Xperf gives the accurate lifetime of a process, an year ago I used to hold a stop watch and do this 🙂
xperf flags used – LOADER+PROC_THREAD
for this demonstration i am going to launch xperf with LOADER+PROC_THREAD flags and open notepad, do some typing, finally close notepad and stop xperf and merge kernel and user traces and get the lifetime of notepad from process lifetimes graph..
- open cmd as administrator
- create, cd into dir c:\xperf_ouput and launch xperf with LOADER+PROC flags
- open notepad, type something in it and close it
- stop xperf and merge kernel and user trace using xperf -d
- open the etl file with Performance Analyzer and get the notepad lifetime
As you can see the duration of notepad was 16.4 seconds.
This same procedure can be used with xbootmgr to capture boot and shutdown etl’s and analyze which process is causing the delays.
Thanks for viewing, hope you learned something from this.