserTime / KernelTime, and maybe you can analyse if the thread waits on some event.

GP

3

!prcb will tell you the user and kernel time of the processor and you can
get the idle time from the idle thread, which would give you a general idea
as to how busy the system has been overall. This may or may not be useful
depending on how much time passed before and after the event. If you have a
crash at the exact moment where you think that you went beyond your
threshold you can check the ready lists with !ready. This will tell you if
your thread is waiting for a slice and you should be able to tell how long
it’s been waiting.

-scott

–
Scott Noone
Consulting Associate and Chief System Problem Analyst
OSR Open Systems Resources, Inc.
http://www.osronline.com

“Taed Wynnell” wrote in message news:xxxxx@windbg…

To explain a recent crash I have, it seems that there would have had to be a
process swap and the process didn’t get to run again for nearly a minute
(allowing a buffer to wrap). That seems unlikely, but the process was
running at low priority, so I’m looking for something to support or shoot
down the theory.

Is there some way to tease out some information along those lines from a
memory.dmp? Such as recent amount of time the process ran, or % CPU load
recently, or something along those lines? Clearly, I’m not going to find
the % CPU graph sitting around, but I’m hoping that there’s some detailed
process information that might help me.

Thanks!