Sysinternals Homepage
Forum Home Forum Home > Windows Discussions > Troubleshooting
  New Posts New Posts RSS Feed: DPC (Deferred Procedure Calls)
  FAQ FAQ  Forum Search   Calendar   Register Register  Login Login

DPC (Deferred Procedure Calls)
 Post Reply Post Reply Page  <1234 54>
Author
Message Reverse Sort Order
  Share Topic Share Topic  Topic Search Topic Search  Topic Options Topic Options
dirbase View Drop Down
Senior Member
Senior Member
Avatar

Joined: 26 March 2008
Online Status: Online
Posts: 440 		Post Options Post Options   Quote dirbase Quote  Post ReplyReply Direct Link To This Post Topic: DPC (Deferred Procedure Calls)
    Posted: 29 June 2010 at 7:33am
Originally posted by Haysys

For purposes of clarity, the location you refer to as system32\dllcache appears to be Windows\driver cache\i386 on this system.
Kernrate reports having found ntkrnlpa.exe in windows\system32\dllcache\:
Originally posted by Kernrate symbol search dialog

DBGHELP: FindExecutableImageEx-> Looking for C:\WINDOWS\System32\dllcache\ntkrnlpa.exe... OK
found

"Windows\system32\dllcache\"  is a hidden folder, so make sure your Windows Explorer options are set to display hidden folders/files (sorry, I should have mentioned that earlier). You should then be able to view the system32\dllcache\ntkrnlpa.exe file.
Please change this file name as mentioned before and launch kernrate with output4.txt instead of output3.txt.
Back to Top
Haysys View Drop Down
Newbie
Newbie
Avatar

Joined: 26 June 2010
Location: Sammamish, WA
Online Status: Offline
Posts: 12 		Post Options Post Options   Quote Haysys Quote  Post ReplyReply Direct Link To This Post Posted: 28 June 2010 at 11:50pm
As requested.
 
For purposes of clarity, the location you refer to as system32\dllcache appears to be Windows\driver cache\i386 on this system. I renamed the file located in the latter and reran your script. If I'm missing something here, then please advise.
 
David Hays
Back to Top
dirbase View Drop Down
Senior Member
Senior Member
Avatar

Joined: 26 March 2008
Online Status: Online
Posts: 440 		Post Options Post Options   Quote dirbase Quote  Post ReplyReply Direct Link To This Post Posted: 28 June 2010 at 10:30pm
This difference does not imply a problem, it's just that the symbols may not be the same.
Could you please rename ntkrnlpa.exe in system32\dllcache to ntkrnlpa.bak (only for the duration of this test) and relaunch the last kernrate command just changing output2.txt to output3.txt.
Back to Top
Haysys View Drop Down
Newbie
Newbie
Avatar

Joined: 26 June 2010
Location: Sammamish, WA
Online Status: Offline
Posts: 12 		Post Options Post Options   Quote Haysys Quote  Post ReplyReply Direct Link To This Post Posted: 28 June 2010 at 10:19pm
I just checked another server of the same config at another site. The ntklnlpa.exe in the two locations (system32 and Driver cache\i386) is identical to that of the server with problems. This appears, on the basis of a sample of two, to be the norm.
David Hays
Back to Top
Haysys View Drop Down
Newbie
Newbie
Avatar

Joined: 26 June 2010
Location: Sammamish, WA
Online Status: Offline
Posts: 12 		Post Options Post Options   Quote Haysys Quote  Post ReplyReply Direct Link To This Post Posted: 28 June 2010 at 10:09pm
Hmmm...
 
Actually, they are not identical. They have the same date modified Date & Time (2/16/2010 5:34:00 AM). However, their size differs. The one in Windows\System32 has a size of 2,340,352 bytes and a creation date of 2/16/2007 while the one in Windows\Driver Cache\I386 has a size of 2,300,928 bytes and creation date of 6/30/2008.
 
Implication???
David Hays
Back to Top
dirbase View Drop Down
Senior Member
Senior Member
Avatar

Joined: 26 March 2008
Online Status: Online
Posts: 440 		Post Options Post Options   Quote dirbase Quote  Post ReplyReply Direct Link To This Post Posted: 28 June 2010 at 9:51pm
The symbols for ntkrnlpa.exe are those for the file in windows\system32\dllcache\.
Could you please check if the file in windows\system32\ is exactly the same?
Back to Top
Haysys View Drop Down
Newbie
Newbie
Avatar

Joined: 26 June 2010
Location: Sammamish, WA
Online Status: Offline
Posts: 12 		Post Options Post Options   Quote Haysys Quote  Post ReplyReply Direct Link To This Post Posted: 28 June 2010 at 9:06pm
OK, sounds like you know what you're talking about.
 
Attached is the requested output file.
 
 
Thanks!!
David Hays
Back to Top
dirbase View Drop Down
Senior Member
Senior Member
Avatar

Joined: 26 March 2008
Online Status: Online
Posts: 440 		Post Options Post Options   Quote dirbase Quote  Post ReplyReply Direct Link To This Post Posted: 28 June 2010 at 8:07pm
RATTV3 confirms my earlier thought: the report shows that ACPI is responsible for 96% of all interrupts and 99% of all DPCs. Here is an extract from this report (total counts added)

Cumulative Histogram for:      ACPI.sys  (ACPI.sys)
  #,                  Range, Label,       ISR Count,      DPC Count,           DPCTmr Count
  1,    1.00us to    1.99us, <2.00us,             0,             6,                   0
  2,    2.00us to    2.99us, <3.00us,             0,             9,                    0
 10,   10.00us to   19.99us, <20.00us,      7947207,   48803279,      0
 11,   20.00us to   29.99us, <30.00us,      8339661,      75555,         0
 12,   30.00us to   39.99us, <40.00us,         4020,      14457,            0
 13,   40.00us to   49.99us, <50.00us,         7475,          1,                0
                              TOTALS,                 16298363/17015445,   48893307/49230228,          0


On a sideline, I have some doubts for the symbols resolution concerning ntkrnlpa (although this module does not seem to be central to your problem)
Could you add the -v switch to the kernrate command,  running exactly this:
Kernrate_i386_XP.exe -m -b 4 -i 2500 -w 3 -s 10 -k 3 -j "symsrv*symsrv.dll**http://msdl.microsoft.com/download/symbols" -z hal -z intelppm -z ACPI -z ntkrnlpa -v >output2.txt 2>&1
and please upload the output2.txt file here.

Originally posted by Haysys

When I look at the Output .txt file, I too see the 19% on ACPIInterupt... from Intelppm.sys.

Intelppm.sys spends 100% of its activity in ACPIC1Idle which is what the idle threads on both processors runs; so this module activity (12%) is only spent by both idle threads and can be discarded for your problem..



Edited by dirbase - 28 June 2010 at 8:42pm
Back to Top
Haysys View Drop Down
Newbie
Newbie
Avatar

Joined: 26 June 2010
Location: Sammamish, WA
Online Status: Offline
Posts: 12 		Post Options Post Options   Quote Haysys Quote  Post ReplyReply Direct Link To This Post Posted: 28 June 2010 at 7:12pm
Sure,
 
The unit is a Intel Core 2 Duo Xeon E310 running at 3GHz. This sits on an Intel S3210SH MB with 4GB (4 sticks of 1GB ECC) of RAM. The OS is 32-bit. All of this is in a SuperMicro case with a single power supply (sorry, don't recall the model, but it is an entry-level server case).
 
Wehn you say "power-setup". I'm not sure I know what you mean, but here is what I know. The power settings are "Always On". The system is set to never power down drives or sleep.
 
The RAID array is using the onboard controller with 2 500GB drives in a RAID 1 config.
 
I ran the RATTV3 for 60 seconds. I have attached the txt file from that run, though it looks to be Greek to me.
 
When I look at the Output .txt file, I too see the 19% on ACPIInterupt... from Intelppm.sys. But I also see a 66% on Write_Port_Uchar under the HAL.dll with 10,600,000 events/sec on an idle machine. Is the HAL output simply a symptom of the ACPI, or....????
 
Thanks Again!!
 
David Hays
Back to Top
dirbase View Drop Down
Senior Member
Senior Member
Avatar

Joined: 26 March 2008
Online Status: Online
Posts: 440 		Post Options Post Options   Quote dirbase Quote  Post ReplyReply Direct Link To This Post Posted: 28 June 2010 at 9:50am
The high interrupts/DPC events seem to be due to the ACPI module.
This could be checked using RATTV3, and could prove useful.
Could you please give more information on your specific machine (brand, power set-up, etc).
Anything worth mentionning concerning the power management used?
Back to Top
 Post Reply Post Reply Page  <1234 54>

Forum Jump Forum Permissions View Drop Down