Kernel equivalent of !Runaway

WINDBG
1

Hello all,

I am currently trying to debug an issue with my driver where it is
currently consuming too much of the processor. The way I’ve
determined this is by looking at the task manager and observing that
the “system” process is using 80%+ of the process. Is there a way to
determine which threads are currently eating up the processor? I am
looking for a kernel-mode equivalent of !runaway for user-mode
processes.

Thanks,
J

2

I don’t think there’s a built in command to do this in kernel mode. !process
and !thread do show this information though, so:

!process 4 7

Will show you all of the threads in the system process and their kernel
times. You could then parse this out with the help of coffee or a quick Perl
script.

Or, even better, take the !uniqstack implementation from the latest issue of
The NT Insider and add a !runaway command for kernel mode:

Article: http://www.osronline.com/article.cfm?article=559
Code: http://www.osronline.com/OsrDown.cfm/apexts.zip?name=apexts.zip&id=559

It at least shows how to walk every thread in the system, from there you
could just grab the user/kernel times (they’re in the KTHREAD) and sort the
output that way.

-scott

–
Scott Noone
Consulting Associate
OSR Open Systems Resources, Inc.
http://www.osronline.com

“Jonathon” wrote in message news:xxxxx@windbg…
> Hello all,
>
> I am currently trying to debug an issue with my driver where it is
> currently consuming too much of the processor. The way I’ve
> determined this is by looking at the task manager and observing that
> the “system” process is using 80%+ of the process. Is there a way to
> determine which threads are currently eating up the processor? I am
> looking for a kernel-mode equivalent of !runaway for user-mode
> processes.
>
> Thanks,
> J
>