Examine system events
In order to start examining an event file, the easiest way is to name it with a .kev (kernel event) extension. Files with this extension are automatically bound to the System Profiler editor.
The System Profiler editor is the center of all of the analysis activity. It provides different visualization options for the event data in the log files:
The System Profiler editor panes include the following:
The IDE generates an overview of the CPU and trace event activity over the period of the log file. This overview contains the same information displayed in the Overview view.
The process activity (amount of time spent RUNNING or READY, number of kernel calls) displayed in the Summary pane contains the same information as can be extracted by drilling down for a particular time range of the event log using the General Statistics and Event Owner Statistics views.
The Summary pane is the default. To choose one of the other types, right-click in the editor, then select , or click this icon:
You can choose a specific display type by from the dropdown menu associated with this menu item or icon.
For the CPU Activity pane, you can display the data using your choice of graph by right-clicking the graph and choosing Graph Type. Select one of the graph types from the list:
3D versions of the charts are also available.
Each of these visualizations is available as a "pane" in a stack of "panes." Additionally, the visualization panes can be split -- you can look at the different sections of the same log file and do comparative analysis.
All panes of the same stack share the same display information. A new pane inherits the display information of the previous pane, but becomes independent after it's created.
To split the display, right-click in the editor, then select , or click this icon:
You can lock two panes to each other. From the Split Display submenu, choose the graph you want to display in the new pane, or click this icon:
 |
You can have a maximum of four panes displayed at once. |
A number of different features are available from within the editor:
If an owner has children (e.g. a parent process with threads), you'll see a plus sign beside the parent's name. To see a parent's children, click the plus sign.
For example, to view only processes that are sending pulses, choose to open the Filters view. Select the Events tab, and then replace type filter text with MsgSend. Click Deselect All, and then click the applicable MsgSend events that your search found. The selected events are added to your display dynamically.
),
or right-click in the editor and choose
Bookmark from the menu.
These bookmarks show up in the Bookmarks view and can represent a range of time or a single particular event instance.
You can toggle IPC tracing on/off by clicking this button in the toolbar:
By default, this displays the IPC trace arrows for all event owners. You can choose to display only the arrows for the selected owners by choosing Selection from the button's dropdown menu.
)
lets you display labels in the timeline; open the button's dropdown menu
and select the type of labels you want to display:
If you haven't expanded a process in the display, the labels for all its threads are displayed. By default, no labels are displayed.
Within the editor, you can select either of the following:
To select a single owner, simply click the owner's name. To unselect an owner, press and hold the Ctrl key, then click each selected owner's name.
To select multiple owners, press and hold the Ctrl key, then click each owner's name.
To select a point in time, click an event on the timeline.
To select a range, click the start point on the timeline, then drag and release at the end point.
Or, select the start point, then hold down the Shift key and select the end point.
When zooming in, the display centers the selection. If a time-range selection is smaller than the current display, the display adjusts to the range selection (or by a factor of two).
When zooming out, the display centers the selection and adjust by a factor of two.
When using a preset zoom factor (100% to 0.01%), the display centers the current selection and adjust to the new factor.
There are various ways to zoom:
You can use these keys to scroll through time:
| To move: | Use this key: |
|---|---|
| The selection to the left by one event | Ctrl-<-- |
| The selection to the right by one event | Ctrl---> |
| The display to the left | <-- |
| The display to the right | --> |
| The selection for the current owner to the left by one event | Ctrl-Shift-<-- |
| The selection for the current owner to the right by one event | Ctrl-Shift---> |
You can use these keys to scroll through the owners:
| To move the display: | Use this key: |
|---|---|
| Up by one owner | /\ |
| Down by one owner | \/ |
| Up by one page (horizontal scrollbar thumb size) | Page Up |
| Down by one page (horizontal scrollbar thumb size) | Page Down |
| To the top of the owner list | Home |
| To the bottom of the owner list | End |
When you pause your mouse pointer over an owner or an event, you'll see relevant information (e.g. PID, timestamps, etc.).