Share via


Processing

Displays trace post-processing options.

xperf -i <trace file>... 
     [-o output] 
     [-symbols ...] 
     [-target {human|machine}] 
     [-a action ...[-a action ...] ...]
     [-quiet]
     [-tle]
     [-tli]

Parameters

-i trace file

The trace file to be processed.

-o output file

Optional, the name of the file that output goes to. If not given, stdout is used.

-symbols [options]

Enable and configure symbol decoding support. See "xperf -help symbols" for detailed help

-target {human|machine}

Select the target audience of the output. Default is human.

-a action ...

Optional, the actions to take. Default action is to dump the event in text form.

-quiet

Do not print progress information.

-tle

Process the trace even in the presence of lost events.

Lost events generally happen because the buffers for the trace sessions were too small or too few. If this happens, you should increase the ETW session sizes instead of using the -tle parameter. For more information, see Using Event Tracing.

Note

You must use -tle parameter only when a trace with missing events must be processed. If the parameter is specified and events were indeed lost, none of the calculations and aggregations produced by XPerf can be considered accurate.

-tti

Process the trace even in the presence of time inversions.

On some systems, the time source may not be completely reliable. Although XPerf handles small time inversions by default, it issues a warning only in those cases where time inversions were too large or frequent.

Note

You must use -tti parameter only when a trace on a system with large time inversions must be processed. As a workaround, you may want to switch to another hardware platform whenever your trace sessions encounter time inversions.

Examples

xperf -i trace.etl -o out.csv
dump the events in trace.etl to file out.csv
xperf -help registry
print help on action registry
xperf -i trace.etl -a registry
print registry access statistics to stdout
xperf -i trace32.etl trace64.etl -o out.csv
dump the events in trace32.etl and trace64.etl to file o

Available Actions

Action Meaning
boot
Show boot and shutdown statistics
Bootprefetch
Show boot-time prefetching information
cpudisk
Show CPU/Disk activity report
cswitch
Show Context Switch data
diskio
Show Disk IO Statistics
dpcisr
Show DPC/ISR Statistics
drvdelay
Show Driver delays
drvdelay
Show Driver delays
dumper
Dump events in the trace in text form
filename
Show File Names in the trace
focuschange
Show the Windows thread focus change events in the trace
hardfault
Show hard fault statistics by process and file.
marks
Show Marks Information
pagefault
Show page fault information in the trace
perfctrs
Show process performance counters
pnp
Show PnP events in the trace
prefetch
Show Prefetch Information
process
Show process, thread, image information
profile
Show Sampled profiler data
readyBoot
Show ReadyBoot statistics
registry
Show Registry Access Statistics
services
Show service status information
shutdown
Show shutdown statistics
stack
Show stack information
suspend
Show suspend transition information
sysconfig
Show system configuration information
tracestats
Show trace statistics
winlogon
Show Winlogon events in the trace

Use xperf -help <action> [<action> ...] for detailed help. If no action is present, Dumper will be invoked.