28,657 questions
If anyone has this same issue, they may be able to solve it by installing Intel VTune, after installing whatever was the issue was gone and wpr can no also run again.
I am unable to start Windows Performance Recorder for certain profiles.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(144, 5%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBV%3C/text%3E%3C/svg%3E)
Bart Verberne
0
Reputation points
This issue comes from use of visual studio, where starting the profiler for cpu usage fails with Failed to enable requested events on system provider (0x800700aa)..
This seems to rely on starting a Window Performance Recorder (wpr) session. Trying to do that directly fails with the same error:
wpr -start CPU
The requested resource is in use.
Profile Id: CPU.Verbose.Memory
Error code: 0x800700aa
The requested resource is in use.
Can anyone help me solve this issue?
WPR is able to start certain types of sessions that seem to not rely on performance counters on the CPU.
Windows SDK version is 10.0.26100.418
Short overview of what I've tried:
- I've tried reinstalling the windows SDK, but no difference.
- This question has the same issue, but their solution doesn't help me. I am however able to start an xperf session if that is of importance. https://answers.microsoft.com/en-us/windows/forum/all/windows-performance-recorder-wont-start-recording/958c45c9-dd4f-4ba2-bbe2-b90ba0b01e56
- I've tried stopping other traces using
logman query -etscallinglogman stop "<session name>" -etson all except a few that required elevation.
Windows for business | Windows Client for IT Pros | User experience | Other
{count} votes
-
Gary Nebbett 6,216 Reputation points2025-06-04T08:11:43.56+00:00 Hello Bart,
Does the command "wpr -resetprofint" have any impact on the behaviour?
Gary
-
Bart Verberne 0 Reputation points
2025-06-04T15:50:43.5166667+00:00 @Gary Nebbett No, after that command I am still getting "Error code: 0x800700aa".
-
Gary Nebbett 6,216 Reputation points
2025-06-04T16:57:14.01+00:00 Hello Bart,
Like you, I suspect the CPU performance counters.
Some other things that you could try are:
- Run "wpr -start CPU" under a debugger and explore any exceptions that are thrown.
- Use "wpr -exportprofile CPU MyCPU.wprp" to export the profile, remove the "<Keyword Value="SampledProfile" />" element and check whether the resulting custom profile can be started.
Gary
-
Bart Verberne 0 Reputation points
2025-06-05T09:53:21.7566667+00:00 @Gary Nebbett
The custom profile without "SampledProfile" can run with success.I've installed the windows ADK:
Windows ADK 10.1.26100.2454 (December 2024)
This includes the windows performance toolkit and comes with it's own version of wpr.exe.Using this wpr also gives the same error.
However, this is a different version than in system32. I cannot find out how to update the system32 version of wpr. After uninstalling the windows SDK, wpr.exe is still present in system32.
Any clue how i'm supposed to update wpr in system32?
-
Gary Nebbett 6,216 Reputation points
2025-06-05T09:58:37.24+00:00 Hello Bart,
You are not supposed to update the version of wpr in System32. You should just "arrange" that the ADK version is started by either specifying a full path to wpr.exe or appropriately ordering the entries in the "Path" environment variable.
Update: I just saw the information about the custom profile - I will need some time to think about how to understand what is going wrong when trying to use sampled profiling.
Gary
-
Gary Nebbett 6,216 Reputation points
2025-06-05T20:04:14.47+00:00 Hello Bart,
It will be too difficult to diagnose this problem remotely. I think that the kernel routine KeStartProfile is returning STATUS_DEVICE_BUSY and that this value is ultimately returned to user-mode and translated by RtlNtStatusToDosError into an ERROR_BUSY HR value. KeStartProfile uses the IPI (InterProcessor Interrupt) mechanism to start the profiling interrupt on all processors.
Gary
-
Bart Verberne 0 Reputation points
2025-06-06T18:42:54.01+00:00 Hi Gary,
Thank you for the help so far. From your description it seems like this is a problem I won't be able to solve. Are there any steps to take outside of a fresh install?
Bart
-
Gary Nebbett 6,216 Reputation points
2025-06-07T09:44:36.86+00:00 Hello Bart,
I don't think that a fresh install is likely to help.
Mārtiņš Možeiko added this comment to the GitHub source of his MiniPerf tool:
Status = TraceSetInformation(TraceHandle, TracePmcCounterListInfo, CounterSources, CounterCount * sizeof(CounterSources[0])); // if this triggers ERROR_BUSY = 0xaa, then I believe that that someone else is collecting PMU counters // in the system, and I'm not sure how or if at all you to forcefully stop/reconfigure it. Rebooting helps.Does rebooting offer temporary relief from the problem?
As far as I can tell, the "in use" status is just determined by examining MSRs; I don't think that there are any data structures linking this status to particular processes.
One thing that you have probably not tried to stop and that potentially uses performance monitoring is the end-point protection software used on the system. For example:
Intel TDT helps endpoint security solutions harness CPU telemetry and hardware acceleration to help identify threats and detect anomalous activity. It uses a combination of CPU telemetry and machine learning (ML) heuristics to detect specific behavior. The CPU performance monitoring unit (PMU) sits below the applications, operating system and virtualized layers to provide a greater view into active threats across the stack.
Gary
-
Bart Verberne 0 Reputation points
2025-06-09T15:27:04.49+00:00 Rebooting does not offer relief, the error occurs immediately after login.
The only protection software I have (Trend Micro Security Agent) also runs on colleagues devices which are able to use wpr (I cannot disable it without IT support).Some extra info: using "logman -query -ets", the only sessions i cannot stop are:
Eventlog-Security
Diagtrack-Listener
EventLog-Application
EventLog-DebugChannel
EventLog-Microsoft-RMS-MSIPC-Debug
EventLog-System
UBPM -
Gary Nebbett 6,216 Reputation points
2025-06-10T06:51:41+00:00 Hello Bart,
ETW sessions are not the only potential users of performance management counters - they can be configured and used via other APIs (e.g. NtStartProfile).
Gary
Sign in to comment