Tracing Windows95 Min Zhou and Alan Jay Smith Rep ort No. UCB/CSD-99-1037 January 1999 Computer Science Division EECS University of California Berkeley, California 94720 Tracing Windows95 y Min Zhou and Alan Jay Smith January 1999 dicult and imp ortant part of trace based analy- Abstract sis. [Smit81] Most published research on system b ehavior and Multi-user time-sharing computer systems such workload characterization has b een based on ei- as UNIX systems and mainframe computer sys- ther Unix systems or large, usually IBM or IBM- tems have b een extensively studied. Much compre- compatible, mainframe systems. It is reasonable to hensive system tracing and related work has b een b elieve that user b ehavior and workloads are di er- done on these systems. [Smit81] [Bake91] [Oust85] ent for PC systems. Further, the asp ects of system [Cost85] [Hans85] Far less system tracing and anal- design most needing study havechanged from the ysis have b een done for p ersonal computers, which mainframes dominant in the 1960s and 1970s, and have already b ecome the most widely used typ e the Unix systems that b ecame so p opular in the of computer. Wehave/had in mind a number of 1980s to the PCs that seem to b e rapidly taking over research studies directed towards the PC environ- many or most asp ects of computing. Windows95 is ment, and accordingly, our rst step has b een to currently the most widely used computer op erating write and run a tracer for such systems. Since the system, and is very similar to the newly released most dominant PC op erating system and architec- Windows98. In this pap er, we describ e our tracer, ture are Microsoft Windows95 and the Intel x86 which runs on Intel Pentium based PCs running based Architecture IA resp ectively,wechose In- the Microsoft Windows95 op erating system. Fol- tel based PCs running Windows95 as our tracing lowing the discussion of our tracing metho dology, target systems. We will call Intel based PCs run- Windows95 op erating system, and a tracing to ol we ning the Microsoft Windows95 op erating system as develop ed for Windows95, we give some descriptive "PC systems" in the rest of this pap er. We note and statistical results based on the traces collected that the newly released Windows98 is very similar from 29 PC users. to Windows95, and we b elieve that user b ehavior and workload characteristics for Windows98 should also b e very similar to those for Windows95. 1 Intro duction We b elieve that traces taken from PC systems will di er from those taken from multi-user time- System tracing is widely used for obtaining re- sharing systems in a numberofways: alistic workloads for computer system analysis and First, the workload on a PC system with a sin- p erformance tuning. It is a standard technique gle activeinteractive user is likely to b e di erent in computer architecture and op erating system re- from the other systems, b oth b ecause there is only search. The traces are often used to characterize one user, and b ecause the applications are likely to the b ehavior of the system as well as the workload b e di erent. The interleaved activityofanumber of represented by the traces, and can b e further used users will di er from the individual streams of activ- in b enchmark development. The traces can also b e ity.Even in the case of a single-user Unix worksta- applied to trace driven simulation to evaluate var- tion, it is common to havemultiple pro cesses active ious algorithms and design-prototyp es. Obtaining at a given time. Further, we b elieve that PC users a set of valid and suitable traces is often the most are likely to run much shorter and less computa- The authors' research has b een supp orted in part by the tionally intensive jobs. The PCs are more likely to State of California under the MICRO program, and by Mi- b e used by the users for their private work. This is crosoft, Fujitsu Micro electronics, Cirrus, Toshiba, Quantum, very much the case for those home PC users. Sun Microsystems, and Intel Corp oration. y Computer Science Division, EECS Department, Univer- Second, time-sharing UNIX op erating systems sity of California, Berkeley, CA 94720-1776 and Windows95 op erate di erently. Unlike UNIX, 1 Windows95 was designed to b e backward compati- metho dology, our tracer design implementation, as ble with old software applications including old MS- well as the tracer installation and exp eriments. We DOS applications and 16-bit Windows applications. give information ab out the users and the systems For instance, Windows95 uses an improved version b eing traced in the same section. Section 4 dis- of the MSDOS-FAT format le system, and Win- cusses the description and the statistics of the traces dows95 also supp orts several di erent memory mo d- that we collected. The trace description is followed els. Windows95 is not a true preemptive op erating by the discussion of the tracer overhead and limi- system nor is it a secure op erating system, and it tations. Finally, section 5 summarizes our tracing is not as stable as larger time-sharing systems as and gives the directions of our future work. In the well. [Schu95] [Oney96] [Petz96] [Nort97] We will app endices, we provide an overview of Windows95 further discuss Windows95 and its le system, vir- and a more detailed discussion of the trace formats. tual machine, memory system and pro cess schedul- ing in the next ma jor section. 2 Related Work Third, time-sharing systems and PC system do not always share the same typ e of application soft- In this section, we discuss some previous related ware. Large time-sharing system applications are system tracing work. We concentrate on related more likely to b e scienti c computation oriented or work by these others and others at Berkeley, but enterprise server software. The most p opular UNIX cite some other work as well; this is a small fraction workstation testing workload are the SPEC b ench- of the dozens to hundreds of trace based system mark suite [Sp ec98] and TPC database b enchmark studies. We also brie y highlight the ma jor di er- suite [TPC98]. PC software applications are more ences and similarities b etween those related tracers likely to b e graphic user interface GUI oriented, and our Windows95 tracer. p ersonal information pro cessing intended, and more interactive with the users. MS-Word and Lotus-123 2.1 Tracing UNIX Workstations and are such examples. Finally, hardware and software develop ers of Mainframe Computers workstation and mainframe computers often em- Da Costa [Cost85] presented a BSD 4.2 UNIX phasize such issues as p erformance, capacity and le system tracing package. See also [Zhou85]. reliability. In comparison, PC develop ers are more Ousterhout et al [Oust85] [Bake91] traced the concerned with cost, convenience, p ower consump- Sprite distributed le system via kernel instrumen- tion, etc. tation. In most cases, UNIX tracers were imple- For this pro ject, wehave designed and devel- mented via mo difying the UNIX le system kernel. op ed a Windows95 PC system tracer, WMonitor, Zivkov et al. [Zivk96] used several sets of main- which collects traces of user and le system activ- frame computer traces to characterize disk refer- ity. In this part of the pro ject, our ob jective has encing patterns and study disk caching. Their DB2 also b een to characterize the PC workload. Our disk reference traces were collected from IBM DB2 tracing guideline is to achieve a reasonable compro- customer sites using DB2PM, an IBM DB2 p er- mise among the requirements of comprehensiveness, formance monitoring package, and GTF, an IBM exibility, minimum user interference and simplicity general tracing package. The IMS disk referencing of analysis. traces were generated from IMS online system log The selection of users traced will have a signif- les. The GCOS traces were collected by instru- icant impact on the characteristics of the workload menting the GCOS op erating system. collected. In this pap er, we rep ort on traces col- The ab ove pro jects were all primarily fo cused on lected from 29 real users, including engineers, sci- the le systems of time-shared multi-user computer entists, managers, home users and scho ol students, systems. Similarly to our Windows95 le system using a variety of system con gurations. Since we tracing, these le system tracing pro jects were also are interested in PC workload characteristics, which done at the logical level, and le system call func- include those of users and le systems, our trace tion names and logical addresses were recorded with events include user inputs, application switches, and time stamps. Most sets of traces were similar to our le system calls. traces, whichcover the le system activities over a The rest of this pap er is organized as follows: p erio d of a few days to one week. Our tracing is dif- Section 2 discusses and compares some previous ferent from other tracing pro jects in that our targets related research. Section 3 discusses our tracing 2 counter inside Intel's Pentium pro cessors. Similar are single user PC systems, and our tracing do es not to Intel's \PowerMonitor", Chen et al [Chen96] pre- need to mo dify the kernel co de of Windows95. sented a Windows to ol which studies the Pentium Hanson et al [Hans85] used a mo di ed UNIX pro cessor's p erformance.