Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

DCStart and DCEnd in trace performance monitor

Posted on 2008-06-12
3
Medium Priority
?
1,082 Views
Last Modified: 2012-05-05
Does anybody know what this word mean (DCStart and DCEnd)?  I use trace logs in performance monitor (Windows XP).  When I create trace, I check "Process creations/deletions".  When the trace is started, it get all event about process creation in Windows.  This produce a .etl file.  When I convert this etl file in csv file, I see every process started on the computer where trace as been activated.  In the trace, I see a lot of starting type method, both of them are DCStart and DCEnd.   Does anybody know what DC mean ?
Thank you.

This is an exemple of log in the file...
     Process          DCStart       0x02F8      1.28577E+17      2008-06-11 18:05      1190      700       0x00014A71      756      668      0      0       "\\NT AUTHORITY\SYSTEM"       "winlogon.exe"
     Process          DCStart       0x0338      1.28577E+17      2008-06-11 18:05      0      0       0x00015673      800      756      0      0       "\\NT AUTHORITY\SYSTEM"       "services.exe"
0
Comment
Question by:swatuser
  • 2
3 Comments
 
LVL 5

Expert Comment

by:squillman
ID: 21771757
DCStart is the event that lists running processes at the start of a kernel session.  DCEnd is the event that lists them at the end of the kernel session.
0
 

Author Comment

by:swatuser
ID: 21772279
Thanks for your post, can you just say to me what is a "Kernel session" ?  When it finish ?  If I start a trace logs in moment x, all running process will be logged as "DCStart" ? (In other word, all new process will be logged as "Start" ?)  This part is not clear for me.  Thanks for your help.
0
 
LVL 5

Accepted Solution

by:
squillman earned 500 total points
ID: 21773639
Sorry, I should have said kernel logging session.  There will be a process with DCStart for each process running at the time the logging session starts and one with DCEnd for each process that was running at the time the logging session ends.  And yes, for a process that starts during your logging session you'll see a Process entry with a Type of Start.  If a process ends during your logging session you'll get an entry with Type of End.

This is also true for threads.
0

Featured Post

Ask an Anonymous Question!

Don't feel intimidated by what you don't know. Ask your question anonymously. It's easy! Learn more and upgrade.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Ever visit a website where you spotted a really cool looking Font, yet couldn't figure out which font family it belonged to, or how to get a copy of it for your own use? This article explains the process of doing exactly that, as well as showing how…
In this modest contribution, I want to share with the IT community (especially system administrators, IT Support Engineers and IT Help Desks) about Windows crashes/hangs and how to deal with these particular problems.
In this video, we discuss why the need for additional vertical screen space has become more important in recent years, namely, due to the transition in the marketplace of 4x3 computer screens to 16x9 and 16x10 screens (so-called widescreen format). …
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…

972 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question