Use WPR.exe to trace the source of the issue - Solved!

[Johncoool]

What is the correct command to be used so that a session can be started and saves the work when the PC gets the black screen from an error.

Cannot be saved manually because it is crashed.

 

[ChatGPT]

To capture a trace of system behavior during a crash, you would typically use the Windows Performance Recorder (WPR.exe). However, because WPR.exe requires user interaction which might not be possible during or immediately after a crash, in this circumstance it would be better to start a trace automatically at system startup, or utilize a different tool designed for analyzing crashes, like LiveKD which takes a snapshot of live system memory, or a memory dump file. To capture a trace using WPR.exe on startup: First, create a startup entries.

1. Open Task Scheduler. Run taskschd.msc in the Run box (Win + R).
2. On the right-hand side, click "Create Basic Task".
3. Fill in a name and description for your task and click "Next".
4. Change the trigger to “When the computer starts" and click "Next".
5. Change the action to “Start a program” and click "Next".
6. Browse to the location of WPR.exe (usually C:\Windows\System32\), and then in “Add arguments” enter -start GeneralProfile -filemode && timeout -1 && wpr -stop Desktop\trace.etl. After the system restarts the next time, it will begin an automatic trace when it boots up that will only stop and save when user manually presses any key, ideally after a crash has occurred. If system becomes too unresponsive after a crash, hard restart the system and the trace will be saved in C:\Desktop by the name trace.etl. Remember that, larger the trace file, more detailed analysis we can get. However, a large file takes longer to analyze. In any case, please take all necessary precautions before trying these technical fixes, and keep back ups of your important files. As always, apply these fixes at your own risk.

 

[Johncoool]

To capture a trace of system behavior during a crash, you would typically use the Windows Performance Recorder (WPR.exe). However, because WPR.exe requires user interaction which might not be possible during or immediately after a crash, in this circumstance it would be better to start a trace automatically at system startup, or utilize a different tool designed for analyzing crashes, like LiveKD which takes a snapshot of live system memory, or a memory dump file.

To capture a trace using WPR.exe on startup:

First, create a startup entries.

1. Open Task Scheduler. Run `taskschd.msc` in the Run box (Win + R).
2. On the right-hand side, click "Create Basic Task".
3. Fill in a name and description for your task and click "Next".
4. Change the trigger to “When the computer starts" and click "Next".
5. Change the action to “Start a program” and click "Next".
6. Browse to the location of WPR.exe (usually `C:\Windows\System32\`), and then in “Add arguments” enter `-start GeneralProfile -filemode && timeout -1 && wpr -stop Desktop\trace.etl`.

After the system restarts the next time, it will begin an automatic trace when it boots up that will only stop and save when user manually presses any key, ideally after a crash has occurred. If system becomes too unresponsive after a crash, hard restart the system and the trace will be saved in `C:\Desktop` by the name `trace.etl`.

Remember that, larger the trace file, more detailed analysis we can get. However, a large file takes longer to analyze.

In any case, please take all necessary precautions before trying these technical fixes, and keep back ups of your important files. As always, apply these fixes at your own risk.

Confirm that this is a correct argument.

I dont see wpr.exe running in taskm anager after reboot.

 

[Johncoool]

It's quite possible that you won't see `wpr.exe` running in Task Manager after a reboot. `wpr.exe` is designed to be a fairly lightweight tool and is primarily an on-demand service for problem diagnosis. It doesn't run persistently in the background under normal circumstances.

Your command `-start GeneralProfile -filemode && timeout -1 && wpr -stop Desktop\trace.etl` is generally correct. It tells WPR to start a general trace recording to a file until timeout is terminated by pressing any key or a system crash, and then stop the recording and save to `Desktop\trace.etl`.

However, this statement has some timing issues in the Task Scheduler context. The Role of `&& timeout -1` is to pause the command execution until you hit the key following the `-start` command. However, if the system crashes before you manually stop it, wpr wouldn't be able to execute `-stop` argument to save the results.

So, considering the scenario you're dealing with (a crash), what you need is to start recording with WPR at system boot and stop the recording at the next boot. For this purpose, creating two separate tasks seems more practical.

Create a new task as follows using the Task Scheduler:

1. For the "Start up" task
- Arguments: `-start GeneralProfile -filemode`
- Trigger: At startup.

2. For the "Shut down" task
- Arguments: ` -stop Desktop\trace.etl`
- Trigger: At an event (Log=System, Source=Kernel-Power, Event ID=109, which corresponds to a system shutdown).

Again, please ensure to backup important files and be aware that Microsoft encourages the use of these tools for advanced users or professionals because incorrect use can cause serious problems.

use the below information to create the correct argument and then make a proper augment.

WPR Command-Line Options
Article
08/17/2022
9 contributors

Feedback
In this article
General options
Profiles
Start
Stop
Show 28 more
Windows Performance Recorder (WPR) offers a simple command line interface. The full complexity of WPR is embedded in the recording profiles.

General options
WPR requires Windows 8.1 or later version operating system.

Syntax
dos

Copy
wpr FirstLevelOption [<arguments>] [Additional options [<arguments>]]
You can get additional help with:

dos

Copy
wpr -help [start | stop | status | profiles | providers | tracing | boottrace | heap | hardwarecounter | advanced]
The following FirstLevelOptions are available:


Expand table
Option Description
-help Provide the list of sub-level help information .
-profiles Enumerates the profile names and descriptions from a profile.
-purgecache Purges the dynamic symbols cache.
-start Starts one or more profiles.
-marker Fires an event marker.
-markerflush (Obsolete) Fires an event marker and flushes the working set.
-status Displays the status of an active recording (if any).
-profiledetails Fires an event marker and flushes the working set.
-exportprofile export built-in profile to a file.
-providers Displays detailed information about providers.
-cancel Cancels the recording initiated by WPR (if any).
-stop Cancels and saves the recording initiated by WPR (if any).
-merge Merges etl files into the given file.
-flush Flushes the logging sessions initiated by WPR (if any).
-log Configures the debug information saved to the event log.
-disablepagingexecutive Changes the Disable Paging Executive settings.
-heaptracingconfig Changes a processes' heap tracing settings.
-snapshotconfig Change snapshot settings for a process.
-capturestateondemand Captures the states of the configured providers in the current recording.
-pmcsources Queries the list of PMU events available on the system.
-pmcsessions Query the list of sessions using PMU events.
-setprofint Sets the sampled profile interval.
-profint Queries the current profile interval.
-resetprofint Restores the default profile interval values.
-boottrace Configures the registry entries for autologger/globallogger sessions.
-enableperiodicsnapshot Enables Periodic Snapshot for the specified interval and given process id.
-disableperiodicsnapshot Disables Periodic Snapshot for all process.
-singlesnapshot Gets an on-demand Snapshot for the specified process.
Profiles
The Profiles option lists the WPR profiles that the recording uses.

Syntax

Copy
wpr -profiles [<path>]
The following table describes the available arguments that you can apply to this option. To see built-in profiles, omit the argument.


Expand table
Argument Description
<path> Specifies the path and the name of the file that contains the profile definitions. For example:

wpr -profiles “c:\Users\User1\Documents\WPR Files\Custom Profiles\CustomProfile1.wprp”
Start
The Start option starts a recording by using one or more profiles.

Syntax

Copy
wpr -start <profile> [-start <profilen>]... [-filemode] [-recordtempto <temp folder path>] [-onoffscenario <OnOff Transition Type>] [-onoffresultspath <path to which the trace files are saved>] [-onoffproblemdescription <description of the scenario>] [-numiterations <number of iterations for OnOff tracing>]
The following table describes the available switches that you can apply to this option.


Expand table
Switch Description
<profile> [-start <profilen>]... Specifies either a built-in profile or the path to a user-defined profile. You can specify up to 64 profiles on a single command line, with each profile specified as follows:

<profile> := [<filename.wprp>!]<profile name>[.{light|verbose}]

Each profile can define either light or verbose versions, or both versions. If neither option is specified, the verbose version is used unless the profile includes only a light version.
-shutdown [<KSR>] Specifies that session info and recordings will persist over the reboot. Shutdown option works only with the file mode trace where as KSR only works only with the memory mode. Call -stop command at the next boot to merge the trace.
-filemode Specifies that recording is done in file mode. (The default mode is memory.) By using this option, the data is recorded to an unbounded file, which can grow in size until it fills the disk.
-recordtempto <temp folder path> Specifies the temporary folder path that the recording is saved to.
-onoffscenario <OnOff Transition Type> Specifies one of the on/off transition types. These are: Boot, FastStartup, Shutdown, RebootCycle, Standby, or Hibernate.
-onoffresultspath <path to which the trace files are saved> Specifies the path to which the trace files are saved.
-onoffproblemdescription <description of the scenario> Specifies the description of the scenario.
-numiterations <number of iterations for OnOff tracing> Sets the number of iterations for OnOff recording. By default, the settings from the built-in or custom profile file are used by default.
Example
dos

Copy
wpr -start CPU (Starts verbose CPU profile in memory mode)
wpr -start CPU.light -filemode (Starts light CPU profile in file mode)
wpr -start filename.wprp!ProfileName.Verbose (Starts verbose ProfileName profile defined in filename.wprp)
Stop
The Stop option stops the current recording and saves it to the file that is specified by the argument.

Syntax

Copy
wpr -stop <file> <problem description> -[skipPdbGen] [-force] [-compress]
The following table describes the available arguments that you can apply to this option.


Expand table
Argument Description
<file name> Specifies the event trace log (ETL) file to which WPR saves the recording. This argument is required.
<problem description> Specifies the problem description. Although this argument is optional, we recommended that you use it.
-skipPdbGen Disables dynamic generation of ngen and embedded pdbs for .NET modules. This option can reduce the stop operation time.
-force Disables the warning when the target file extension is not .etl.
-compress Compresses output trace file.
Merge
The Merge option merges etl files into the given file.

Syntax

Copy
wpr -merge <trace files ...> <merged file> -[skipPdbGen] [-compress] [-supresspii] [-mergeonly] [-injectonly]
The following table describes the available arguments that you can apply to this option.


Expand table
Argument Description
<trace files ...> Specifies one or more un-merged event trace log (ETL) files. This argument is required.
<merged file> Specifies the output file into which WPR merges ETL file(s).
-skipPdbGen Disables dynamic generation of ngen and embedded pdbs for .NET modules. This option can reduce the stop operation time.
-compress Compresses output trace file.
-supresspii Suppresses personally identifiable(PII) information.
-mergeonly Merges the traces without adding machine-specific information or image ID events. Cannot be used with -injectonly.
-injectonly Generates only machine-specific and/or image id events without copying original events in the merged file.
Cancel
The Cancel option cancels the current recording without saving the recorded data. If no instance is currently active, the Cancel option returns an error.

Syntax

Copy
wpr -cancel
This option takes no arguments.

Status
The Status option displays status information about the current WPR recording.

Syntax

Copy
wpr -status [profiles] [collectors [-details]]
If no recording is currently active, a message displays that WPR is not recording. If a recording is currently active and no arguments are used, the following status information displays:


Copy
WPR recording is in progress...

Time since start : 00:04:27

Dropped event : 0

Logging mode : Memory
If you supply arguments together with the –status option, the information listed above displays together with data that is specific to that option. The following table describes the available arguments that you can apply to this option.


Expand table
Argument Description and Example Output
profiles This argument lists each profile that is being used in the current WPR recording.
Example:

Recording system activity using the following set of profiles:
Profile : CPU.Verbose.Memory

collectors Lists collector information. If buffers have been lost, those buffers are listed.
Example:

Actively recording collectors:
Collector Name : NT Kernel Logger
Buffer Size (KB) : 1024
Events Lost : 0
System Keywords
CSwitch
ProcessThread
SampledProfile
System Stacks
CSwitch
SampledProfile


Collector Name : WPR_initiated_WPR Event Collector
Buffer Size (KB) : 1024
Events Lost : 0
Providers
Microsoft-Windows-Shell-Core: 0x1000000000000: 0x04
Microsoft-Windows-Win32k: 0x1000000402000: 0xff : Stack
CaptureState Providers on Save
Microsoft-Windows-Win32k: 0x80000: 0xff

details Lists additional information about each collector.
Profiledetails
The Profiledetails option displays detailed information about a profile or set of profiles. To specify multiple profiles, use the following syntax where <profilen> refers to the name of each profile.

Syntax

Copy
wpr -profiledetails <profile1>+<profile2>+...+<profilen> [-filemode] -onoffscenario <OnOff Transition Type>
The following table describes the available switches that you can apply to this option.


Expand table
Switch Description
-filemode Specifies that recording was done in file mode. (The default mode is memory.)
-onoffscenario <OnOff Transition Type> Specifies one of the on/off transition types. These are: Boot, FastStartup, Shutdown, RebootCycle, Standby, or Hibernate.
ExportProfile
The ExportProfile option exports the built-in profile(s) to the given file. Use wpr -Profiles command to enumerate available built-in profiles. To specify multiple profiles, use the following syntax where <profilen> refers to the name of each profile. The naming convention of the profiles is exactly the same as used in wpr -start. A profile is specified as <profile name>[.{light|verbose}].

Syntax

Copy
wpr -exportprofile <profile1>+<profile2>+...+<profilen> <ExportedFileName.wprp> [-filemode]
This example exports the filemode verbose GeneralProfile profile into GeneralProfileVerboseFile.wprp file.

Example
dos

Copy
wpr -exportprofile GeneralProfile d:\profiles\GeneralProfileVerboseFile.wprp -filemode
Providers
The Providers option displays detailed information about providers. Providers refer to the Event Tracing for Windows (ETW) components that expose events to Windows Performance Recorder (WPR). To display information about providers, use the following syntax, where -providers refers to all installed/known and registered providers.

Syntax

Copy
wpr -providers
This option takes no arguments.

Boottrace
The Boottrace option configures the registry entries for autologger/globallogger sessions for the given profile.

Syntax

Copy
wpr -boottrace {-addboot [<filename.wprp>!]<profile> [-addboot <profile> ...] [-filemode] [-recordtempto <temp folder path>] | -stopboot <recording filename> <Problem description> | -cancelboot}
The following table describes the available keywords that you can apply to this option.


Expand table
Argument Description
-boottrace Specifies the following argument is to set up the autologger. In current WPR, this argument is optional.
-addboot Sets the autologger registry entries for the given profile. The wpr -addboot command takes the same options as the wpr -start command. Note that this options does not immediately start the trace. After reboot, the autologger will be started by the operating system.
-stopboot Removes the autologger configured by addboot, stops the boot recording and merges all the recording into the given file. Note that this option saves the trace only if the autologger session is running (i.e. after reboot). Otherwise, this option will remove only the autologger configuration.
-cancelboot Removes the autologger configured by addboot and cancels the boot recording initiated by WPR.
CaptureStateOnDemand
The CaptureStateOnDemand option captures states for the configured providers in the current recording. The event provider should be configured for capturestateondemand within the profile file while the session is running.

Syntax

Copy
wpr-capturestateondemand
Below is an example of EventProvider:


Copy
<EventProvider Id="EventProvider_Microsoft-Windows-Win32k" Name="Microsoft-Windows-Win32k" NonPagedMemory="true" CaptureStateOnly="true">
<CaptureStateOnDemand Timeout="5">
<Keyword Value="0x0"/>
</CaptureStateOnDemand>
</EventProvider>
Marker
The Marker option fires an event marker with the given text in the current system logging session.

Syntax

Copy
wpr -marker <text> [-flush]

Expand table
Argument Description
-flush Flushes the working set. Equivalent to -MarkerFlush.
MarkerFlush (Obsolete)
The MarkerFlush option fires an event marker with the given text and flushes the working set. This command is obsolete in current WPR.

Syntax

Copy
wpr -markerflush <text>
Flush
The Flush option flushes logging sessions to files initiated through WPR.

Syntax

Copy
wpr -flush
This option takes no arguments.

HeapTracingConfig
The HeapTracingConfig option enables or disables heap tracing for a specific process or store application.

Syntax

Copy
wpr -HeapTracingConfig <process name> [<package full name> <package relative app ID>] [{enable|disable}]
Note

If the {enable|disable} parameter is omitted, the current heap tracing configuration for the process or app will be displayed. For example: wpr -HeapTracingConfig Heaptest.exe enable
This command doesn’t immediately start the trace, and should be executed before taking the heap trace. See Recording for Heap Analysis for more details.
Always disable HeapTracingConfig for the process after tracing is done since it can impact the performance of the process.
Disablepagingexecutive
The Disablepagingexecutive option specifies whether drivers and kernel-mode system code can be paged to disk. Setting this option to on prevents paging. This option sets the value of DisablePagingExecutive in the registry.

Syntax

Copy
wpr -disablepagingexecutive {on | off}
Note

To correctly capture event stacks on 64-bit systems that are running Windows 7, disablepagingexecutive should be set to On, and the system must be rebooted before you start performance recording. For 32-bit systems that are running Windows 7 and for all systems that are running Windows 8 or higher, you can operate performance recording without setting disablepagingexecutive to On.

Log
The Log option appends and configures debug logging to the event log.

Syntax

Copy
wpr -log {enabled | disabled | remove}
The following table describes the available keywords that you can apply to this option.


Expand table
Keyword Description
enabled Enables debug logging to the event log
disabled Disables debug logging to the event log
remove Uninstalls the WPR debug logging provider manifest from the system
Purgecache
The Purgecache option purges the managed symbols cache.

Syntax

Copy
wpr -purgecache
This option takes no arguments.

Help
Use this option to display on-line help in the Command Prompt window.

Syntax

Copy
wpr -help [start | stop | status | profiles | providers | tracing | boottrace | heap | hardwarecounter | advanced]
The following table describes the available keywords that you can apply to this option.


Expand table
Keyword Description
No keyword Displays a list of options and short descriptions. To get further help for specific options, use a keyword. For example: wpr -help start.
start Describes the –start command-line argument. For more information, see Start.
stop Describes the -stop, -merge, and -cancel command-line argument.
status Describes -status command-line arguments. For more information, see Status.
profiles Describes -profiles, -profiledetails, and -exportprofile command-line arguments.
providers Describes the -providers command-line argument. For more information, see Providers.
tracing Describes the –marker, -flush, and -capturestateondemand command-line argument.
boottrace Describes the -addboot, -stopboot, and -cancelboot command-line arguments.
heap Describes -heaptracingconfig, -snapshotconfig, -enableperiodicsnapshot, -disableperiodicsnapshot, and -singlesnapshot command-line arguments.
hardwarecounter Describes -pmcsources, -pmcsessions, -setprofint, -profint, and -resetprofint command-line arguments.
advanced Describes -purgecache, -log, -disablepagingexecutive, -instancename, and -container command-line arguments.
SnapshotConfig
The SnapshotConfig option enables or disables the ability to capture one-time or periodic snapshots of <snapshot option>\ for a specific process or processes. Currently you can take take snapshots of the heap.

Syntax

Copy
wpr -SnapshotConfig <snapshot option> {-name <process name> | -pid <pid 1> [pid 2] ...} [{enable|disable}]
If the {enable|disable} parameter is omitted, the current snapshot configuration for the process will be displayed (i.e. only the -name option).

This example uses the snapshotconfig command with image names:


Copy
wpr -snapshotconfig heap -name Win32Project1.exe //query snapshot config
wpr -snapshotconfig heap -name Win32Project1.exe enable //enable snapshot config
wpr -snapshotconfig heap -name Win32Project1.exe disable //disable snapshot config
This example uses the snapshotconfig command with a PID:


Copy
wpr -snapshotconfig heap -pid 8048 enable //enable snapshot config
Note

If the process and OS architecture does not match match (for example, a win32 app on a 64bit Operating system), use the image name option.

The following table describes the available switches that you can apply to this option.


Expand table
Switch Description
<snapshot option> Specifies one of the snapshot option types. Currently only the Heap is available.
-name Specifies the name of process. This switch cannot be used with -Pid switch. If this switch is used to enable the snapshot, the config will apply to all new instances of the specified process name. Please be sure to disable it when the testing has finished.
-pid Specifies the process id. This switch cannot be used with -name switch. If this switch is used to enable the snapshot, the configuration will be applied immediately and for the lifetime of the process.
SingleSnapshot
The SingleSnapshot option triggers an on-demand snapshot of <snapshot option> for specified process ID.

Syntax

Copy
wpr -SnapshotConfig <snapshot option> <pid 1> [pid 2] ... [up to pid 8]
Note

The snapshot feature needs to be enabled for the process id (or name) before calling SingleSnapshot.

For example: wpr -singlesnapshot heap <pid for foo.exe>

Please refer to SnapshotConfig command for more information.

The following table describes the available switches that you can apply to this option.


Expand table
Switch Description
<snapshot option> Specifies one of the snapshot option type.
<pid> Specifies the process id.
EnablePeriodicSnapshot
The EnablePeriodicSnapshot option triggers periodic snapshots at specified intervals and given process IDs

Syntax

Copy
wpr -enableperiodicsnapshot <snapshot option> <interval (in seconds)> <pid 1> [pid 2] ... [up to pid 8]
Note

The snapshot feature needs to be enabled for the process id (or name) before calling SingleSnapshot.

For example: wpr -enableperiodicsnapshot heap 60 <pid for foo.exe>

Please refer to SnapshotConfig command for more information.

The following table describes the available switches that you can apply to this option.


Expand table
Switch Description
<snapshot option> Specifies one of the snapshot option type.
<interval> Specifies the interval in seconds. Note that the minimum valid interval is 5.
<pid> Specifies the process id.
DisablePeriodicSnapshot
The DisablePeriodicSnapshot option disables periodic snapshots for all processes specified by the enableperiodicsnapshot option.

Syntax

Copy
wpr -disableperiodicsnapshot <snapshot option>
Example

Copy
wpr -disableperiodicsnapshot heap
The following table describes the available switches that you can apply to this option.


Expand table
Switch Description
<snapshot option> Specifies one of the snapshot option types.
PMCSources
The PMCSources option queries the list of PMU (Performance Monitoring Unit) events on the system and their default interval value for the counter overflow. The interval is the number of events.

Syntax

Copy
wpr -pmcsources
Note

Performance Monitor Unit events are used to measure CPU performance and understand workloads CPU characterization. Only a subset of PMU events in Arm/intel reference documents are implemented in Windows HAL. The example output of this option on Intel CPU device is below:


Copy
C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit>wpr -pmcsources
Id Name Interval Min Max
--------------------------------------------------------------
0 Timer 10000 1221 1000000
2 TotalIssues 698400 4096 2147483647
6 BranchInstructions 65536 4096 2147483647
10 CacheMisses 65536 4096 2147483647
11 BranchMispredictions 65536 4096 2147483647
19 TotalCycles 65536 4096 2147483647
25 UnhaltedCoreCycles 65536 4096 2147483647
26 InstructionRetired 65536 4096 2147483647
27 UnhaltedReferenceCycles 65536 4096 2147483647
28 LLCReference 65536 4096 2147483647
29 LLCMisses 65536 4096 2147483647
30 BranchInstructionRetired 65536 4096 2147483647
31 BranchMispredictsRetired 65536 4096 2147483647
32 LbrInserts 65536 4096 2147483647
PMCSessions
The PMCSessions options query the list of sessions using hardware counters. This option is only available on Windows 11 or later.

Syntax

Copy
wpr -pmcsessions
ProfInt
The ProfInt option queries the “profiling” interval.

Syntax

Copy
wpr -profint
Example

Copy
C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit>wpr -profint
Current Profile Interval = 10000 [1.0000ms]
SetProfInt
The SetProfInt option sets the sampling profile interval for PMU events. If PMU event name is omitted, the default is Timer.

Syntax

Copy
wpr -setprofint [PMU event name] 1221...10000000
Example

Copy
C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit>wpr -setprofint 100000
New Profile Interval = 100000 [10.0000ms]

C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit>wpr -setprofint TotalIssues 1000000
New Profile Interval = 100000 [Counter: TotalIssues]
ResetProfInt
The ResetProfInt option resets the profile interval to the default value.

Syntax

Copy
wpr -resetprofint [Profile Source Name]
Note that if [Profile Source Name] is not provided, all profile sources will be reset to the default value.

Instancename
The Instancename option specifies a name to uniquely identify the tracing instance.

This option can be applied to any commands that manipulate the logging session and assigns a user supplied logging session name. WPR sets the default session name if this option is omitted.

Syntax

Copy
wpr –{option <arguments>} -instancename <text>
Note

-instancename must be the last parameter. If the logging sessions were started with this option, all the subsequent commands should use the same instancename option. For example:


Copy
C:\wpt>wpr -start cpu -instancename CpuSession
C:\wpt>wpr -status -instancename CpuSession
WPR recording is in progress...
...
Time since start : 00:00:05
Dropped event : 0
Logging mode : Memory
C:\wpt>wpr -stop cpu.etl -> omitting instancename option would not find CpuSession
There are no trace profiles running.
Error code: 0xc5583000
C:\wpt>wpr -stop cpu.etl -instancename CpuSession -> trace will be saved
Remarks
Each time that WPR saves a trace that was captured when managed applications were running on the system, WPR saves managed symbols next to the trace file. This feature enables performance analysis of managed applications.

Generating managed symbols is a resource- and time-consuming operation. WPR automatically creates a managed symbol cache to expedite the generation of managed symbols. When WPR needs managed symbols, it first checks this cache and uses any available and appropriate symbols instead of regenerating them.

The default managed symbol cache location is C:\ProgramData\WindowsPerformanceRecorder\NGenPdbs_Cache.

 

[Johncoool]

Sorry I couldn't contact the ChatGPT think tank

try again.

 

[Johncoool]

Thank you for providing detailed information about WPR command-line options. Based on this input, you can start and stop trace sessions depending on your needs:

To start a trace session, you will use the start command.

Here's an example:

```
wpr -start GeneralProfile -filemode -recordtempto C:\Temp\
```
This command starts a trace with the GeneralProfile and records in file mode to a temporary directory C:\Temp.

If you want to use more than one profile, you can add another `-start` option:

```
wpr -start GeneralProfile -start CPU -filemode -recordtempto C:\Temp\
```
This command starts a trace using both the GeneralProfile and CPU profile.

To stop the trace session and save the trace file, you can use the stop command.

Here's an example:

```
wpr -stop C:\TraceResults\MyTrace.etl
```
This command stops the currently running trace and saves the recorded data to the file MyTrace.etl.

I hope this helps you navigate using the WPR command-line tool to address your issues. As always, remember to use these commands with caution, as improper use could lead to unexpected system behavior.

make one for the initial request while using this information

 

[Johncoool]

From the inputs you provided about utilizing WPR command-line options, it seems you need to start a trace session automatically and save it when a system crash happens. Given these specifics, consider the steps below:

First, create two tasks using Task Scheduler:

Task 1: Start trace at boot

1. Open Task Scheduler. Run `taskschd.msc` in the Run box (Win + R).
2. On the right-hand side, click "Create Basic Task".
3. Fill in a name and description for your task and click "Next".
4. Choose the trigger as “When the computer starts" and click "Next

try again

 

[Johncoool]

Sorry I couldn't contact the ChatGPT think tank

try again

 

[Johncoool]

Apologies for the confusion earlier.

To start WPR automatically on startup and stop while crashing in the context of a BSOD, you'll want to save output to a location that persists after a crash. Writing directly to an ETL file is recommended as it will survive a system crash.

To automatically start your trace when the system boots, you'll want to configure a task in the Task Scheduler.

1. Open Task Scheduler (taskschd.msc).
2. On the right-hand side, click "Create Basic Task".
3. Enter a name and a description for your task, then click "Next".
4. Choose "When the computer starts" as trigger, then click "Next".
5. Choose "Start a program" as action, then click "Next".
6. Enter `C:\Windows\System32\wpr.exe` in the "Program/script" box.
7. In the "Add arguments" box, put your desired WPR flags. For a general trace, relayed to a file, you would use: `-start GeneralProfile -filemode -recordtempto C:\Temp\`
8. Click "Next", then "Finish".

The `"-recordtempto C:\Temp\"` argument tells WPR to write the trace to the `C:\Temp\` directory. Please replace with your preferred directory.

On reboot, your machine will automatically start recording a trace. Beware that traces can be large depending on the system load and the duration of the trace.

Unfortunately, WPR cannot be pre-configured to stop on a system crash such as a BSOD, because by that point, a large portion of the system services WPR relies on will have been terminated. However, as you're recording using `-filemode`, the ETL file is being written in real time and not held in memory hence you should have all the trace data leading up to BSOD.

Please test everything out and let us know how it goes, or if you have any questions or run into issues. Be aware that tracing may affect system performance, and traces can take up significant disk space.

i am trying in command line and i got the below error. can you correct it?

wpr.exe -start GeneralProfile -filemode -recordtempto C:\Users\sonojo\Desktop\test.edl

Invalid temporary trace directory.

Error code: 0xc5586004

 

[Johncoool]

i am trying in command line and i got the below error. can you correct it?

wpr.exe -start GeneralProfile -filemode -recordtempto C:\Users\sonojo\Desktop\test.edl

Invalid temporary trace directory.

Error code: 0xc5586004

try again.

 

[Johncoool]

Apologies for the confusion earlier.

To start WPR automatically on startup and stop while crashing in the context of a BSOD, you'll want to save output to a location that persists after a crash. Writing directly to an ETL file is recommended as it will survive a system crash.

To automatically start your trace when the system boots, you'll want to configure a task in the Task Scheduler.

1. Open Task Scheduler (taskschd.msc).
2. On the right-hand side, click "Create Basic Task".
3. Enter a name and a description for your task, then click "Next".
4. Choose "When the computer starts" as trigger, then click "Next".
5. Choose "Start a program" as action, then click "Next".
6. Enter `C:\Windows\System32\wpr.exe` in the "Program/script" box.
7. In the "Add arguments" box, put your desired WPR flags. For a general trace, relayed to a file, you would use: `-start GeneralProfile -filemode -recordtempto C:\Temp\`
8. Click "Next", then "Finish".

The `"-recordtempto C:\Temp\"` argument tells WPR to write the trace to the `C:\Temp\` directory. Please replace with your preferred directory.

On reboot, your machine will automatically start recording a trace. Beware that traces can be large depending on the system load and the duration of the trace.

Unfortunately, WPR cannot be pre-configured to stop on a system crash such as a BSOD, because by that point, a large portion of the system services WPR relies on will have been terminated. However, as you're recording using `-filemode`, the ETL file is being written in real time and not held in memory hence you should have all the trace data leading up to BSOD.

Please test everything out and let us know how it goes, or if you have any questions or run into issues. Be aware that tracing may affect system performance, and traces can take up significant disk space.

i am trying in command line and i got the below error. can you correct it?

wpr.exe -start GeneralProfile -filemode -recordtempto C:\Users\sonojo\Desktop\test.edl

Invalid temporary trace directory.

Error code: 0xc5586004

 

[Johncoool]

I apologize for the confusion. The error message is indicating that WPR is having trouble with the path you provided to store the trace file.

The option `-recordtempto` only accepts directories, not a specific filename. It seems you're trying to specify the file name (`test.edl`) along with the directory, which is why it's giving you an error.

Try the corrected command:

```
wpr.exe -start GeneralProfile -filemode -recordtempto C:\Users\sonojo\Desktop\
```
In this case, WPR will save the trace file to `C:\Users\sonojo\Desktop\` and will automatically generate an appropriate filename.

After you stops the capture, you can rename the generated .etl file to `test.etl`. Please note that the correct extension for WPR files is .etl,

Will this work to auto save when system crashes?

wpr.exe -start GeneralProfile -filemode -recordtempto C:\Users\sobonojo\Desktop

 

[Johncoool]

Your command will initiate WPR to start recording and save the trace file to the specified directory. The `-filemode` option writes the trace directly to the disk, making it more likely to have some data saved in the case of a system crash. However, it's important to note that if your system crashes (suffers a BSOD), the recording might stop immediately without finalizing the trace file reports properly. You might risk having an incomplete trace file.

Here’s how WPR works:

1. When it starts, it begins recording events in a circular buffer in memory or directly to a file (with the `-filemode` option).
2. When you stop the trace, it finalizes the reports and generates a trace file, writing either the entire contents of the circular buffer (for memory mode) or the data kept since it started (for file mode).

In simplicity, unless you have periodic triggers to stop and start new sessions to generate sequences of completed trace files, there's a chance that a trace started at boot will not provide useful information from a system crash, because the system crashed before instructions to stop the trace and hence finalize the trace file could be executed.

I would still suggest performing this action as sometimes, valuable data can be retrieved up until the point of the crash.

It worked. however. how i make sense of the information and how to trace gpu

 

[Johncoool]

Great to hear that you could successfully create the trace file!

To analyze the trace file, you'll need a tool called Windows Performance Analyzer (WPA), which is part of the Windows Performance Toolkit. It can open your `.etl` file and provide you with a detailed look at what was happening in your system at the time.

Here's a brief step to do this:
1. Download and install the latest version of Windows Assessment and Deployment Kit (ADK) for Windows 10. You can download it from Microsoft's official site.
2. During installation, you can uncheck all other options and just check "Windows Performance Toolkit".
3. Once it's installed, you can find WPA in your Start menu.

To analyze a GPU problem specifically:

1. Start WPR.exe.
2. From the "Select additional profiles for performance recording" section, check the box next to GPU Usage and then click on "Start".
3. Once done, stop the recording using WPR.exe, and this will create a trace file.
4. Open this file with WPA.exe.

Once you open the trace file, WPA presents a hierarchical view of the data. In your case, look at the `GPU Usage` graph, which presents data about the activity of the GPU during the collection time.

Reading these graphs and data takes some understanding of system operations, but in a nutshell, you're looking for persistent high usage and/or large spikes in activity which may indicate the source of problems.

Remember, interpreting WPA results can be complex, as the Windows operating system is a complicated system with many components. This might be a start, but you may need further assistance depending on the complexity of the issue you're trying to resolve. Don't hesitate to post on our forum if you need more help with

I can see the data. but how do I find the issue.

I want GPU command from command line too

 

[Johncoool]

I found the issue.

It turned out that the Monitor driver was causing the crashes.

Resolved after updating the monitor drivers.

 

[ChatGPT]

Let's dissect that command and ensure it's squeaky clean for capturing those precious performance traces. It's like preparing a recipe: if even one ingredient is off, it could ruin the whole dish!

Reviewing the Command​

Your command looks like it's aiming to start WPR and then stop it with a timeout. Generally, it should look something like this: wpr -start GeneralProfile -filemode && timeout -1 && wpr -stop Desktop\trace.etl

Potential Issues​

1. WPR Location:
   • Ensure that the path to WPR.exe is correct. It should indeed typically be located in C:\Windows\System32\. Double-check this to avoid a path issue.
   []Command Syntax:
   • You're using && to chain commands. In the context of Task Scheduler, this might not work as expected. Consider using separate tasks or commands instead.

     Revised Method to Set Up the Task​

     Here’s a more straightforward way to set it up without chaining commands:
   []Open Task Scheduler:
   • Run taskschd.msc.
   []Create a Basic Task:
   • Click "Create Basic Task" on the right.
   • Provide a name and description, then click "Next."
   []Set Trigger:
   • Set the trigger to "When the computer starts" and click "Next."
   []Action:
   • Select "Start a program" and click "Next."
   []Program/Script:
   • In the "Program/script" box, enter the path to wpr.exe: C:\Windows\System32\wpr.exe
   []Add Arguments (For starting):
   • Instead of chaining in one command, just focus on starting: -start GeneralProfile -filemode
   []Click Next and Finish:
   • This sets up the task to start the WPR trace when the system boots.

     Stopping the Trace​

     When you want to stop the trace after the crash:
   • Open a command prompt as an Administrator and execute: wpr -stop C:\Path\To\Your\Desktop\trace.etl (Ensure you adjust the path here according to your setup.)

     Verify in Task Manager​

   • After rebooting, you might not see wpr.exe running in Task Manager under the name you expect. It often runs as a background process, and you may only see it if you sort your processes by 'details' or look for related entries.

     Final Thoughts​

     If you're still not seeing it, consider checking the Task Scheduler for task history to confirm that it's executing as intended. Ensure that you’re running under a user account that has the necessary permissions to execute these tasks, as that can sometimes cause issues too. If you’re still not having success, let me know and we can troubleshoot further! You’re not alone in this quest for a perfect trace!