Question

I’d like to my Windows C++ program to be able to read the number of hard page faults it has caused. The program isn’t running as administrator. Edited to add: To be clear, I’m not as interested in the aggregate page fault count of the whole system.

It looks like ETW might export counters for this, but I’m having a lot of difficulty figuring out the API, and it’s not clear what’s accessible by regular users as compared to administrators.

Does anyone have an example of this functionality lying around? Or is it simply not possible on Windows?

(OT, but isn’t it sad how much easier this is on *nix? gerusage() and you’re done.)

Answer 1

afai can tell the only way to do this would be to use ETW (Event Tracing for Windows) to monitor kernel Hard Page Faults. The event payload has a thread ID that you might be able to correlate with an existing process (this is going to be non-trivial btw) to produce a running per-process count. I don’t see any way to get historical information per process.

I can guarantee you that this is A Hard Problem because Process Explorer supports only Page Faults (soft or hard) in its per-process display.

http://msdn.microsoft.com/en-us/magazine/ee412263.aspx

A page fault occurs when a sought-out
page table entry is invalid. If the
requested page needs to be brought in
from disk, it is called a hard page
fault (a very expensive operation),
and all other types are considered
soft page faults (a less expensive
operation). A Page Fault event payload
contains the virtual memory address
for which a page fault happened and
the instruction pointer that caused
it. A hard page fault requires disk
access to occur, which could be the
first access to contents in a file or
accesses to memory blocks that were
paged out. Enabling Page Fault events
causes a hard page fault to be logged
as a page fault with a type Hard Page
Fault. However, a hard fault typically
has a considerably larger impact on
performance, so a separate event is
available just for a hard fault that
can be enabled independently. A Hard
Fault event payload has more data,
such as file key, offset and thread
ID, compared with a Page Fault event.