Use Microsoft-Windows-Kernel-Memory instead of scanning working sets about uiforetw HOT 6 CLOSED

I tested on Windows 7 and while Microsoft-Windows-Kernel-Memory works as a provider (the trace can be recorded) no memory data is recorded - at least nothing that WPA shows.

I'll test on Windows 8.1 as well and figure out what version checking to use. I'll also try KERNEL_MEM_KEYWORD_WS_SWAP to see if it is any use.

from uiforetw.

I found a bit of documentation of these flags here:

https://github.com/MSOpenTech/Tx/blob/master/Manifests/SystemEvents.man

If you have any other information then please share.

from uiforetw.

You can use Perfview on a Windows to dump the manifest and look which events are supported.

PerfView /nogui userCommand DumpRegisteredManifest Microsoft-Windows-Kernel-Memory
generates the manifest asMicrosoft-Windows-Kernel-Memory.manifest.xml

For me it shows that Win7 only supports KERNEL_MEM_KEYWORD_MEMINFO which doesn't log WorkingSets.

from uiforetw.

Testing on Windows 8.1 shows that it captures KERNEL_MEM_KEYWORD_MEMINFO_EX data - the Virtual Memory Snapshots view is populated. I haven't tested Windows 8 and don't intend to. So... on Windows 8.1 and above we can rely on Microsoft-Windows-Kernel-Memory and can disable UIforETW's scanning of working sets, which neatly reduces the overhead of having UIforETW running.

from uiforetw.

I'm tempted to put more information in the settings dialog to explain why the options are disabled in 8.1 and above, but for now I haven't bothered. Fixed. Thanks for the suggestion. It will be in the next release.

from uiforetw.

You should also enable it for 6.2 (Win8(Embedded)/Server 2012), not only 8.1/2012R2.

from uiforetw.