Lab 09 - Memory, CPU and Network Monitoring (Windows)
Objectives
- Find the root cause if the system runs out of memory with Task Manager, Windows Performance Recorder, Windows Performance Analyzer, Visual Studio, VMMap.
- Monitor the CPU usage with Task Manager, Windows Performance Recorder, Windows Performance Analyzer.
- Check the amount of network traffic generated by processes with Task Manager, Windows Performance Recorder, Microsoft Network Monitoring, Wireshark.
You can download the Windows 10 VM via OneDrive.
If you need to use VirtualBox, you can use this .ovf version to import the VM (just on OneDrive) OneDrive.
There is also the option to download as a torrent ep_win10_vm.7z.torrent.txt. DokuWiki is not configured to accept .torrent files so remove the .txt extension. After that, you know what to do…
Alternatively, you can install the following on your own Windows machine:
- ADK - make sure to check Windows Performance Analyser and Windows Performance Recorder.
- Visual Studio Community Edition - select C++ development.
Proof of Work
Before you start, create a Google Doc. Here, you will add screenshots / code snippets / comments for each exercise. Whatever you decide to include, it must prove that you managed to solve the given task (so don't show just the output, but how you obtained it and what conclusion can be drawn from it). If you decide to complete the feedback for bonus points, include a screenshot with the form submission confirmation, but not with its contents.
When done, export the document as a pdf and upload in the appropriate assignment on Moodle. Remember, the cut-off time is 15 minutes after the lab ends.
Contents
Introduction
The Windows operating system contains plenty of built-in tools to analyze its resource usage. The most famous one is probably the Windows Task Manager, as it highlights resource usage of individual processes and gives admins and users the option to kill any misbehaving ones.
The Performance Monitor and Resource Monitor are two additional tools that admins and experienced Windows users may use to analyze performance or any resources related issues on Windows machines.
01. RAM Monitoring
Processes are dynamically allocating and using memory. Thus, it is possible to have memory allocation spikes. Task Manager shows you the amount of memory allocated to a process, by checking the Peak Working Set value in the Details tab. We can notice that the Peak Working Set can be sometimes significantly greater than the Working Set.
What can we do if the system runs out of memory, but we do not know what causes this?
Let's imagine a situation when a system encounters issues if some conditions are met, and these conditions can be reproduced. To find out the root cause of this problem, we can start the Windows Performance Recorder tool. We need to select the following profiles for performance recording: Heap usage, Pool usage and VirtualAlloc usage. Moreover, we need to make sure that the detail level is set to verbose and the logging mode selected is for memory.
Following the steps below, we can highlight how such a situation should be treated:
| Part 1: Emphasize memory usage for each process | |
|---|---|
| 1. Run, in parallel with the Windows Performance Recorder application, a program that allocates memory for a while and then stops. | |
| 2. Save the capture and open it in Windows Performance Analyzer. | |
| 3. Right click on the Memory section and select the option to Add all Memory graphs to Analysis View. | |
| 4. Scroll down until you find the Virtual Memory Snapshots graph, which shows you the memory usage for all processes. |
Going further, let's assume that we did not find any memory leaks for our program and the memory used by it gets successfully freed at the end.
How can we determine which part of the program is responsible for generating a memory spike?
A solution to this question can be achieved by using another tool from the Sysinternals suite, more precisely VMMap. With this tool, we can view a process's memory allocations and usage.
| Part 2: Emphasize memory spike of a process | |
|---|---|
| 1. Go to Options → Configure Symbols and make sure the paths are set correctly to point to the Microsoft Symbol Server and to the program's source files. | |
| 2. Click OK and navigate to File → Select Process. | |
| 3. Select the Launch and trace a new process tab, choose the corresponding executable application and the directory where it will run. | |
| 4. Click OK and let the program run. | |
| 5. To view the latest memory allocations, you need to click on the Heap row in the upper-part of the VMMap tool, and hit F5 (refresh) from time to time. | |
| 6. Select one memory allocation from the bottom-part of the VMMap tool and press the Heap Allocations button, located in the bottom right corner. | |
| 7. Press the Stack button to observe where the allocation occurred. By clicking on the Source button, we can view the actual code for the allocation. |
02. CPU Monitoring
Let's consider the same scenario as the one presented in the previous section.
Monitoring the CPU usage presents similar issues to the ones encountered when monitoring the memory usage. Task Manager can help us to find out the current CPU usage for a process.
How can we catch an event when the CPU usage briefly spikes up and then goes back to normal?
Using Task Manager, we would need to continuously have someone watching what is happening, to catch the moment when the spike occurs. To overcome this limitation, we can use Windows Performance Recorder, by selecting the CPU usage profile.
Following the steps below, we can highlight how such a situation should be treated:
| Emphasize the CPU usage of a program | |
|---|---|
| 1. Run, in parallel with the Windows Performance Recorder application, a program that generates CPU usage for a while and then stops. | |
| 2. Save the capture and open it in Windows Performance Analyzer. | |
| 3. Right click on the Computation section and select the option to Add all Computation graphs to Analysis View. | |
| 4. The CPU Usage graph shows the impact of our program and helps us to determine who is generating this load. |
03. Network Monitoring
As you probably already know, the easiest and fastest way to monitor the amount of network traffic generated by a process on a Windows operating system is through using Task Manager.
However, if the process generating the network activity is unknown, we can use Windows Performance Recorder, by selecting the Networking I/O activity profile. After we save the capture and open it in Windows Performance Analyzer, we will observe that the information offered is for the total use of the network, rather than per process statistics.
Due to this reason, we are calling upon another tool developed by Microsoft, more precisely Microsoft Network Monitor. After we install it, start it using “Run as administrator” and select the network interface through which the traffic is expected to pass (cable, wifi, etc.), we will be able to capture the frames.
Last but not least, another well-known tool that you should already be familiar with from the Linux network monitoring lab is Wireshark. This can be used for displaying all traffic generated on a HTTP connection (it can also be HTTPS, as long as we control the server, but this is not in the scope of this tutorial).
Tasks
01. [30p] RAM Monitoring
RAM Investigation
Using Windows Performance Recorder, run a program (MemoryLeak.exe) that allocates 1MB of memory every 100 milliseconds for a while and then stops. After the program stops, save the capture, open it in Windows Performance Analyzer and analyze the Virtual Memory Snapshots graph. What conclusion can you draw by looking at the memory usage of the process that is running our program?
Using VMMap, inspect the memory spikes generated by running the same program.
⠀
RAM Cleaning
Previously we identified that a given program allocated memory and did not free it, which started exhausting our resources. If we still want to run that program, and we do not want to leave it running uninterrupted, we can try “cleaning” our RAM memory during its execution and hope that it helps. Similar with Linux, where we drop caches, in Windows we can use a tool called RAMMap to inspect our memory in detail and free space in RAM.
After starting the program you should see something similar to the image below.
Let's now try to use RAMMap to free memory. In the document you can add just two images, a before-after of running all empty routines. Follow the steps below:
- Start RAMMap and position it on the left side of your screen
- Start Task Manager and position it on the right side of your screen
- Start several applications to get your RAM up to at least ~70%
- From the highlighted Empty tab, run every empty routine from top to bottom and inspect the total in Task Manager
Sounds good, but what is a disadvantage of cleaning our RAM too often? Think about performance.
02. [40p] CPU Monitoring
First of all, monitor the CPU usage of the CPUUsage process, using both Task Manager and Windows Performance Recorder.
Going further, we want to analyze EvenimenteProcMon program, which has the purpose of integrating your messages with Process Monitor, so these can be viewed as the process unfolds. It is necessary to understand any code, not perfectly, but at least to get the big picture of what is going on.
A ProcessMonitor class with 5 functions was created:
- OpenProcMon opens up a handle for the Process Monitor's message interface.
- CloseProcMon closes this handle.
- ProcMonLog writes the message that is passed as a parameter to the Process Monitor interface.
- MyProcMon is the class constructor. It is called when a MyProcMon object is declared.
- ~ MyProcMon is the class destructor. It is called to destroy the MyProcMon object.
The code below highlights that it was declared globally:
MyProcMon __procMon;
This means that at the start of the process, before executing the main function, when the global variables are initialized, our class instance will be constructed along with the implicit handle for the Process Monitor message interface. The handle is closed when the object is destroyed, after the program's execution ends.
Another class was declared, ProcMonLogFunc, with the purpose of highlighting when entering and leaving a function. This led to defining the following macro, which declares a ProcMonLogFunc object and passes it the name of the current function as a parameter.
#define DBGTRACE_FN_ () ProcMonLogFunc __my_log __ (__ FUNCTIONW__)
Start Process Monitor and change the filter to ProcessName contains EvenimenteProcMon. Select the profiling button as shown below:
After running the program, the Process Monitor tool will generate a capture containing multiple details. We should notice messages such as Output: =⇒ Func1 and Output: ⇐= Func1, with the associated timestamps for these events in the Time of Day column. The difference between these times indicates how long the execution took for Func1, expressed in hundreds of nanoseconds.
As it is inefficient to calculate by hand the times for each function, we can save the output in a .csv format, by going to File → Save and choosing the “Comma-Separated Values” option. The generated file will look like this:
"4:42:07.1846936 PM","EvenimenteProcMon.exe","6352","Debug Output Profiling","","","Output: ==>main" "4:42:07.1848812 PM","EvenimenteProcMon.exe","6352","Debug Output Profiling","","","Output: Acesta e logul meu 1" "4:42:07.1848883 PM","EvenimenteProcMon.exe","6352","Debug Output Profiling","","","Output: ==>Func1" "4:42:07.1848955 PM","EvenimenteProcMon.exe","6352","Debug Output Profiling","","","Output: <==Func1" "4:42:07.1848990 PM","EvenimenteProcMon.exe","6352","Debug Output Profiling","","","Output: ==>Func2" "4:42:07.1849038 PM","EvenimenteProcMon.exe","6352","Debug Output Profiling","","","Output: <==Func2" "4:42:07.1849069 PM","EvenimenteProcMon.exe","6352","Debug Output Profiling","","","Output: ==>Func3" "4:42:07.1849105 PM","EvenimenteProcMon.exe","6352","Debug Output Profiling","","","Output: <==Func3" "4:42:07.1849148 PM","EvenimenteProcMon.exe","6352","Debug Output Profiling","","","Output: Acesta e logul meu 2" "4:42:07.1849184 PM","EvenimenteProcMon.exe","6352","Debug Output Profiling","","","Output: <==main"
Create a simple parser in Python to find out easier the total time spent in every function. If you only want to take into account the CPU usage, you need to have logging messages before and after every I/O operation, in order to not count in their time.
03. [30p] Network Monitoring
We want to check the network traffic generated by the Winhttp.exe file (a program that downloads putty.exe; it is located in the Debug folder, after successfully running the code). By looking at its content, it can be noticed that it makes a request to www.sociouman-usamvb.ro.
Monitor the network traffic generated by Winhttp.exe using Task Manager, Windows Performance Recorder and Microsoft Network Monitor.
Using Wireshark, capture all the frames generated after running this program. Is it possible to extract the conversation data from the packet exchange? Justify your answer.
- Click the Start button and run Winhttp.exe. After Winhttp.exe stops, click the Stop button in Wireshark.
- Use the ping command to get the IP address of the previously mentioned URL.
- Switch back to Wireshark and add a filter for ip.addr == <ip_address> (make sure to use the IP address identified using the ping command).
- Right click on the GET /documents request and choose Follow → TCP Stream.
- In the bottom part of the Wireshark window, at the ”Show and save data as” option, choose “Raw”. Save the capture using the “Save as” button.
- Use Notepad++ to open the .PDF file and remove the headers (GET request and HTTP response).
- Save it, close Notepad++ and double-click on the newly saved .PDF file.
04. [10p] Feedback
Please take a minute to fill in the feedback form for this lab.
