How to Capture Windows Startup, Shutdown, Sleep, Hibernate, or Reboot Traces/Logs

The Windows Performance Toolkit is a part of the Windows 7 SDK, but you won’t need to install the entire SDK to get the WPT installation files. Download - http://msdn.microsoft.com/en-us/windowsserver/bb980924.aspx and you only need to check the “Windows Performance Toolkit” checkbox under the “Redistributable Packages”. The downloaded .MSI files will be located (by default) in C:\Program Files\Microsoft SDKs\Windows\v7.1\Redist\Windows Performance Toolkit

Disable the Paging of the Kernel Executive on x64 Windows:
If you have a 64bit installation of Windows, you will need to modify the registry to enable full tracing to work properly. Open regedit and browse to KEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management, double-click the "DisablePagingExecutive" value, and change it from "0" to "1". Click "OK" to save the value:

• Creating a BOOT trace:

Type following command from Admin command prompt:

Code:

xbootmgr –trace boot -traceFlags LATENCY+DISPATCHER+DISK_IO_INIT+NETWORKTRACE+MEMINFO+POWER+PERF_COUNTER+PRIORITY+REGISTRY+FILE_IO+FILE_IO_INIT -postBootDelay 300 -stackWalk Profile+ProcessCreate+CSwitch+ReadyThread+Mark+ThreadCreate+DiskReadInit+DiskWriteInit+DiskFlushInit+RegSetValue+RegCreateKey+RegSetInformation -resultPath C:\Boot_Trace

This command will cause your machine to shut down and reboot automatically. Log in as soon as possible to minimize the size of the resulting trace file. Once logged in, the system will present a dialog box letting you know that it is waiting 120 seconds (it will count down) before finishing the trace. DO NOT use your computer to do anything during this time – let the countdown finish and trace files generate:



Once the trace is complete, you will find a large .ETL file and a log file in C:\Boot_Trace.

• Creating Shutdown traces:

xbootmgr –trace shutdown -traceFlags BASE+LATENCY+DISK_IO_INIT+DISPATCHER+DRIVERS+FILE_IO+FILE_IO_INIT+NETWORKTRACE+PERF_COUNTER+POWER+PRIORITY+REGISTRY -resultPath C:\Shutdown_Trace

• Creating a REBOOT trace: Type command:

xbootmgr –trace rebootCycle -traceFlags BASE+LATENCY+DISK_IO_INIT+DISPATCHER+DRIVERS+FILE_IO

Once the system restarts a third time, log in as soon as possible. This time, the trace will finalize:

Once the trace is complete, you will find a large .ETL file and a log file in C:\Reboot_Trace.