Home / server / Questions / 104131
In Process
jlupolt
Asked: 2010-01-20 04:43:00 +0800 CST

How can I find out what is causing interrupts on Windows?

  • 772

Occasionally I come across servers (Windows 2003 and 2008) with high processor % interrupt time. Is there a way to see what program or device is causing the interrupts?

windows performance debugging kernel interrupts

4 Answers

  1. After digging through the documentation (based on the other answers here), this is the process I ended up using:

    1. Capture the ETW log of the problem

      The easiest way to do this is using the Windows Performance Recorder. I'm not sure when it first appeared, but seems to be built in on recent versions of Windows. Set the profile to CPU usage.

      Windows Performance Recorder

      or, using an elevated command prompt, navigate to the folder which contains it and use the command-line tool xperf:

      xperf -on base+interrupt+dpc

      Note, you will need to close Process Monitor or any other app which uses ETW or you will get the following error: xperf: error: NT Kernel Logger: Cannot create a file when that file already exists. (0xb7).

    2. Stop tracing / save the log

      xperf -d interrupt_trace.etl

    3. Open the trace in Windows Performance Analyzer (part of Windows Performance Toolkit); some places mention using xperfview instead.

    4. Expand Computation -> CPU Usage (Sampled) -> DPC and ISR Usage by Module, Stack, right-click and add graph to analysis view

      Windows Performance Analyzer

    5. This pointed right to the driver in question. In this case, HDAudBus.sys is using a constant 10.82% of my cpu via interrupts, which is exactly what Process Explorer was showing me.

    • 60

  2. If you can handle low-level system tools;

    Windows Performance Analyzer (WPA)

    Windows Performance Analyzer (WPA) is a set of performance monitoring tools used to produce in-depth performance profiles of Microsoft Windows operating systems and applications.

    After you learn how to use xperf; check out;

    The DPC/ISR Action

    The DPC/ISR action produces a text report that summarizes the various metrics regarding DPCs and ISRs. The usage for this action is:

    Copy Code -a dpcisr [-dpc -isr -summary -interval [n] -bucket [n] -range T1 T2 ]

    Option

    Description

    dpc

    Show statistics for DPC only

    isr

    Show statistics for ISR only

    summary

    Show summary report

    interval [dt]

    Show usage report for intervals of dt, default is 1 second

    bucket [dt]

    Show histogram for intervals of dt, default is 2 seconds

    range T1 T2

    Show delays between T1 and T2

    If no data type is specified, default is to show report for both DPC

    and ISR. If no report type is specified, default is to print all three kinds of report.

    • 5

  3. Here's the best article I've found on how to do this, with tutorials, screenshots, and download links to the relevant tools:

    http://www.msfn.org/board/topic/140263-how-to-get-the-cause-of-high-cpu-usage-by-dpc-interrupt/

    • 4

  4. Two great tools are LatencyMon and DPC Latency Checker.

    • 2