Dan McKinley
Math, Programming, and Minority Reports

    #
    # trim-perflog.msh
    #   This pares down a set of enormous perfmon logs to a
    #   size that can be managed by the Microsoft LogParser.
    #
    #   This finds the column indices that we're interested in,
    #   then runs through each line in the input CSV file(s)
    #   and pulls them out.
    #
    
    # The counters in the perfmon trace that we're interested in.
    #
    $counters =
    "(PDH-CSV 4.0) (Eastern Standard Time)(300)",
    "\\machine\.NET CLR Exceptions(w3wp)\# of Exceps Thrown / sec",
    "\\machine\.NET CLR LocksAndThreads(w3wp)\Contention Rate / sec",
    "\\machine\.NET CLR Memory(w3wp)\% Time in GC",
    "\\machine\.NET CLR Remoting(w3wp)\Remote Calls/sec",
    "\\machine\Process(w3wp)\Page Faults/sec",
    "\\machine\Process(w3wp)\% Processor Time",
    "\\machine\Process(w3wp)\% User Time",
    "\\machine\Process(w3wp)\% Privileged Time",
    "\\machine\Process(w3wp)\Private Bytes";
    
    # Prettier names for the counters.
    #
    $columnAlias = "time", "exceptionsPerSecond",
    "contentionPerSecond", "pctTimeInGC",
    "remoteCallsPerSecond", "pageFaultsPerSecond",
    "pctProcessorTime", "pctUserTime",
    "pctPrivelegedTime", "privateBytes";
    
    # Returns an array that contains the index of each of the
    # $counters in the csv.
    #
    function getPerflogIndices
    {
        param([System.String]$columns)
    
        $tokens = $columns.Split(',');
        for($i = 0; $i -lt $tokens.Length; $i++)
        {
            $t = $tokens[$i];
            $t = $t.Substring(1, $t.Length-2);
            $index = -1 ;
            for($j = 0; $j -lt $counters.Length; $j++)
            {
                if($t -eq $counters[$j])
                {
                    $index = $j;
                }
            }
            if($index -ge 0)
            {
                write-object $i;
            }
        }
    }
    
    # writes a CSV line using the values in $array.
    #
    function write-array
    {
        param([System.IO.StreamWriter]$writer, $array)
        $j = 0;
        $last = $array.Length;
        foreach($a in $array)
        {
            $writer.Write($a);
            if($j -ne $last)
            {
                $writer.Write(",");
            }
            $j++;
        }
        $writer.WriteLine();
    }
    
    # Writes a single line to the result CSV file.
    # This requires:
    #    $writer  - The output stream.
    #    $ln      - A single line read from
    #                the input stream.
    #    $indices - The column indices of the
    #                  subject perfmon counters.
    #
    function write-csv-line
    {
        param([System.IO.StreamWriter]$writer,
           [System.String]$ln, [System.Object[]]$indices)
    
        $vals = $ln.Split(',');
        $j = 0;
        $last = $indices.Length - 1;
        foreach($i in $indices)
        {
            $writer.Write($vals[$i]);
            if($j -ne $last)
            {
                $writer.Write(",");
            }
            $j++;
        }
        $writer.WriteLine();
    }
    
    # Trims down the input CSV file. If $names is True,
    # writes the names of the columns as the first line
    # in the output.
    function trim-perflog
    {
        param([System.IO.FileInfo]$in, [System.Boolean]$names)
    
        $r = $in.OpenText();
        $ln = $r.ReadLine();
        $indices = getPerfLogIndices $ln;
    
        $wr = [System.IO.File]::AppendText($out);
        if($names)
        {
            write-array $wr $columnAlias;
        }
        while($r.Peek() -ge 0)
        {
            write-csv-line $wr $r.ReadLine() $indices;
        }
        $wr.Close();
    }
    
    $out = "c:\perflogs\output.csv";
    
    trim-perflog c:\perflogs\prod_000005.csv True
    trim-perflog c:\perflogs\prod_000006.csv False
    trim-perflog c:\perflogs\prod_000007.csv False

  

    // Performs a range search on the current
    // thread's stack.
    //
    template<class search_command>
    inline void SearchStack(ULONG64 pattern)
    {
        TEB_INTERNAL teb = {0};
        HRESULT hr = GetCurrentTEB(&teb);
        if( FAILED(hr) )
        {
            Out("Could not retrieve the TEB.\n");
            return;
        }

        ULONG64 esp = 0;
        hr = m_Registers->GetStackOffset(&esp);
        if( FAILED(hr) )
        {
            Out("Could not read the stack pointer.\n");
            return;
        }
        Out("Thread %d:\n", teb.dwThreadId);

        // Thunk the dword to a 64-bit integer.
        // Otherwise we'll take the previous dword
        // field in the TEB structure with us into
        // the Search call.
        ULARGE_INTEGER li = { teb.dwStackBase, 0L };
        this->SearchPointers<search_command>(
             pattern,
             esp,
             li.QuadPart);
    }

    // Searches for the pattern with a level
    // of indirection.
    //
    template<class search_command>
    inline void SearchPointers(ULONG64 pattern,
         ULONG64 start, ULONG64 end)
    {
        search_command sc;
        int hits = 0;
        for(ULONG64 offs = start;
            offs <= end;
            offs += m_PtrSize)
        {
            ULONG64 ptr = 0;
            HRESULT hr = m_Data->ReadPointersVirtual(
                1L, offs, &ptr);
            ULONG64 ptrVal = 0;
            hr = m_Data->ReadPointersVirtual(
                1L, ptr, &ptrVal);
            if( hr == S_OK && ptrVal == pattern )
            {
                if( sc.HandleMatch(ptr) )
                {
                    ++hits;
                }
            }
        }
        sc.ShowResults(hits);
    }

  

    // Some definitions that correspond to the managed
    // SampleApp.Colors enum.
    typedef ULONG Color;
    const Color COLOR_RED = 0;
    const Color COLOR_GREEN = 1;
    const Color COLOR_BLUE = 2;
    const Color COLOR_PURPLE = 3;
    const Color MAX_COLOR = COLOR_PURPLE;

    PCSTR g_szColorNames[] = { "Red", "Green",
        "Blue", "Purple" };

    bool IsColor(Color c)
    {
        if( c <= MAX_COLOR )
        {
            return true;
        }
        return false;
    }

    PCSTR ColorName(Color c)
    {
        if( !IsColor(c) )
        {
            return NULL;
        }
        return g_szColorNames[static_cast<int>(c)];
    }

  

    // ------------------------------------------------------
    // mtypes.h
    //        Some base classes for dealing with instances
    //        of managed objects.
    //
    #pragma once

    template<class object_fields>
    class ManagedInstance
    {
    protected:
        object_fields m_Fields;
        ULONG64 m_offset;
        bool m_valid;

        // Can be used by derived classes can to refer
        // to this class.
        typedef ManagedInstance<object_fields> base_t;

        // Constructor - pass the offset of the managed
        // object. Check the result of IsValid() before
        // using an instance derived from this class.
        ManagedInstance(ULONG64 offset) : m_Fields()
        {
            // Load the data for the fields from the
            // debugee process / memory dump
            IDebugDataSpaces* pData = g_Ext->m_Data;
            m_offset = offset;
            ULONG read = 0L;
            HRESULT hr = pData->ReadVirtual(
                m_offset,
                reinterpret_cast<void*>(&m_Fields),
                sizeof(object_fields),
                &read);
            m_valid = SUCCEEDED(hr) &&
                (read == sizeof(object_fields));
        }

        virtual ~ManagedInstance() {}

    public:
        // Returns true if the object was successfully
        // read from the debugee. Doesn't validate that
        // it actually is a managed object of the desired
        // type, but overridden implementations should
        // do this.
        virtual bool IsValid() { return m_valid; }
    };

    // This can be used as a base class for classes used
    // as the object_fields template parameter.
    class ObjectFields
    {
    public:
        ULONG pMethodTable;
    };

  

    // Represents the fields of a
    // SampleApp.ArbitraryType instance.
    class ArbitraryTypeFields
         : public ObjectFields
    {
    public:
        Color col;
        ULONG id;
    };

    // Represents a single ArbitraryType instance.
    class ArbitraryType :
        public ManagedInstance<ArbitraryTypeFields>
    {
    public:
        ArbitraryType(ULONG64 offset)
            : base_t(offset) {}
        virtual bool IsValid();
        Color GetColor() { return m_Fields.col; }
    };

    // Returns true if the loaded data is a valid
    // ArbitraryType instance.
    bool ArbitraryType::IsValid()
    {
        if( base_t::IsValid() &&
            IsColor(m_Fields.col) )
        {
            return true;
        }
        return false;
    }

  

    class AtStatCmd : public SearchCommand
    {
    protected:
        typedef map<Color, int>  CountMap_t;
        CountMap_t m_counts;

    public:
        virtual void ShowResults(int totalHits);
        virtual bool HandleMatch(ULONG64 offset);
        AtStatCmd();
    };

    bool AtStatCmd::HandleMatch(ULONG64 offset)
    {
        ArbitraryType at(offset);
        if( at.IsValid() )
        {
            Color c = at.GetColor();
            g_Ext->Out("%08I64x : %s\n",
               offset, ColorName(c));
            m_counts[c]++;
            return true;
        }
        return false;
    }