viewer9 documentation

ThreadProfiling PML Operation

Example from 64-bit PML

Hover over field values like Time, ResultCode, and bytes of evdata in this example to see tooltips as they appear in viewer9. The tooltip of the first byte of a color patch tells the field name.

ThreadProfiling opcode=4,0

ev=43926

Time:2022-05-19 23:22:15.9058705
Duration:1.0027157
ResultCode:SUCCESS
Tid:212
UserTime:0.3407923
KernelTime:0.6619234
ContextSwitches:3276850

evdata[0-11] file offset 9896814

033 00 34 00 62 00 65 00 3.4.b.e.
832 00 32 00 2.2.

Call Stack stacksize=6

StackAddressmodModNameModPath
0x8290087d128ntkrnlpa.exe + 0xb387dC:\Windows\system32\ntkrnlpa.exe
0x828b8725128ntkrnlpa.exe + 0x6b725C:\Windows\system32\ntkrnlpa.exe
0x828b759b128ntkrnlpa.exe + 0x6a59bC:\Windows\system32\ntkrnlpa.exe
0x828b828d128ntkrnlpa.exe + 0x6b28dC:\Windows\system32\ntkrnlpa.exe
0x828b7b23128ntkrnlpa.exe + 0x6ab23C:\Windows\system32\ntkrnlpa.exe
0x82a62b38128ntkrnlpa.exe + 0x215b38C:\Windows\system32\ntkrnlpa.exe

ThreadProfiling is "Thread Profiling" with a space in Procmon. And likewise, these corresponding detail field names have spaces in Procmon: User Time, Kernel Time, Context Switches.

See also

Posted 4 Jul 2022 last updated 15 Nov 2022   As viewer9 is just starting out, discussion is invited via email. Please send questions and comments to forum@viewer9.com directly. Threads that might be valuable to other users will be posted as part of the documentation. Posted messages will not include your address or your full name, and might be shortened for brevity.

Copyright 2022, bryantlite, Inc.