A colleague of mine recently asked the question ‘I see CPU N is constantly pegged at 100%; is there any good way to determine which specific process is using that specific CPU?’

Well, he already figured that Task Manager or Process Explorer does not provide that information. And by definition purely in user mode one cannot find this information, because the OS dispatcher schedules threads, not processes and the dispatcher runs at a lower level than user mode threads do. So classically, a live kernel debug would be required to be sure. The extension command !pcr or !prcb will give you the current thread for that processor, which you can use with !thread to get the process object.)

BUT no customer will let us do a live kernel debug in production unless it is really necessary. There must be an easier way out!

Today, with XPerf (part of Windows Performance Toolkit) you can get this information fairly easily and accurately. Here’s how you can get started:

1. Download and install the Platform SDK (http://msdn.microsoft.com/en-us/windows/hardware/gg463009.aspx) and choose the install the Windows Performance Toolkit
2. Redistributable versions should get installed as well at C:Program Files (x86)Windows Kits8.0Windows Performance ToolkitRedistributables (notice the ARM target is now available as well!)
3. Use the Windows Performance Recorder utility to record a trace with just CPU in it. Save it to a (.ETL) file.
4. Collect data for not more than 30-45 seconds. A LOT of information is collected, so limit the duration.
5. Transfer and Double-click the .ETL file on your laptop, it should open up in the Windows Performance Analyzer (WPA) utility.
6. Then from the graph explorer on the left side you should be able to select the CPU timeline report
7. Select the CPU of interest, and ZOOM IN to a particular section of the timeline. The zooming is important as without that you are not told which process is utilizing that CPU.

Here is an example screenshot of the type of information that WPA displays. Click on the thumbnail to get a larger view.

As you can see, it is really detailed and extremely easy to use. If you have Windows 7, Windows Server 2008 R2, Windows 8 or Windows Server 2012, you should be able to leverage the WPT to the full extent.

For more information on WPT you can click the help links I have mentioned above, and for a more interactive discussion I recommend you view the BUILD 2011 videos around WPT / WPA:

• Improving performance with the Windows Performance Toolkit
• Capturing and analyzing performance traces
• Introduction to the new WPA user interface
• Customizing WPA Trace Views

There are some additional videos on Channel9 which cover specific scenarios where WPT / WPA can be very useful:

• Understanding pool usage using Windows Performance Analyzer
• Understanding heap data using Windows Performance Analyzer
• Understanding VirtualAlloc usage using Windows Performance Analyzer

Please leave a comment and rate the post if you found it useful. I appreciate your time very much!

Happy performance investigations!