thread wait time format

WINDBG
1

Hi all
I’m looking at the wait time for some threads in a x64 memory dump and !thread gives these as Ticks: 15451 (0:00:04:01.037)

Does this equate to 4m 1s 37ms or 4s 1ms 37us ??

I’ve tried converting myself using KeTimeIncrement
dd KeTimeIncrement l1
fffff800`03704094 00001388

My understanding is that a time increment of 0x1388 (0n5000) means that each tick is 5000 100 ns intervals so each tick is 0n5000/0n10000000.0 = 0.0005s

Multiplying up, 15451 * 0.0005s = 7.7255s which is nothing like the 04:01.037 whatever the format.

Very confused. Can anybody shed any light on this ??

Regards

Mark

2

xxxxx@amberleigh.eclipse.co.uk wrote:

Hi all
I’m looking at the wait time for some threads in a x64 memory dump and !thread gives these as Ticks: 15451 (0:00:04:01.037)

Does this equate to 4m 1s 37ms or 4s 1ms 37us ??

4 minutes. Those are timer interrupt ticks (scheduler intervals), which
are 15.6ms on your system.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

3

Thanks Tim - much appreciated.

Regards

Mark

4

though tim answered you i remembered a good entry by Dmitry Vostokov
regarding the same so posting the link

http://www.dumpanalysis.org/blog/index.php/2007/07/22/crash-dump-analysis-patterns-part-19/

On 5/21/12, xxxxx@amberleigh.eclipse.co.uk wrote:
> Thanks Tim - much appreciated.
>
> Regards
>
> Mark
>
>
> —
> WINDBG is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>