Process Hacker Discussion Forum

 
David Xanatos
Member
Posts: 17
Joined: 25 May 2019 06:55

MMapIO statistics and more

20 Jun 2019 05:53

It would be great when process hacker would have the ability to show stats for what the tool TaskInfo calls MMapIO

TaskInfos FileIO graph is the same as ProcessHackers IO statistics, and if one uses any of thees tools for a longer period of time one notices that not all disk access is represented by the regular IO stats. This is especially prominent when using VMWare ans Saving or restoring snapshots, when saving a snapshot FileIO will often remain at 0 and only MMapIO will actually show the write rates to disk.
Its especially painful if you are saving snapshots to a mechanical disk as it seams after a initial burst of data at a high data rate it often slows down to a crawl writing with 5-10MB/s for a minute or sometimes many more, massively slowing down any other disk access to that volume. That is why now I run my VM's of an SSD raid array, but i digress.

For a while I was Assuming what TaskInfo shows as MMapIO would be counted by process hacker as Disk Reads and Writes as provided by the ExtendedTools plugin. But this while being similar does not seam to be the case as you can see in this screenshot:
mmap.png
On the left you see my own UI for the ProcessHacker Library made to look as close to task info as I liked it
and on the right is TaskInfo as you can see there were a few read operations peaking at many 10MB's which were not noticed by the ProcessHacker based graph.
Not cool :/


Also I know for a fact that TaskInfo is not using ETW events to create the MMapIO stats, as demonstrated by this experiment:
mmapN.png
You see here me first reading from a samba share, than writing to it (with a small gap) and than reading again.
Task info counts the reads from the share as MMapIO, strangely it does not the writes, but my ETW based approach to get MMapIO stats functionality, completely misses the samba activity.
And its not using its driver since in VM's where I only start the exe and the driver is not present this stats are still working.

So the big question is what exactly is TaskInfo querying to get this data?

Anyone here having an idea how TaskInfo obtains said statistics?

EDIT:

I found the answer, actually its quite simple, thats what TaskInfo seams to do:
	SYSTEM_PERFORMANCE_INFORMATION PerfInformation;
	NtQuerySystemInformation(SystemPerformanceInformation, &PerfInformation, sizeof(SYSTEM_PERFORMANCE_INFORMATION), NULL);

	m_Stats.MMapIo.ReadRaw = ((quint64)PerfInformation.PageReadCount) * PAGE_SIZE;
	
	m_Stats.MMapIo.WriteRaw = ((quint64)PerfInformation.MappedPagesWriteCount + (quint64)PerfInformation.DirtyPagesWriteCount + (quint64)PerfInformation.CcLazyWritePages) * PAGE_SIZE;
 
User avatar
dmex
Admin
Posts: 1695
Joined: 17 Jan 2011 05:43

Re: MMapIO statistics and more

25 Jun 2019 07:10

David Xanatos wrote: 20 Jun 2019 05:53
I found the answer, actually its quite simple, thats what TaskInfo seams to do:
	SYSTEM_PERFORMANCE_INFORMATION PerfInformation;
	NtQuerySystemInformation(SystemPerformanceInformation, &PerfInformation, sizeof(SYSTEM_PERFORMANCE_INFORMATION), NULL);

	m_Stats.MMapIo.ReadRaw = ((quint64)PerfInformation.PageReadCount) * PAGE_SIZE;
	
	m_Stats.MMapIo.WriteRaw = ((quint64)PerfInformation.MappedPagesWriteCount + (quint64)PerfInformation.DirtyPagesWriteCount + (quint64)PerfInformation.CcLazyWritePages) * PAGE_SIZE;
I've added these statistics to the latest nightly build (System Information > Memory > Mapped IO group) but I'm not sure if these values are actually the same as TaskInfo?

TaskInfo also uses the NetStatisticsGet function for other statistics in addition to SystemBasicInformation, SystemProcessorInformation, SystemPerformanceInformation, SystemFileCacheInformation, SystemSuperfetchInformation, SystemMemoryListInformation and SystemPageFileInformation.
 
David Xanatos
Member
Posts: 17
Joined: 25 May 2019 06:55

Re: MMapIO statistics and more

16 Aug 2019 21:26

Yes they are the same, I ran Task Info and my Task explorer for a month side by side and they always showed the same values for MMapedIO,
NetStatisticsGet is only used for the client/server plots showing the samba data rates.

Great to hear that you've added the values, but it would be even greater if they would be shown in a plot.
So in the IO page of Process Hackers system information's, instead of File IO only, there should be a second plot with MMapedIO like its done on the Memory page.

A lot of disk access is not properly shown by the FileIO values, especially with mechanical drives that's a problem, as the FileIO may show all done, while in reality the OS will be writing the cache to disk for 15 more minutes or so... and this i visible in the MMaped IO values.