You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/troubleshoot-av-performance-issues-with-wprui.md
+32-36Lines changed: 32 additions & 36 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ ms.author: ewalsh
6
6
ms.reviewer: yongrhee
7
7
ms.service: defender-endpoint
8
8
ms.topic: troubleshooting-general
9
-
ms.date: 01/06/2025
9
+
ms.date: 01/08/2025
10
10
ms.subservice: ngp
11
11
manager: deniseb
12
12
ms.localizationpriority: medium
@@ -23,48 +23,46 @@ ms.custom:
23
23
24
24
## Capture performance logs using Windows Performance Recorder
25
25
26
-
You can use Windows Performance Recorder (WPR) to include additional information in your submission to Microsoft support. WPR is a powerful recording tool that creates Event Tracing for Windows recordings.
26
+
Windows Performance Recorder (WPR) is a powerful recording tool that creates Event Tracing for Windows recordings and allows you to include additional information in your submission to Microsoft support.
27
27
28
28
WPR is part of the Windows Assessment and Deployment Kit (Windows ADK) and can be downloaded from [Download and install the Windows ADK](/windows-hardware/get-started/adk-install). You can also download it as part of the Windows 10 Software Development Kit at [Windows 10 SDK](https://developer.microsoft.com/windows/downloads/windows-10-sdk/).
29
29
30
-
You can use the WPR user interface by following the steps in [Capture performance logs using the WPR UI](/editor/MicrosoftDocs/defender-docs-pr/defender-endpoint%2Ftroubleshoot-performance-issues.md/main/ae28f1cf-14bc-fb9c-5f0c-873a683e907c/?branch=main&branchFallbackFrom=main%2C).
31
-
32
-
Alternatively, you can also use the command-line tool *wpr.exe*, which is available in Windows 8 and later versions by following the steps in [Capture performance logs using the WPR CLI](/editor/MicrosoftDocs/defender-docs-pr/defender-endpoint%2Ftroubleshoot-performance-issues.md/main/ae28f1cf-14bc-fb9c-5f0c-873a683e907c/?branch=main&branchFallbackFrom=main%2C).
30
+
Alternatively, follow the steps in [Capture performance logs using the WPR UI](/editor/MicrosoftDocs/defender-docs-pr/defender-endpoint%2Ftroubleshoot-performance-issues.md/main/ae28f1cf-14bc-fb9c-5f0c-873a683e907c/?branch=main&branchFallbackFrom=main%2C), or use the command-line tool *wpr.exe*[Capture performance logs using the WPR CLI](/editor/MicrosoftDocs/defender-docs-pr/defender-endpoint%2Ftroubleshoot-performance-issues.md/main/ae28f1cf-14bc-fb9c-5f0c-873a683e907c/?branch=main&branchFallbackFrom=main%2C). Both are available in Windows 8 and later versions.
33
31
34
32
### Capture performance logs using the WPR UI
35
33
36
34
> [!TIP]
37
-
> If multiple devices are experiencing this issue, use the one which has the most RAM.
35
+
> If multiple devices are experiencing this issue, try using the one with the most RAM.
38
36
39
37
1. Download and install WPR.
40
38
41
-
2. Under *Windows Kits*, right-click **Windows Performance Recorder**.
39
+
1. Under *Windows Kits*, right-click **Windows Performance Recorder**.
42
40
43
41
44
42
45
43
Select **More**. Select **Run as administrator**.
46
44
47
-
3. When the User Account Control dialog box appears, select **Yes**.
45
+
1.Right-click **Yes** when the User Account Control dialog box appears.
48
46
49
47
50
48
51
-
4. Next, download the [Microsoft Defender for Endpoint analysis](https://github.com/YongRhee-MDE/Scripts/blob/master/MDAV.wprp) profile and save as `MDAV.wprp` to a folder like`C:\temp`.
49
+
2. Next, download the [Microsoft Defender for Endpoint analysis](https://github.com/YongRhee-MDE/Scripts/blob/master/MDAV.wprp) profile and save as `MDAV.wprp` to a folder such as`C:\temp`.
52
50
53
-
5. On the WPR dialog box, select **More options**.
51
+
3. In the WPR dialog box, select **More options**.
54
52
55
53
56
54
57
-
6. Select **Add Profiles...** and browse to the path of the `MDAV.wprp` file.
55
+
4. Select **Add Profiles...** and browse to the path of the `MDAV.wprp` file.
58
56
59
-
7. After that, you should see a new profile set under *Custom measurements*named *Microsoft Defender for Endpoint analysis* underneath it.
57
+
5. A new profile named Microsoft Defender for Endpoint analysis should appear under Custom measurements.
60
58
61
59
62
60
63
61
> [!WARNING]
64
-
> If your Windows Server has 64 GB of RAM or more, use the custom measurement `Microsoft Defender for Endpoint analysis for large servers` instead of `Microsoft Defender for Endpoint analysis`. Otherwise, your system could consume a high amount of non-paged pool memory or buffers which can lead to system instability. You can choose which profiles to add by expanding **Resource Analysis**.
62
+
> If your Windows Server has 64 GB of RAM or more, use the custom measurement `Microsoft Defender for Endpoint analysis for large servers` instead of `Microsoft Defender for Endpoint analysis`. Otherwise, your system consumes a high amount of non-paged pool memory or buffers, leading to system instability. Explore **Resource Analysis** to choose profiles to add.
65
63
> This custom profile provides the necessary context for in-depth performance analysis.
66
64
67
-
8. To use the custom measurement Microsoft Defender for Endpoint verbose analysis profile in the WPR UI:
65
+
6. To use the custom measurement Microsoft Defender for Endpoint verbose analysis profile in the WPR UI:
68
66
69
67
1. Ensure no profiles are selected under the *First-level triage*, *Resource Analysis* and *Scenario Analysis* groups.
70
68
@@ -77,38 +75,36 @@ Select **More**. Select **Run as administrator**.
77
75
5. Select **File** or **Memory** under Logging mode.
78
76
79
77
> [!IMPORTANT]
80
-
> You should select *File* to use the file logging mode if the performance issue can be reproduced directly by the user. Most issues fall under this category. However, if the user cannot directly reproduce the issue but can easily notice it once the issue occurs, the user should select *Memory* to use the memory logging mode. This ensures that the trace log will not inflate excessively due to the long run time.
78
+
> Select **File** to use the file logging mode if you can directly reproduce the performance issue. Most issues fall under this category. However, if you cannot directly reproduce the issue, select Memory to use the memory logging mode. This prevents the trace log from inflating excessively due to long run times.
81
79
82
-
9. Now you're ready to collect data. Exit all the applications that aren't relevant to reproducing the performance issue. You can select**Hide options** to keep the space occupied by the WPR window small.
80
+
7. Now you're ready to collect data. Close all unnecessary applications. Click**Hide options** to keep the space occupied by the WPR window small.
83
81
84
82
85
83
86
-
10. Select **Start**.
84
+
8. Select **Start**.
87
85
88
86
89
87
90
-
11. Reproduce the issue.
88
+
9. Reproduce the issue.
91
89
92
90
> [!TIP]
93
-
> Keep the data collection to no more than five minutes. Two to three minutes is a good range since a lot of data is being collected.
91
+
> Limit the data collection to a maximum of five minutes. Ideally, aim for two to three minutes, as a significant amount of data is being collected.
94
92
95
-
12. Select **Save**.
93
+
10. Select **Save**.
96
94
97
95
98
96
99
-
13. Fill up**Type in a detailed description of the problem:** with information about the problem and how you reproduced the issue.
97
+
11. Fill in**Type in a detailed description of the problem:** with information about the problem and how you reproduced the issue.
100
98
101
99
102
100
103
-
1. Select **File Name:** to determine where your trace file is saved. By default, it's saved to `%user%\Documents\WPR Files\`.
101
+
12. Select **File Name:** to determine where your trace file is saved. By default, it's saved to `%user%\Documents\WPR Files\`.
104
102
105
103
1. Select **Save**.
106
104
107
-
14. Wait while the trace is being merged.
108
-
109
105
110
106
111
-
15. Once the trace is saved, select**Open folder**.
107
+
13. After the trace has been merged and saved, right-click**Open folder**.
112
108
113
109
114
110
@@ -118,15 +114,15 @@ Select **More**. Select **Run as administrator**.
118
114
119
115
### Capture performance logs using the WPR CLI
120
116
121
-
The command-line tool *wpr.exe* is part of the operating system starting with Windows 8. To collect a WPR trace using the command-line tool wpr.exe:
117
+
To collect a WPR trace using the command-line tool wpr.exe:
122
118
123
-
1. Download **[Microsoft Defender for Endpoint analysis](https://github.com/YongRhee-MDE/Scripts/blob/master/MDAV.wprp)**profile for performance traces to a file named`MDAV.wprp` in a local directory such as `C:\traces`.
119
+
1. Download **[Microsoft Defender for Endpoint analysis](https://github.com/YongRhee-MDE/Scripts/blob/master/MDAV.wprp)** performance trace profile as`MDAV.wprp` in a local directory such as `C:\traces`.
124
120
125
-
2. Right-click the **Start Menu** icon and select **Windows PowerShell (Admin)** or **Command Prompt (Admin)** to open an Admin command prompt window.
121
+
1. Right-click the **Start Menu** icon and select **Windows PowerShell (Admin)** or **Command Prompt (Admin)** to open an Admin command prompt window.
126
122
127
-
3. When the User Account Control dialog box appears, select **Yes**.
123
+
1. Select **Yes** in the User Account Control dialog box.
128
124
129
-
4. At the elevated prompt, run the following command to start a Microsoft Defender for Endpoint performance trace:
125
+
1. At the **Command Prompt (Admin)**, run the following command to start a Microsoft Defender for Endpoint performance trace:
130
126
131
127
```console
132
128
@@ -135,22 +131,22 @@ The command-line tool *wpr.exe* is part of the operating system starting with Wi
135
131
```
136
132
137
133
> [!WARNING]
138
-
> If your Windows Server has 64 GB or RAM or more, use profiles `WDForLargeServers.Light` and `WDForLargeServers.Verbose` instead of profiles `WD.Light` and `WD.Verbose`, respectively. Otherwise, your system could consume a high amount of non-paged pool memory or buffers which can lead to system instability.
134
+
> If your Windows Server has 64 GB of RAM or more, use profiles `WDForLargeServers.Light` and `WDForLargeServers.Verbose` instead of profiles `WD.Light` and `WD.Verbose`, respectively. Otherwise, your system consumes a high amount of non-paged pool memory or buffers, leading to system instability.
139
135
140
-
5. Reproduce the issue.
136
+
1. Reproduce the issue.
141
137
142
138
> [!TIP]
143
-
> Keep the data collection no to more than five minutes. Depending on the scenario, two to three minutes is a good range since a lot of data is being collected.
139
+
> Limit the data collection to a maximum of five minutes. Ideally, aim for two to three minutes, as a significant amount of data is being collected.
144
140
145
-
6. At the elevated prompt, run the following command to stop the performance trace, making sure to provide information about the problem and how you reproduced the issue:
141
+
1. At the **Command Prompt (Admin)**, run the following command to start a Microsoft Defender for Endpoint performance trace:
146
142
147
143
```console
148
144
wpr.exe -stop merged.etl "Timestamp when the issue was reproduced, in HH:MM:SS format" "Description of the issue" "Any error that popped up"
149
145
```
150
146
151
-
7. Wait until the trace is merged.
147
+
1. Wait until the trace is merged.
152
148
153
-
8. Include both the file and the folder in your submission to Microsoft support.
149
+
1. Include both the file and the folder in your submission to Microsoft support.
0 commit comments