The Xperf.exe program is a command-line tool that provides the following features:

• ETW trace control
• ETW trace merging and enhancements by including other events
• Executable image and symbol identification
• Trace dump capabilities
• Support for post-processing by using actions

This tool manages the end-to-end operations that are needed to generate a trace file for analysis. An overview of the tool is shown in the following figure:

Xperf enables events in the operating system by using groups and/or flags. These flags enable and disable events from providers in various parts of the operating system. For example, flags can direct the kernel, services, and applications to one or more trace files by using log sessions with custom configurations. You can then merge all traces into a single aggregate trace file that is commonly referred to as a merged trace file. When Xperf generates this file, it collects additional information from the operating system and adds it to the aggregate trace. The most notable information is executable image identity, which is critical for symbol decoding. You can process the merged trace file on any supported operating system without reference to the system that generated the trace. You can then use Performance Analyzer to analyze the merged file, you can put the merged file into an ANSI text format, or use actions to do other types of processing. Actions produce summarized outputs that are specific to an area of interest, such as boot, shutdown, suspend, and resume operations, or to a type of system events, such as sampled profile, context switches, DPCs and ISRs, disk I/O, registry accesses, file accesses, or system configuration.

Performance Analyzer and Xperf both fully support symbol decoding. For more information about how to enable symbol decoding support, see the Symbol Support section later in this documentation.

This section includes the following topics:

Using the Command-line Help

Providers

Starting a Trace

Stopping a Trace

Merging Traces

Actions

An Example