SourceForge.net Logo
Home

TPROF - Time Profiler

Contents:




Introduction




How do I run TPROF?


Time-based vs. Event-based TPROF


Notes of profiling Java applications




run.tprof

    run.tprof: Coordinates the TPROF procedure

    Syntax:
    -------
      run.tprof [-a | -t | -p] [-b #] [-m [time | event]] [-s #] [-r #] [-M [fn]]

                Options valid with '-m time':
                   [-c #ticks_per_second]

                Options valid with '-m event':
                   [-e event_name] [-c #evts]

                To get help:
                   [? | -? | /? | ?? | -?? | /??] (Windows only)
                   [-h | -h verbose]              (Linux only)

    Where:
    ------
      -a        Run entire TPROF procedure.
                * !!! THIS IS THE DEFAULT AND NEED NOT BE SPECIFIED !!!
                * Performs the trace and post-processing steps.
                * Produces a raw trace file (swtrace.nrm2) and a TPROF report
                  file (tprof.out).
                * This option is mutually exclusive with -t and -p.

      -t        Run tracing only.
                * Performs only the tracing (ie. data collection) step of the
                  TPROF procedure.
                * Produces a raw trace file (swtrace.nrm2).
                * The trace will not be post-processed. You can post-process
                  the trace at a later time by invoking run.tprof with the
                  -p option.
                * This option is mutually exclusive with -a and -p.

      -p        Run post-processing only.
                * Performs only the post-processing step of the TPROF procedure.
                * It requires a trace file (swtrace.nrm2) and assumes that you've
                  already done the tracing step, either by itself (via a previous
                  -t) or in a previous complete run (via -a).
                * Produces a TPROF report file (tprof.out).
                * This option is mutually exclusive with -a and -t.

      -b #      Set trace buffer size to # MB **PER PROCESSOR**
                * You can also set this value using the IBMPERF_TPROF_BUFFER_SIZE
                  environment variable in the toolsenv.cmd configuration file.

      -m mode   Set the TPROF mode.
                * Valid modes are:
                  - TIME
                      This causes TPROF to run in TIME-based mode.
                      In this mode sampling is based on time and the time between
                      samples is constant. The sampling rate can set via the -c
                      option.
                  - EVENT
                      This causes TPROF to run in EVENT-based mode.
                      In this mode sampling is based on event counts and the time
                      between samples is not constant. The sampling event count
                      can set via the -c option.
                * Default mode is TIME.
                * You can also set this value using the IBMPERF_TPROF_MODE
                  environment variable in the toolsenv.cmd configuration file.

      -e event  Set event name when in EVENT-based mode.
                * 'event' is the name of an event. Valid event names can be
                  obtained by entering the "SWTRACE EVENT LIST" command.
                  - Event names are not case sensitive. INSTR is the same as
                    Instr or iNStr or instr or ...
                  - An event count can be set using the -c option.
                * Default event name is INSTR.
                * You can also set this value using the IBMPERF_TPROF_EVENT
                  environment variable in the toolsenv.cmd configuration file.

      -c #evts  Set tick rate (TIME-based) or event count (EVENT-based).
                * If mode is TIME then #evts represents the desired TPROF tick
                  rate, in ticks/second.
                  - Default tick rate is 128 ticks/second.
                  - You can also set this value using the IBMPERF_TPROF_TICK_RATE
                    environment variable in the toolsenv.cmd configuration file.
                * If mode is EVENT then #evts represent the number of events
                  after which a TPROF tick will occur.
                  - Default event count is 10,000,000 events.
                  - You can also set this value using the IBMPERF_TPROF_EVENTCNT
                    environment variable in the toolsenv.cmd configuration file.
                * Setting the rate too high may affect overall system performance.
                * Setting the rate too low may not collect enough samples.
                * Set a rate that is neither too high nor too low :-)

      -s #      Automatically start tracing after approximately # seconds.
                * You WILL NOT be prompted for when to start tracing. Instead,
                  tracing will start automatically after a delay of approximately
                  # seconds.
                * If you DO NOT specify the -r option, you will be prompted for
                  when to stop tracing.
                * If you specify 0 (zero), or a non-numeric value, tracing is
                  started immediately.
                * If you use this option your application should be started and
                  warmed up by the time tracing is started.
                * Only applicable with -a or -t. Ignored otherwise.
                * Default is to prompt for when to start tracing.

      -r #      Run (trace) for approximately # seconds.
                * You WILL NOT be prompted for when to stop tracing. Instead,
                  tracing will stop automatically after a delay of approximately
                  # seconds from the time tracing was started.
                * If you DO NOT specify the -s option, tracing is stopped
                  approximately # seconds after you press ENTER to start the trace.
                * If you specify 0 (zero), or a non-numeric value, tracing is
                  stopped immediately after being started.
                * If you use this option your application should complete the
                  scenario you want to trace in the approximately the amount of
                  time you specify with this option.
                * Only applicable with -a or -t. Ignored otherwise.
                * Default is to prompt for when to stop tracing.

      -M [fn]   Combine the tprof.out, tprof.micro, log-jita2n*, log-jtnm* and
                post.show files into a single file.
                * Done if no errors are encountered generating the TPROF report.
                * You can also set this option using the
                  IBMPERF_TPROF_GENERATE_MERGE_FILE and IBMPERF_TPROF_MERGE_FILE_NAME
                  environment variables in the toolsenv.cmd configuration file.
                * If fn is specified that will be the name of the combined file.
                * Default fn is: tprof_e.out.  fn can not be specified on Linux.

    Notes:
    ------
      * In a rare (for me) departure from normal Windows operation, command
        options are now case sensitive. -a is no longer treated the same as -A.
        Be warned.
      * Options are parsed from left to right. If you specify an option more
        than once, the rightmost option is used.
      * -a, -t and -p are exclusive options: only one of them is allowed.
      * -b, -m, -c and -e override the values set in 'toolsenv.cmd' environment
        variables.
      * The meaning of -c varies depending on the mode. It is assumed to be a
        rate (ticks/second) in TIME-based mode, or an event count in EVENT-based
        mode.
      * -e is ignored if the current mode is TIME.
      * -s and -r are useful if you are automating the TPROF procedure and have
        an idea of how long it takes for the scenario to start up (-s option)
        and how long you want to TPROF for (-r option).
      * Time delays specified with -s and -r are approximate. Specifying 5
        doesn't mean exactly 5 seconds. It will be about 5 seconds.
      * Valid option combinations:
        No options       Run entire procedure. Prompt to start and stop trace.
        -a               Same as no options.
                         Trace start/stop controlled by -s/-r.
        -t               Trace only. No post-processing.
                         Trace start/stop controlled by -s/-r.
        -p               Post-process only. No tracing.

        No -s and no -r  Prompt to start and prompt stop tracing.
        -s #             Automatically start tracing in # seconds.
                         Prompt to stop.
        -r #             Prompt to start tracing. Automatically stop tracing
                         approximately # seconds after tracing started.
        -s # -r #        Automatically start tracing in approximately # seconds.
                         Automatically stop tracing approximately # seconds
                         after tracing started.
      * Windows batch language does not provide a way to check whether a value
        is a valid number or not. As such, the values entered with the -s, -r,
        -b and -c options are not checked. A non-numeric value is the same as
        entering 0 (zero).
      * run.tprof won't run if environment variable IBMPERF_TOOLS_PATH isn't set.

    Customization: (Windows only)
    --------------
      All customization should be done via one of the three (3) available
      methods. You *SHOULD NOT* modify this (run.tprof.cmd) command file.

      1) TOOLSENV.CMD:
         This command file sets pre-defined environment variables used by the
         tools to achieve some level of customization.
         * It is created by TINSTALL the first time you install the tools
         * It resides in the tools bin directory
         * It is self-documenting (if you can believe that). You just need to
           spend a few minutes reading it.
         The first thing run.tprof does is to execute TOOLSENV.CMD. It tries
         to locate it along the PATH, if that fails it tries .\bin\TOOLSENV.CMD
         and if that fails it gives up.
         Please take the time to understand what you can do with TOOLSENV.CMD.

      2) USERXBEGIN.CMD:
         This is the "begin user exit" command file. If present it will be
         executed immediately after TOOLSENV.CMD is executed.
         * It is assumed to be reachable either via the PATH environment
           variable or in the current directory.
         * It is invoked via a CALL. That means you should not have an "exit"
           statement in it.
         * It is not passed any arguments
         * In it you are free to do anything you want:
           - Clean up files
           - Do special set up for your scenario
           - Whatever else you want
         * An empty USERXBEGIN.CMD is included in the package. It is up to
           you to modify it if you wish.

      3) USERXEND.CMD:
         This is the "end user exit" command file. If present it will be
         executed immediately after successful execution of run.tprof BUT before
         run.tprof terminates.
         * It is assumed to be reachable either via the PATH environment
           variable or in the current directory.
         * It is invoked via a CALL. That means you should not have an "exit"
           statement in it.
         * It is not passed any arguments
         * In it you are free to do anything you want:
           - Clean up/copy/move/rename files
           - Do additional post-processing
           - Whatever else you want
         * An empty USERXEND.CMD is included in the package. It is up to
           you to modify it if you wish.

    Examples:
    ---------
      1) run.tprof
         Runs the entire TPROF procedure. You are prompted to start and stop
         the trace. Generates TPROF report.
         Same as:  'run.tprof -a'

      2) run.tprof -s 10 -r 60
         Runs the entire TPROF procedure. Tracing starts automatically after
         about a 10 seconds delay. Tracing stops automatically about 60 seconds
         after being started. Generates TPROF report. There are no prompts -
         everything happens automatically.
         Same as: 'run.tprof -a -s 10 -r 60'

      3) run.tprof -t
         Runs the trace step of the TPROF procedure. You are prompted to start
         and stop the trace. Does not generate a
         TPROF report.

      4) run.tprof -t -s 10 -r 60
         Runs the trace step of the TPROF procedure. Tracing starts automatically
         after about a 10 seconds delay. Tracing stops automatically about 60
         seconds after being started. There are no prompts - everything happens
         automatically.

      5) run.tprof -t -s 10
         Runs the trace step of the TPROF procedure. Tracing starts automatically
         after about a 10 seconds delay. You are prompted for when to stop tracing.

      6) run.tprof -p
         Runs the post-processing step of the TPROF procedure. You are prompted
         to start and stop the trace. Only generates a TPROF report.

      7) run.tprof -m event -e l2_read_refs -c 100000 s 10 -r 60
         Runs the entire TPROF procedure. Sampling is EVENT-based, using event
         L2_READ_REFS and sampling every 100,000 occurrences. Tracing starts
         automatically after about a 10 seconds delay. Tracing stops
         automatically about 60 seconds after being started. Generates TPROF
         report. There are no prompts - everything happens automatically.

      8) run.tprof -m event -e l2_read_refs -c 100000 s 10 -r 60 -M mt_file
         Same as number 7) above but the mergetprof command is run.
         MERGETPROF output will be in file 'mt_file'.



Customizing the TPROF process (Windows only)


toolsenv.cmd


clearenv.cmd


userxbegin.cmd


userxend.cmd




A little more about Event-based TPROF ...


How do I specify the event to use?


How do I set the counters to count my own event?




TPROF output




Sample tprof.out report

     Tprof Reports

     Platform : Windows-x86

           ProcessorSpeed      2658000000
              TraceCycles    173148923700
                TraceTime          65.143(sec)



     TOTAL TICKS          16674
     (Clipping Level :   0.0 %    0 Ticks)


       ================================
          TPROF Report Summary

        )) Process
        )) Process_Module
        )) Process_Module_Symbol
        )) Process_Thread
        )) Process_Thread_Module
        )) Process_Thread_Module_Symbol
        )) Module
        )) Module_Symbol
       ================================


       ================================
        )) Process
       ================================

       LAB    TKS   %%%     NAMES

       PID   8588 51.51    IdleProcess_0000
       PID   8063 48.36    watch.exe_0a4c
       PID     14  0.08    iclient.exe_02e8
       PID      3  0.02    vsmon.exe_00b4
       PID      2  0.01    winlogon.exe_0254
       PID      2  0.01    svchost.exe_0410
       PID      1  0.01    csrss.exe_02b4
       PID      1  0.01    cmd.exe_0aec

       ================================
        )) Process_Module
       ================================

       LAB    TKS   %%%     NAMES

       PID   8588 51.51    IdleProcess_0000
        MOD   8585 51.49     C:\WINDOWS\system32\DRIVERS\intelppm.sys
        MOD      2  0.01     C:\WINDOWS\system32\hal.dll
        MOD      1  0.01     C:\WINDOWS\system32\ntkrnlpa.exe
       
       PID   8063 48.36    watch.exe_0a4c
        MOD   8062 48.35     C:\ibmperf\v20080430-GA\bin\watch.exe
        MOD      1  0.01     C:\WINDOWS\system32\hal.dll
       
       PID     14  0.08    iclient.exe_02e8
        MOD      7  0.04     C:\WINDOWS\system32\ntkrnlpa.exe
        MOD      2  0.01     C:\WINDOWS\System32\Drivers\Ntfs.sys
        MOD      2  0.01     C:\WINDOWS\system32\ntdll.dll
        MOD      1  0.01     C:\WINDOWS\system32\drivers\ssrtln.sys
        MOD      1  0.01     C:\WINDOWS\system32\USER32.dll
        MOD      1  0.01     C:\WINDOWS\system32\hal.dll

       PID      3  0.02    vsmon.exe_00b4
        MOD      1  0.01     C:\WINDOWS\system32\VSUTIL.dll
        MOD      1  0.01     C:\WINDOWS\system32\ZoneLabs\VSRULEDB.DLL
        MOD      1  0.01     C:\WINDOWS\system32\hal.dll

       PID      2  0.01    winlogon.exe_0254
        MOD      1  0.01     C:\WINDOWS\system32\ntkrnlpa.exe
        MOD      1  0.01     C:\WINDOWS\System32\Drivers\Ntfs.sys

       PID      2  0.01    svchost.exe_0410
        MOD      1  0.01     c:\windows\system32\rpcss.dll
        MOD      1  0.01     C:\WINDOWS\system32\KERNEL32.dll

       PID      1  0.01    csrss.exe_02b4
        MOD      1  0.01     C:\WINDOWS\System32\RDPDD.dll

       PID      1  0.01    cmd.exe_0aec
        MOD      1  0.01     C:\WINDOWS\system32\ntdll.dll

       ================================
        )) Process_Module_Symbol
       ================================

       LAB    TKS   %%%     NAMES

       PID   8588 51.51    IdleProcess_0000
        MOD   8585 51.49     C:\WINDOWS\system32\DRIVERS\intelppm.sys
         SYM   8585 51.49      AcpiC1Idle

        MOD      2  0.01     C:\WINDOWS\system32\hal.dll
         SYM      1  0.01      READ_PORT_UCHAR
         SYM      1  0.01      READ_PORT_BUFFER_USHORT

        MOD      1  0.01     C:\WINDOWS\system32\ntkrnlpa.exe
         SYM      1  0.01      ExfInterlockedCompareExchange64
       
       PID   8063 48.36    watch.exe_0a4c
        MOD   8062 48.35     C:\ibmperf\v20080430-GA\bin\watch.exe
         SYM   4095 24.56      ThirtyTwo
         SYM   2048 12.28      Sixteen
         SYM   1024  6.14      Eight
         SYM    512  3.07      Four
         SYM    255  1.53      Two
         SYM    128  0.77      One

        MOD      1  0.01     C:\WINDOWS\system32\hal.dll
         SYM      1  0.01      KeAcquireQueuedSpinLock
       
       PID     14  0.08    iclient.exe_02e8
        MOD      7  0.04     C:\WINDOWS\system32\ntkrnlpa.exe
         SYM      1  0.01      _SEH_epilog
         SYM      1  0.01      IopfCallDriver
         SYM      1  0.01      KeQuerySystemTime
         SYM      1  0.01      __KeGetCurrentThread
         SYM      1  0.01      NtQueryDirectoryFile
         SYM      1  0.01      ExpInterlockedPopEntrySListEnd
         SYM      1  0.01      ObReferenceObjectByHandle

        MOD      2  0.01     C:\WINDOWS\System32\Drivers\Ntfs.sys
         SYM      1  0.01      NtfsCompleteRequest
         SYM      1  0.01      NtfsPurgeFileRecordCache

        MOD      2  0.01     C:\WINDOWS\system32\ntdll.dll
         SYM      1  0.01      RtlDosPathNameToNtPathName_Ustr
         SYM      1  0.01      ExpInterlockedPopEntrySListEnd

        MOD      1  0.01     C:\WINDOWS\system32\drivers\ssrtln.sys
         SYM      1  0.01      <<.text>>

        MOD      1  0.01     C:\WINDOWS\system32\USER32.dll
         SYM      1  0.01      PtiCurrent

        MOD      1  0.01     C:\WINDOWS\system32\hal.dll
         SYM      1  0.01      KfRaiseIrql

       PID      3  0.02    vsmon.exe_00b4
        MOD      1  0.01     C:\WINDOWS\system32\VSUTIL.dll
         SYM      1  0.01      <<.text>>

        MOD      1  0.01     C:\WINDOWS\system32\ZoneLabs\VSRULEDB.DLL
         SYM      1  0.01      <<.text>>

        MOD      1  0.01     C:\WINDOWS\system32\hal.dll
         SYM      1  0.01      KeReleaseQueuedSpinLock

       PID      2  0.01    winlogon.exe_0254
        MOD      1  0.01     C:\WINDOWS\system32\ntkrnlpa.exe
         SYM      1  0.01      KiFastCallEntry

        MOD      1  0.01     C:\WINDOWS\System32\Drivers\Ntfs.sys
         SYM      1  0.01      NtfsFindFreeBitmapRun

       PID      2  0.01    svchost.exe_0410
        MOD      1  0.01     c:\windows\system32\rpcss.dll
         SYM      1  0.01      CMutexLock::Lock

        MOD      1  0.01     C:\WINDOWS\system32\KERNEL32.dll
         SYM      1  0.01      InterlockedDecrement

       PID      1  0.01    csrss.exe_02b4
        MOD      1  0.01     C:\WINDOWS\System32\RDPDD.dll
         SYM      1  0.01      DrvTextOut

       PID      1  0.01    cmd.exe_0aec
        MOD      1  0.01     C:\WINDOWS\system32\ntdll.dll
         SYM      1  0.01      RtlAllocateHeap

       ================================
        )) Process_Thread
       ================================

       LAB    TKS   %%%     NAMES

       PID   8588 51.51    IdleProcess_0000
        TID   8588 51.51     tid_0000
       
       PID   8063 48.36    watch.exe_0a4c
        TID   8063 48.36     tid_0738
       
       PID     14  0.08    iclient.exe_02e8
        TID     14  0.08     tid_08fc

       PID      3  0.02    vsmon.exe_00b4
        TID      2  0.01     tid_01d8
        TID      1  0.01     tid_0bd0

       PID      2  0.01    winlogon.exe_0254
        TID      2  0.01     tid_0628

       PID      2  0.01    svchost.exe_0410
        TID      2  0.01     tid_0a74

       PID      1  0.01    csrss.exe_02b4
        TID      1  0.01     tid_0314

       PID      1  0.01    cmd.exe_0aec
        TID      1  0.01     tid_0af0

       ================================
        )) Process_Thread_Module
       ================================

       LAB    TKS   %%%     NAMES

       PID   8588 51.51    IdleProcess_0000
        TID   8588 51.51     tid_0000
         MOD   8585 51.49      C:\WINDOWS\system32\DRIVERS\intelppm.sys
         MOD      2  0.01      C:\WINDOWS\system32\hal.dll
         MOD      1  0.01      C:\WINDOWS\system32\ntkrnlpa.exe
       
       PID   8063 48.36    watch.exe_0a4c
        TID   8063 48.36     tid_0738
         MOD   8062 48.35      C:\ibmperf\v20080430-GA\bin\watch.exe
         MOD      1  0.01      C:\WINDOWS\system32\hal.dll
       
       PID     14  0.08    iclient.exe_02e8
        TID     14  0.08     tid_08fc
         MOD      7  0.04      C:\WINDOWS\system32\ntkrnlpa.exe
         MOD      2  0.01      C:\WINDOWS\System32\Drivers\Ntfs.sys
         MOD      2  0.01      C:\WINDOWS\system32\ntdll.dll
         MOD      1  0.01      C:\WINDOWS\system32\drivers\ssrtln.sys
         MOD      1  0.01      C:\WINDOWS\system32\USER32.dll
         MOD      1  0.01      C:\WINDOWS\system32\hal.dll

       PID      3  0.02    vsmon.exe_00b4
        TID      2  0.01     tid_01d8
         MOD      1  0.01      C:\WINDOWS\system32\hal.dll
         MOD      1  0.01      C:\WINDOWS\system32\VSUTIL.dll

        TID      1  0.01     tid_0bd0
         MOD      1  0.01      C:\WINDOWS\system32\ZoneLabs\VSRULEDB.DLL

       PID      2  0.01    winlogon.exe_0254
        TID      2  0.01     tid_0628
         MOD      1  0.01      C:\WINDOWS\system32\ntkrnlpa.exe
         MOD      1  0.01      C:\WINDOWS\System32\Drivers\Ntfs.sys

       PID      2  0.01    svchost.exe_0410
        TID      2  0.01     tid_0a74
         MOD      1  0.01      c:\windows\system32\rpcss.dll
         MOD      1  0.01      C:\WINDOWS\system32\KERNEL32.dll

       PID      1  0.01    csrss.exe_02b4
        TID      1  0.01     tid_0314
         MOD      1  0.01      C:\WINDOWS\System32\RDPDD.dll

       PID      1  0.01    cmd.exe_0aec
        TID      1  0.01     tid_0af0
         MOD      1  0.01      C:\WINDOWS\system32\ntdll.dll

       ================================
        )) Process_Thread_Module_Symbol
       ================================

       LAB    TKS   %%%     NAMES

       PID   8588 51.51    IdleProcess_0000
        TID   8588 51.51     tid_0000
         MOD   8585 51.49      C:\WINDOWS\system32\DRIVERS\intelppm.sys
          SYM   8585 51.49       AcpiC1Idle

         MOD      2  0.01      C:\WINDOWS\system32\hal.dll
          SYM      1  0.01       READ_PORT_UCHAR
          SYM      1  0.01       READ_PORT_BUFFER_USHORT

         MOD      1  0.01      C:\WINDOWS\system32\ntkrnlpa.exe
          SYM      1  0.01       ExfInterlockedCompareExchange64
       
       PID   8063 48.36    watch.exe_0a4c
        TID   8063 48.36     tid_0738
         MOD   8062 48.35      C:\ibmperf\v20080430-GA\bin\watch.exe
          SYM   4095 24.56       ThirtyTwo
          SYM   2048 12.28       Sixteen
          SYM   1024  6.14       Eight
          SYM    512  3.07       Four
          SYM    255  1.53       Two
          SYM    128  0.77       One

         MOD      1  0.01      C:\WINDOWS\system32\hal.dll
          SYM      1  0.01       KeAcquireQueuedSpinLock
       
       PID     14  0.08    iclient.exe_02e8
        TID     14  0.08     tid_08fc
         MOD      7  0.04      C:\WINDOWS\system32\ntkrnlpa.exe
          SYM      1  0.01       _SEH_epilog
          SYM      1  0.01       IopfCallDriver
          SYM      1  0.01       KeQuerySystemTime
          SYM      1  0.01       __KeGetCurrentThread
          SYM      1  0.01       NtQueryDirectoryFile
          SYM      1  0.01       ExpInterlockedPopEntrySListEnd
          SYM      1  0.01       ObReferenceObjectByHandle

         MOD      2  0.01      C:\WINDOWS\System32\Drivers\Ntfs.sys
          SYM      1  0.01       NtfsCompleteRequest
          SYM      1  0.01       NtfsPurgeFileRecordCache

         MOD      2  0.01      C:\WINDOWS\system32\ntdll.dll
          SYM      1  0.01       RtlDosPathNameToNtPathName_Ustr
          SYM      1  0.01       ExpInterlockedPopEntrySListEnd

         MOD      1  0.01      C:\WINDOWS\system32\drivers\ssrtln.sys
          SYM      1  0.01       <<.text>>

         MOD      1  0.01      C:\WINDOWS\system32\USER32.dll
          SYM      1  0.01       PtiCurrent

         MOD      1  0.01      C:\WINDOWS\system32\hal.dll
          SYM      1  0.01       KfRaiseIrql

       PID      3  0.02    vsmon.exe_00b4
        TID      2  0.01     tid_01d8
         MOD      1  0.01      C:\WINDOWS\system32\hal.dll
          SYM      1  0.01       KeReleaseQueuedSpinLock

         MOD      1  0.01      C:\WINDOWS\system32\VSUTIL.dll
          SYM      1  0.01       <<.text>>

        TID      1  0.01     tid_0bd0
         MOD      1  0.01      C:\WINDOWS\system32\ZoneLabs\VSRULEDB.DLL
          SYM      1  0.01       <<.text>>

       PID      2  0.01    winlogon.exe_0254
        TID      2  0.01     tid_0628
         MOD      1  0.01      C:\WINDOWS\system32\ntkrnlpa.exe
          SYM      1  0.01       KiFastCallEntry

         MOD      1  0.01      C:\WINDOWS\System32\Drivers\Ntfs.sys
          SYM      1  0.01       NtfsFindFreeBitmapRun

       PID      2  0.01    svchost.exe_0410
        TID      2  0.01     tid_0a74
         MOD      1  0.01      c:\windows\system32\rpcss.dll
          SYM      1  0.01       CMutexLock::Lock

         MOD      1  0.01      C:\WINDOWS\system32\KERNEL32.dll
          SYM      1  0.01       InterlockedDecrement

       PID      1  0.01    csrss.exe_02b4
        TID      1  0.01     tid_0314
         MOD      1  0.01      C:\WINDOWS\System32\RDPDD.dll
          SYM      1  0.01       DrvTextOut

       PID      1  0.01    cmd.exe_0aec
        TID      1  0.01     tid_0af0
         MOD      1  0.01      C:\WINDOWS\system32\ntdll.dll
          SYM      1  0.01       RtlAllocateHeap

       ================================
        )) Module
       ================================

       LAB    TKS   %%%     NAMES

       MOD   8585 51.49    C:\WINDOWS\system32\DRIVERS\intelppm.sys
       MOD   8062 48.35    C:\ibmperf\v20080430-GA\bin\watch.exe
       MOD      9  0.05    C:\WINDOWS\system32\ntkrnlpa.exe
       MOD      5  0.03    C:\WINDOWS\system32\hal.dll
       MOD      3  0.02    C:\WINDOWS\System32\Drivers\Ntfs.sys
       MOD      3  0.02    C:\WINDOWS\system32\ntdll.dll
       MOD      1  0.01    C:\WINDOWS\system32\VSUTIL.dll
       MOD      1  0.01    C:\WINDOWS\system32\KERNEL32.dll
       MOD      1  0.01    C:\WINDOWS\system32\drivers\ssrtln.sys
       MOD      1  0.01    C:\WINDOWS\System32\RDPDD.dll
       MOD      1  0.01    C:\WINDOWS\system32\ZoneLabs\VSRULEDB.DLL
       MOD      1  0.01    c:\windows\system32\rpcss.dll
       MOD      1  0.01    C:\WINDOWS\system32\USER32.dll

       ================================
        )) Module_Symbol
       ================================

       LAB    TKS   %%%     NAMES

       MOD   8585 51.49    C:\WINDOWS\system32\DRIVERS\intelppm.sys
        SYM   8585 51.49     AcpiC1Idle
       
       MOD   8062 48.35    C:\ibmperf\v20080430-GA\bin\watch.exe
        SYM   4095 24.56     ThirtyTwo
        SYM   2048 12.28     Sixteen
        SYM   1024  6.14     Eight
        SYM    512  3.07     Four
        SYM    255  1.53     Two
        SYM    128  0.77     One
       
       MOD      9  0.05    C:\WINDOWS\system32\ntkrnlpa.exe
        SYM      1  0.01     NtQueryDirectoryFile
        SYM      1  0.01     ExfInterlockedCompareExchange64
        SYM      1  0.01     ExpInterlockedPopEntrySListEnd
        SYM      1  0.01     ObReferenceObjectByHandle
        SYM      1  0.01     KiFastCallEntry
        SYM      1  0.01     KeQuerySystemTime
        SYM      1  0.01     __KeGetCurrentThread
        SYM      1  0.01     _SEH_epilog
        SYM      1  0.01     IopfCallDriver

       MOD      5  0.03    C:\WINDOWS\system32\hal.dll
        SYM      1  0.01     READ_PORT_BUFFER_USHORT
        SYM      1  0.01     KeAcquireQueuedSpinLock
        SYM      1  0.01     KeReleaseQueuedSpinLock
        SYM      1  0.01     KfRaiseIrql
        SYM      1  0.01     READ_PORT_UCHAR

       MOD      3  0.02    C:\WINDOWS\System32\Drivers\Ntfs.sys
        SYM      1  0.01     NtfsPurgeFileRecordCache
        SYM      1  0.01     NtfsFindFreeBitmapRun
        SYM      1  0.01     NtfsCompleteRequest

       MOD      3  0.02    C:\WINDOWS\system32\ntdll.dll
        SYM      1  0.01     ExpInterlockedPopEntrySListEnd
        SYM      1  0.01     RtlAllocateHeap
        SYM      1  0.01     RtlDosPathNameToNtPathName_Ustr

       MOD      1  0.01    C:\WINDOWS\system32\VSUTIL.dll
        SYM      1  0.01     <<.text>>

       MOD      1  0.01    C:\WINDOWS\system32\KERNEL32.dll
        SYM      1  0.01     InterlockedDecrement

       MOD      1  0.01    C:\WINDOWS\system32\drivers\ssrtln.sys
        SYM      1  0.01     <<.text>>

       MOD      1  0.01    C:\WINDOWS\System32\RDPDD.dll
        SYM      1  0.01     DrvTextOut

       MOD      1  0.01    C:\WINDOWS\system32\ZoneLabs\VSRULEDB.DLL
        SYM      1  0.01     <<.text>>

       MOD      1  0.01    c:\windows\system32\rpcss.dll
        SYM      1  0.01     CMutexLock::Lock

       MOD      1  0.01    C:\WINDOWS\system32\USER32.dll
        SYM      1  0.01     PtiCurrent
Home