Windows Performance Recorder

Windows Performance Recorder
Name	Windows Performance Recorder
Developer	Microsoft
Released	2012
Latest release version	(integrated release cadence with Windows 10)
Operating system	Microsoft Windows
Platform	x86, x64, ARM
Genre	Performance profiling, tracing
License	Proprietary

Windows Performance Recorder is a system-level tracing tool developed by Microsoft for collecting high-resolution performance data on Microsoft Windows systems. It is designed to capture detailed kernel and user-mode events for analysis, enabling performance engineers and system administrators to diagnose latency, CPU usage, disk I/O, and power-related issues. WPR is commonly used alongside other Microsoft diagnostics technologies and is integral to performance investigations in enterprise, embedded, and consumer contexts such as workstations running Windows 10 or servers in Microsoft Azure deployments.

Overview

Windows Performance Recorder provides event-based tracing using the Event Tracing for Windows paradigm native to Microsoft Windows. It records event streams from kernel providers such as the Windows Kernel scheduler, storage stack, and networking stack, as well as from user-mode providers including Internet Explorer, Microsoft Office, and platform components. Designed to interoperate with performance analysis tools used by teams at Microsoft and third parties, WPR facilitates reproducible captures for scenarios ranging from interactive application lag in Microsoft Edge to boot performance regressions on devices certified under Windows Hardware Compatibility Program.

Features and Functionality

WPR supports configurable recording profiles and provides both a graphical user interface and a command-line interface for scripted captures. Common features include high-resolution CPU sampling tied to the Windows Kernel's thread context, stack walking to attribute CPU time to modules such as NTDLL.dll or Kernel32.dll, and stack compression to reduce file size. WPR can collect power and thermal telemetry relevant to Intel/AMD processor behavior, storage traces from subsystems used by SQL Server, and network traces relevant to Internet Information Services. The tool integrates with symbol resolution services and supports private and public symbol stores used in enterprises and by teams at Microsoft to translate addresses into function names during analysis.

Architecture and Data Collection

At its core, WPR leverages Event Tracing for Windows providers and the Kernel Logger session to stream events to an ETL file that downstream tools parse. The recorder can enable providers such as the kernel memory allocator, the scheduler, or the disk I/O stack, each of which emits events structured by provider manifests maintained by teams like those responsible for the Windows Kernel and I/O Manager. The architecture separates capture from analysis: WPR minimizes on-target processing to reduce perturbation, while heavy-weight symbol resolution, stack unwinding, and correlation are deferred to analyzers used by teams at Microsoft or third-party performance consultancies. Captured ETL artifacts include timing, thread IDs, process IDs for processes such as Explorer.exe and svchost.exe, and provider-specific payloads for components like WinHTTP.

Use Cases and Workflows

Typical workflows begin with selecting a predefined WPR profile tuned for scenarios such as boot trace, application responsiveness, or GPU activity seen in systems running DirectX workloads. Engineers profiling start-up delays in Microsoft Office might enable disk and registry providers, while teams debugging driver-induced freezes would enable kernel stack traces and driver verifier events relevant to vendors like Intel Corporation or NVIDIA Corporation. WPR is used in release validation labs, by support organizations resolving customer reports on systems purchased through OEM channels, and by developers optimizing performance of applications distributed via Microsoft Store. The command-line interface supports reproducible capture scripts integrated into continuous integration pipelines used by product teams at Microsoft and partners.

Integration with Windows Performance Toolkit

WPR is packaged as a component of the Windows Performance Toolkit, which also includes the Windows Performance Analyzer and other utilities maintained by Microsoft. The typical pattern is capture with WPR and analysis with Windows Performance Analyzer to produce flame graphs, CPU usage tables, and disk I/O timelines. Integration points include shared expectations for ETL schema, symbol store configuration used by Visual Studio and WinDbg, and interoperability with lab automation frameworks employed by validation teams within Microsoft and by hardware partners participating in the Windows Hardware Dev Center. This integration enables deep cross-correlation between traces and system configuration data captured during testing.

Common Issues and Troubleshooting

Common issues include large ETL file sizes, missing stack information due to absent symbols, and elevated overhead when enabling aggressive providers. Mitigations include using targeted profiles, configuring enterprise symbol servers used by Microsoft or third-party vendors, and enabling frame pointer capture or compiler-based stack frame metadata in builds produced by teams using MSBuild or Visual Studio. When traces show unexpected idle time or dispatcher anomalies, engineers often correlate WPR captures with system event logs from the Event Viewer and driver update histories from Device Manager. For reproducibility, troubleshooting workflows recommend documenting OS build, driver versions from vendors such as Intel or Realtek, and any third-party security software from companies like Symantec that may inject instrumentation.

Category:Microsoft software