When looking at a trace using Windows Performance Analyzer - Disk IO - Disk Usage - Counts by IO Type, Priority - how are the bytes written categorized as "Normal", "Very Low", or "Critical"?

Question

When taking a trace using Windows Performance Analyzer - Disk IO - Disk Usage - Counts by IO Type, Priority - how are the bytes written categorized as "Normal", "Very Low", or "Critical"?

I'm specifically interested in the "Critical" writes. How are these determined as critical? What are the metrics or deciding factors to classify some writes as "Critical"?

Are there any links or sources that explain the classification determination?

Answer 1

Hello John,

The comments accompanying the definition of IO_PRIORITY_HINT in wdm.h broadly agree with the AI generated content:

typedef enum _IO_PRIORITY_HINT {
    IoPriorityVeryLow = 0,          // Defragging, content indexing and other background I/Os
    IoPriorityLow,                  // Prefetching for applications.
    IoPriorityNormal,               // Normal I/Os
    IoPriorityHigh,                 // Used by filesystems for checkpoint I/O
    IoPriorityCritical,             // Used by memory manager. Not available for applications.
    MaxIoPriorityTypes
} IO_PRIORITY_HINT;

The routines IoSetIoPriorityHint and IoGetIoPriorityHint can manipulate the value (which is stored (slightly modified) as a bit field in the IRP Flags member). The IRP Flags are one of the properties (IrpFlags) of a DiskIo event.

An ETW stack trace could be used to search for the code region that sets a priority hint (here a stack trace for a "Very Low" I/O):

ntoskrnl!EtwpTraceStackWalk+0x1B4
ntoskrnl!EtwpLogKernelEvent+0x6FD
ntoskrnl!EtwTraceSiloKernelEvent+0xA2
ntoskrnl!EtwpTraceIoInit+0xAA
partmgr!PmIo+0x12E
partmgr!PmGlobalDispatch+0x99
ntoskrnl!IopfCallDriver+0x5B
ntoskrnl!IofCallDriver+0x13
partmgr!PartitionIo+0x1FA
partmgr!PartitionWrite+0x42
partmgr!PmGlobalDispatch+0xB9
ntoskrnl!IopfCallDriver+0x5B
ntoskrnl!IofCallDriver+0x13
volmgr!VmReadWrite+0x2B2
ntoskrnl!IopfCallDriver+0x5B
ntoskrnl!IofCallDriver+0x13
fvevol!FveTryInlineWriteEncrypt+0x964
fvevol!FveFilterReadWrite+0x409
fvevol!FveReadWrite+0x1EC
fvevol!FveFilterRundownReadWrite+0x279
fvevol!FveFilterRundownWrite+0x4D
ntoskrnl!IopfCallDriver+0x5B
ntoskrnl!IofCallDriver+0x13
iorate!IoRateDispatchReadWrite+0x1B8
ntoskrnl!IopfCallDriver+0x5B
ntoskrnl!IofCallDriver+0x13
volume!VolumePassThrough+0x23
ntoskrnl!IopfCallDriver+0x5B
ntoskrnl!IofCallDriver+0x13
volsnap!VolSnapWrite+0x21B
ntoskrnl!IopfCallDriver+0x5B
ntoskrnl!IofCallDriver+0x13
Ntfs!NtfsCallStorageDriver+0xD7
Ntfs!NtfsMultipleAsync+0x8A
Ntfs!NtfsNonCachedIo+0x7FF
Ntfs!NtfsCommonWrite+0x3846
Ntfs!NtfsFsdWrite+0x584
ntoskrnl!IopfCallDriver+0x5B
ntoskrnl!IofCallDriver+0x13
FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3FE
FLTMGR!FltpDispatch+0x280
ntoskrnl!IopfCallDriver+0x5B
ntoskrnl!IofCallDriver+0x13
ntoskrnl!MiIssueSynchronousFlush+0x181
ntoskrnl!MiFlushSection+0x63F
ntoskrnl!MmFlushSection+0x142
ntoskrnl!CcFlushCacheOneRange+0x338
ntoskrnl!CcFlushCachePriv+0x137
ntoskrnl!CcMapAndCopyInToCache+0xAFC
ntoskrnl!CcCopyWriteEx+0x1E3
Ntfs!NtfsCommonWrite+0x3EEB
Ntfs!NtfsFsdWrite+0x584
ntoskrnl!IopfCallDriver+0x5B
ntoskrnl!IofCallDriver+0x13
FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3FE
FLTMGR!FltpDispatch+0x280
ntoskrnl!IopfCallDriver+0x5B
ntoskrnl!IofCallDriver+0x13
ntoskrnl!IopSynchronousServiceTail+0x1C5
ntoskrnl!IopWriteFile+0x141
ntoskrnl!NtWriteFile+0x2D2
ntoskrnl!KiSystemServiceCopyEnd

For this I/O, the IrpFlags value was 0x20043, indicating IRP_NOCACHE, IRP_PAGING_IO, IRP_INPUT_OPERATION and IoPriorityVeryLow.

Gary

Answer 2

In Windows Performance Analyzer (WPA), the categorization of disk writes into priority levels such as "Normal", "Very Low", and "Critical" is based on the I/O priority assigned to the operations. The I/O priority levels are defined as follows:

• Very Low (0): This priority is used for operations that can be deferred without impacting the user experience.
• Low (1): This priority is for operations that are less urgent than normal operations but still need to be completed.
• Normal (2): This is the standard priority for most I/O operations, balancing performance and responsiveness.
• High (3): This priority is for operations that require immediate attention and should be processed before normal operations.
• Critical (4): This is the highest priority and is used for operations that are essential for system stability and responsiveness. Critical writes typically involve operations that must be completed immediately to maintain system integrity or performance, such as writing critical system data or responding to user actions that require immediate feedback.

The determination of a write as "Critical" is influenced by the nature of the data being written and the current system state. For example, if the system is under heavy load or if the operation is essential for the completion of a critical task, it may be classified as critical. Additionally, the design of the application or service initiating the write can dictate the priority level assigned to that operation.

In summary, critical writes are determined by the urgency and importance of the data being written, as well as the context in which the write operation occurs.

---

References:

• IOPriority Enum
• MemoryPriority Enum