What's My Boot?: Tool for investigating boot, suspend, and hibernate times and Windows readyBoot

This tool was written to investigate the information that Microsoft Windows Desktop OS's store about boot-time performance, and attempts to improve that performance with ReadyBoot.

Microsoft does not document the format currently, but these tools represent the best efforts to date to extract information about them.

As explained my the book “Windows System Performance Through Caching”, recent versions of the Microsoft Windows operating systems record file read patterns and timing from system boots. This infomation is stored in the Windows Event Log. Microsoft does not document the definitions of most of the items recorded, however there exists definitions for a few of them and we can piece together a few more.

In Windows 7, Microsoft introduced ReadyBoot. ReadyBoot is a pre-caching technique to speed up the time it takes to boot up.

With ReadyBoot enabled (it is on by default), file capture traces are made during the boot process. The most recent 5 traces are stored in files ending in a .FX file extension (the format of FX files is also undocumented). Around 60 seconds after the boot is complete, the SuperFetch service will save off the latest trace and create a new boot plan.

The Boot Plan, which is stored in a compressed form in the Windows Registry (also undocumented, but better understood anyway) is then used during the boot process to cause needed files to be read into memory before they are actually needed, speeding up the time to complete the boot.

This tool reads the history of boot infomration that is retained in the Windows Event Logs and analyzes them. Trending graphs are displayed, and the full details are available at a click of the mouse.

This information may be used to better understand how ReadyBoot operates. It may also be of interest to understand, at a high level, which phase of booting is responsible for a system that boots too slowly. While additional, more complicated, testing with other tools may be required to diagnose a boot issue, with this simple tool you might be able to tell where to start looking.

Usage

WhatsMyBoot is a GUI tool. It consists of a single exe file and has no installer. The program requires .NET 3.5, and must be run with administrative rights in order to read the event log.

When you lauch the tool and click the button to read the data, WhatsMyBoot will analyze this data and display three time-line graphs showing the performance data.

The timings of the records are correlated in the display, with the oldest events on the left and newest on the right. In the image above, you can see how the boot time on this system was improving with subsequent reboots.

Start with the bottom graph. This graph shows the amount of time spent in the three primary phases of each reboot.

• OS Loader is the first phase, and represents the amount of time for the boot loader to load in the OS kernel, before OS initialization. From a visual standpoint, this phase roughly runs from when the Bios message appears on the screen until the message that windows is loading appears. Because all that is occurring is a single file load while single-threaded, the amount of time it takes for this phase to complete is fairly stable.
• Main Boot Path is the second phase, and represents the amount of time for the kernel to initialize and then load and initialize boot-time required drivers and devices, non-boottime drives, and services (other than delay start services). From a visual standpoint, [ENTER INFO]
• Post Boot Phase is the third phase, and is intended to represent the amount of time to complete postponed booting operations. This includes the loading of additional services and system processes. Visually, this phase begins around when the windows desktop manager appears (preparing to logon). This phase ends when the system CPU is measured as being relatively idle for a 10 second period. Because this is used to declare the end of the phase, the ammount of time recorded for this phase will dramatically be affected by a user logging in right away. When performing boot testing, you should let the system set idle for at least 70 seconds before logging in, to prevent affecting the test results.

The middle graph shows the amount of ReadyBoot Prefetch data, or alternativly the amount of time to read in the Prefetch Data, used in a given boot.

The top graph shows analysis of the ReadyBoot performance. By default, three categories of I/O data are shown:

• Cache Hits represents the amount of ReadyBoot precached data read in that was later used during the boot.
• Wasted Cache represents the amount of ReadyBoot precached data read in that was not needed later during the boot.
• Cache Misses represents the amount of data that was needed during the boot but was not precached.

Note:On many systems, there will be far more entries in the top graphic than the others. Those "extra" entries occur when the system re-enters a full running state from sleep or hibernation. Those are not full boot scenarios, and the diagnostics used to populate the lower two graphs are not recorded in the system.

Click on any item to reveal the underlying record details for the event.



Version 2.0 Update

Version 2 of the tool is updated to also analyze shutdown and suspend/hibernate and Resume records, including the records for the Windows 8 "fast boot". An example screen shot from version 2 is below:



What does WhatsMyBoot cost?

TMurgent believes in giving back to the community.   WhatsMyBoot is free for for use by all.

What OSs will it run on?

The tool will run on Windows 7, and probably Windows 8 when that comes out. There are only 32-bit versions of the tools, but they work equally well on x64 systems.

How do I install these tools?

No installer. Just download, unzip, read the readme, and copy the exe somewhere convenient.

Are there more free tools?

TMurgent has a bunch of tools on this page. Usually they are free, unless you are a Software Vendor. Tools for performance have a segregated list here.

Where Can I download the tools?

Here is a link to the ZIP package:    WhatsMyBoot.zip (size? MB )

Where Can I buy the book to learn more?

The book, “Windows System Performance Through Caching”, will be published through Lulu, and you can find it from this page when published.