Analyzing Data Loss With Readlog (Windows Embedded CE 6.0)
1/5/2010
Each time CeLogFlush.exe or another flushing application flushes the RAM buffer, it writes a data loss counter to the log file. If no data is lost, it writes a zero. If data is lost, CeLogFlush writes a value for the amount of lost data. For example, the following line of output shows a data-loss counter of zero:
================ Data loss counter: 0 bytes lost ===============
When you run Readlog.exe to convert a binary log file to text, Readlog recognizes the data counter, and if data loss occurred, Readlog prints a warning:
WARNING! This log is missing some lost data. Interpret it carefully.
Search the file for the string "Data loss" to find where the loss occurred.
By examining the data loss counters, you can identify what periods of time might be suspicious, and what periods of time you can trust. Typically, if data is lost, then the data is lost from the period of time immediately before the non-zero counter.
In the following example output, you can see the data loss counter shows both periods of no data loss (0 bytes lost) and periods of significant data loss (42948 bytes lost).
0:06:27.460.950 : ThreadMigrate, hProcess=0x23FCBC1A
0:06:27.461.331 : ThreadSwitch, hThread=0x03FD19AE
0:06:27.461.341 : ThreadMigrate, hProcess=0x03FDF002
--:--:--.---.--- : ====== Data loss counter: 0 bytes lost ======
0:06:27.461.598 : ThreadSwitch, hThread=0x23F07A9E
0:06:27.461.606 : ThreadMigrate, hProcess=0x23FCBC1A
0:06:27.461.638 : ThreadMigrate, hProcess=0x23F07C7A
--:--:--.---.--- : ====== Data loss counter: 42948 bytes lost ======
0:06:29.323.576 : ThreadMigrate, hProcess=0x23FCBC1A
0:06:29.323.618 : ThreadSwitch, hThread=0x03FD19AE
0:06:29.323.628 : ThreadMigrate, hProcess=0x03FDF002
0:06:29.323.691 : InvertPriority, hThread=0x23F07A9E, Priority=130
--:--:--.---.--- : ====== Data loss counter: 0 bytes lost ======
0:06:29.323.724 : ThreadSwitch, hThread=0x23F07A9E
0:06:29.323.841 : ThreadMigrate, hProcess=0x23FCBC1A
0:06:29.323.882 : ThreadMigrate, hProcess=0x23F07C7A
In the preceding example of a text file output by readlog.exe, about 42KB of data was lost during the time between the first data loss counter and the second. No data was lost during the time between the second counter and the third.
Note that after the nonzero counter, the timestamp increased by about two seconds, indicating that data from approximately two seconds of device run-time was not recorded. Typically, data is lost from the period of time that occurs immediately before the data loss counter. So in the preceding example, data was lost between the thread migration event that occurred at 0:06:27.461.631, and the thread migration event that occurred at 0:06:29.323.576.
See Also
Concepts
CeLog Data Viewing
CeLog Event Tracking Overview
Kernel Tracker