I suppose the subject says it all. I cannot find a good
resource on what the output generated means. Can someone
point me in the right direction?
Thanks in advance.
From the reskit help:
Pfmon Examples
--------------------------------------------------------------------------------
Example 1: Monitor an Existing Process
In this example, system performance is slowing down while a certain application
is running. You want to determine the number of hard page faults that this
existing process is generating. First use Task Manager to determine the Process
IDentifier (PID) of the existing process. Then type the following in the command
window, substituting 1640 with the PID you found in Task Manager:
pfmon -h -p 1640
Pfmon displays a list of hard page faults in the command window while the
process is running. When you terminate the process, Pfmon displays summary
information about the types of page faults that the process generated. Your
report might look similar to the following output. If it does, you can see that
the process used in this sample did not generate a large number of hard page
faults.
HARD: wdCommandDispatch+0x4fd1d : 307be774
HARD: 3018541a : 307d35ac
HARD: MsoFAddPruldepDependent+0x6b : 307a837c
HARD: MsoFAddPruldepDependent+0xdb : 307aab7c
HARD: 300fb83f : 30791030
HARD: 30136545 : 30794c60
HARD: wdCommandDispatch+0xa7c9a : 00125ac4
HARD: CoFreeAllLibraries+0x6861 : 03c99000
HARD: DsFreeNameResultW+0xa1e : 77bfe2fc
HARD: AccRewriteGetExplicitEntriesFromAcl+0x8370 : 69c07e00
HARD: CoFreeAllLibraries+0x6861 : 042c6000
Caused 78 faults had 75 Soft 6 Hard faulted VA's
ntdll Caused 38 faults had 10 Soft 0 Hard faulted VA's
advapi32 Caused 4 faults had 4 Soft 0 Hard faulted VA's
kernel32 Caused 7 faults had 4 Soft 0 Hard faulted VA's
rpcrt4 Caused 0 faults had 0 Soft 0 Hard faulted VA's
gdi32 Caused 0 faults had 0 Soft 0 Hard faulted VA's
user32 Caused 8 faults had 6 Soft 0 Hard faulted VA's
Caused 45 faults had 16 Soft 0 Hard faulted VA's
ole32 Caused 83 faults had 8 Soft 0 Hard faulted VA's
shell32 Caused 4 faults had 0 Soft 0 Hard faulted VA's
shlwapi Caused 4 faults had 0 Soft 0 Hard faulted VA's
comctl32 Caused 0 faults had 0 Soft 0 Hard faulted VA's
winspool Caused 0 faults had 0 Soft 0 Hard faulted VA's
clbcatq Caused 1 faults had 1 Soft 0 Hard faulted VA's
oleaut32 Caused 0 faults had 0 Soft 0 Hard faulted VA's
Caused 2 faults had 1 Soft 0 Hard faulted VA's
Caused 0 faults had 0 Soft 0 Hard faulted VA's
MSVBVM60 Caused 10 faults had 10 Soft 0 Hard faulted VA's
msi Caused 3 faults had 3 Soft 0 Hard faulted VA's
MSAddnDr Caused 0 faults had 0 Soft 0 Hard faulted VA's
Caused 0 faults had 0 Soft 0 Hard faulted VA's
Caused 0 faults had 0 Soft 0 Hard faulted VA's
version Caused 0 faults had 0 Soft 0 Hard faulted VA's
lz32 Caused 0 faults had 0 Soft 0 Hard faulted VA's
cscui Caused 0 faults had 0 Soft 0 Hard faulted VA's
cscdll Caused 0 faults had 0 Soft 0 Hard faulted VA's
Caused 2 faults had 2 Soft 0 Hard faulted VA's
AgentMpx Caused 0 faults had 0 Soft 0 Hard faulted VA's
Caused 1 faults had 1 Soft 0 Hard faulted VA's
Caused 0 faults had 0 Soft 0 Hard faulted VA's
linkinfo Caused 0 faults had 0 Soft 0 Hard faulted VA's
ntshrui Caused 0 faults had 0 Soft 0 Hard faulted VA's
Caused 0 faults had 0 Soft 0 Hard faulted VA's
netapi32 Caused 0 faults had 0 Soft 0 Hard faulted VA's
secur32 Caused 0 faults had 0 Soft 0 Hard faulted VA's
NetRap Caused 0 faults had 0 Soft 0 Hard faulted VA's
samlib Caused 0 faults had 0 Soft 0 Hard faulted VA's
ws2_32 Caused 0 faults had 0 Soft 0 Hard faulted VA's
ws2help Caused 0 faults had 0 Soft 0 Hard faulted VA's
wldap32 Caused 0 faults had 0 Soft 0 Hard faulted VA's
dnsapi Caused 0 faults had 0 Soft 0 Hard faulted VA's
wsock32 Caused 0 faults had 0 Soft 0 Hard faulted VA's
riched20 Caused 0 faults had 0 Soft 0 Hard faulted VA's
unidrvui Caused 0 faults had 0 Soft 0 Hard faulted VA's
unidrv Caused 0 faults had 0 Soft 0 Hard faulted VA's
mscms Caused 0 faults had 0 Soft 0 Hard faulted VA's
icm32 Caused 0 faults had 0 Soft 0 Hard faulted VA's
ntmarta Caused 11 faults had 12 Soft 1 Hard faulted VA's
ntdsapi Caused 4 faults had 3 Soft 1 Hard faulted VA's
PFMON: Total Faults 305 (KM 141 UM 305 Soft 294, Hard 11, Code 127, Data 178)
Example 2: Monitor an Invoked Process
In this example, you suspect that an application you have developed is
generating a large number of hard page faults and is causing a disk bottleneck.
Type the following to invoke your application (in this example it is Notepad)
and specify that output data be written to the Pfmon.log file, not to the
command window:
pfmon -h -n notepad
Pfmon writes a list of hard page faults to the Pfmon.log file. When you close
your application, summary information about the process is written to the log
file, and the final line of the summary is also displayed in the command window.
Based on the small number of hard page faults in the sample output, you can see
that your application is not generating a large number of hard page faults. You
might want to rerun Pfmon while limiting the amount of memory to see how your
application behaves under those conditions. For instructions on how to do this,
see "Limiting Available Memory.;" If the program continues to generate a low
number of hard page faults, you might want to use another tool to investigate
other aspects of your application's behavior.
HARD: RtlTryEnterCriticalSection+0xf : NlsMbOemCodePageTag+0x00000034
HARD: ZwOpenProcessToken+0x166 : NlsAnsiCodePage+0x00000672
HARD: RtlAppendUnicodeToString+0x15e : modf+0x00003DE0
HARD: RtlGetControlSecurityDescriptor+0x4b : 0006ef54
HARD: SetWaitableTimer+0xa1 : 77edf060
HARD: SetWaitableTimer+0xa7 : 77ee0800
HARD: UserClientDllInitialize+0x48 : 77e694bc
HARD: RtlInitializeCriticalSectionAndSpinCount+0xb : 77f784f4
HARD: RpcBindingInqAuthInfoExW+0x2ab : 77da9038
HARD: RtlInitializeCriticalSectionAndSpinCount+0xb : 77e02134
HARD: RegCloseKey+0x2ee : 77e010fc
HARD: RtlInitializeCriticalSectionAndSpinCount+0xb : 77cb4034
HARD: ImageList_SetOverlayImage+0x1326 : 77bb6068
HARD: Ordinal211+0x151e : 776bc248
HARD: ftol+0xc3 : osplatform
HARD: control87+0x1d8 : iob+0x00001290
HARD: GetFileTitleA+0x381 : 76b5b1ac
HARD: InitializeDll+0x3c : 778182b8
HARD: 01004c4b : 0100885c
notepad Caused 8 faults had 11 Soft 1 Hard faulted VA's
ntdll Caused 97 faults had 48 Soft 2 Hard faulted VA's
comdlg32 Caused 3 faults had 2 Soft 1 Hard faulted VA's
shlwapi Caused 2 faults had 3 Soft 1 Hard faulted VA's
gdi32 Caused 24 faults had 12 Soft 1 Hard faulted VA's
kernel32 Caused 48 faults had 37 Soft 2 Hard faulted VA's
user32 Caused 46 faults had 41 Soft 1 Hard faulted VA's
advapi32 Caused 7 faults had 7 Soft 2 Hard faulted VA's
rpcrt4 Caused 6 faults had 5 Soft 1 Hard faulted VA's
comctl32 Caused 6 faults had 6 Soft 1 Hard faulted VA's
shell32 Caused 6 faults had 6 Soft 1 Hard faulted VA's
Caused 10 faults had 11 Soft 3 Hard faulted VA's
winspool Caused 4 faults had 3 Soft 1 Hard faulted VA's
PFMON: Total Faults 267 (KM 22 UM 267 Soft 248, Hard 19, Code 131, Data 136)
Limiting Available Memory
--------------------------------------------------------------------------------
An application might appear to generate a negligible number of hard page faults
when it is run on a computer that has few other processes running and therefore
ample available memory. The performance of the application might degrade,
however, with other processes running and reduced amounts of available memory.
Test this case by limiting memory using LeakyApp or MAXMEM.
Using LeakyApp
LeakyApp is a GUI tool included on the Windows 2000 Resource Kit CD. You can use
LeakyApp to allocate all available memory to its process, and then run the
application you are investigating to see how it performs in this low-memory
situation. For more information about LeakyApp, see the Windows 2000 Resource
Kit.
Using MAXMEM in Boot.ini
You can use the MAXMEM parameter in the boot.ini file to set the maximum
physical memory available to Windows 2000. Boot.ini is a hidden, read-only
system file.
To make changes to boot.ini
View boot.ini in the root directory by doing the following:
In Windows Explorer, on the Tools menu, click Folder Options, and then click the
View tab.
Clear Hide protected operating system files check box.
Under Hidden files and folders, select Show hidden files and folders. Click OK.
Remove the read-only attribute of boot.ini by doing the following:
In the root directory, right-click boot.ini.
Clear Read-only. Click OK.
Follow these steps to edit boot.ini:
Before making any changes, make a copy of boot.ini.
Open the boot.ini file with Notepad. An example boot.ini follows:
[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows 2000 Professional"
/fastdetect
Copy the boot option line under [operating systems] and paste it immediately
below the existing line.
Type descriptive text within the quotes, so the option is identified when your
computer starts. For example:
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows 2000 Professional
32MB" /fastdetect
At the end of the line leave a space, and then type /MAXMEM=n (where n is the
amount of memory in megabytes that you want to make available to Windows 2000.
Do not set the amount below 32MB, or Windows 2000 might not start. For example:
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows 2000 Professional
32MB"/fastdetect/maxmem=32
After completing the preceding procedure, you can reboot your computer and
choose the new option you created from the boot option lines. Check About
Windows or Task Manager to ensure that the change you want is in effect.
Note
MAXMEM works only on Intel architecture-compatible platforms. This information
does not apply to RISC computers (DEC Alpha, MIPS, and Power PC) that store
their boot options in ARC firmware.
Determine the amount of available memory
Open Task Manager.
Select the Performance tab.
Wait until the amount of available memory is at a minimum, and then run the
application you want to test.
Available memory is listed in the "Physical Memory" section.
Page Fault Notes
--------------------------------------------------------------------------------
A page is a fixed amount of data. When you run a program, the microprocessor
stores pages of data that it predicts you will need in main memory, also known
as RAM. Pages of data that are not needed are left on your storage device, such
as your hard disk.
A page fault occurs when a process refers to a virtual memory page that is not
in the working set (the physical memory visible to the program) in main memory.
There are two kinds of page faults: soft and hard. A soft page fault occurs when
a process refers to a virtual memory page that is not in the working set, but
does not require that the page be retrieved from disk. This can happen when the
page is on the standby list in main memory or when the page is being shared with
another process. A hard page fault occurs when a virtual memory page is not
found in main memory and must therefore be retrieved from disk.
Neither type of page fault is an error. Page faults indicate that your program
is reading from and writing to disk. A rise in the number hard page faults
generated by a specific program increases the possibility of a disk bottleneck.
Pfmon helps you determine the number, type, and source of page faults that your
application generates.
Jerold Schulman
Windows: General MVP
JSI, Inc.
http://www.jsiinc.com