As an IT administrator, you've probably faced an issue where one particular system will not restart in a timely fashion. Perhaps you've just updated your servers with the latest security updates, and one particular server has not restarted yet. This is a common issue that can be diagnosed in a number of ways, such as using msconfig.exe to turn off all nonessential services in an effort to determine which service or driver is not responding in a timely fashion. But there should be some way to get an overall view of the shutdown statistics in a way that you can easily interpret, to help you get a bird's-eye view of how your system performs during the shutdown process.
Enter the Windows Performance Toolkit xbootmgr.exe tool, which is supported on Windows Vista, Windows 2008, Windows 7, and Windows 2008 R2. You can use xbootmgr.exe to generate a report that provides you with valuable shutdown information in an easy-to-interpret XML file—information that you can use to help in diagnosing your next shutdown problem. You can obtain the latest Windows Performance Toolkit by downloading the SDK for Windows 7 at www.microsoft.com/downloads/details.aspx?FamilyID=c17ba869-9671-4330-a63e-1fd44e0e2505&displaylang=en.
You do not have to download the entire SDK, however. You'll need only the actual WPT.exe files from this large download. To make the download faster, I recommend you perform the following steps:
- On the Microsoft Windows SDK for Windows 7 and .NET Framework 3.5 SP1 page, click the Download button, then click Run in the dialog box.
- Click Next to the resulting dialog box, then click I agree to the license agreement.
- Continue to click Next until you get to the dialog box that Figure 1 shows, which is the Installation Options page. Here you want to uncheck all the options except for Win32 Development Tools.
- Click Next to begin installation. The installation which will take a few seconds or longer, depending on your Internet connection.
After setup is finished, you will find three files called wpt_ia64.msi, wpt_x64.msi, and wpt_x86.msi in the C:\Program Files\Microsoft SDKs\Windows\v7.0\Bin directory.
Performing a Shutdown Trace
Once you've downloaded the WPT binaries, you can install the one that is the appropriate platform for your system. After Xperf is installed, you can now open a command prompt and navigate to the install directory, which by default is C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft Windows Performance Toolkit. Now type the following command to produce a shutdown trace:
C:\xperf\>xbootmgr.exe -trace shutdown -traceflags
latency+dispatcher -numruns 1 -stackwalk
Profile+CSwitch
(Type the command on one line.) Here are the descriptions for each parameter:
- -trace shutdown: Perform a shutdown trace.
- -traceflags latency+dispatcher: Enable traceflags in the latency Kernel group, plus the dispatcher Kernel flag. You can also issue the command xperf -help providers to view definitions of the trace flags.
- -numruns 1: Set the number of Shutdown runs to 1.
- -stackwalk Profile+CSwitch: Enables stackwalking for Profile and CSwitch. This switch is available only on Windows Vista and later.
Xbootmgr will perform one initial boot after which you'll need to log back into your system. However, Xperf will perform one additional boot for each shutdown trace specified in the numruns switch. After the second boot when the tracing is finished, the Xbootmgr status window will disappear. In the previous command example, my machine rebooted twice.
After the second reboot, Xperf will automatically merge two files into one. You will need to give Xperf a few moments to merge the .etl files with the "premerge" filename into a single file. A few moments after the final reboot, you'll notice a single file called shutdown_latency+dispatcher_1.etl file in the xperf directory. Now you can export this .etl file into a shutdown XML report by issuing the following command (type on one line):
C:\xperf>xperf -i shutdown_latency+dispatcher_1.etl
-o shutdown_demo1.xml -a shutdown