What's the best way to find out why threads are being created in my C ++ application and what are they doing?
I am doing an audit of a C ++ application running on Windows, compiled against a multi-threaded debug library. It has many third party dependencies that can spawn threads. I need to keep track of why each thread exists and how much stack space is allocated.
What is a good way to track the start of thread creation so I can see where it originated?
Update: I must point out that I have source code for the entire application outside of Microsoft dependencies. However, many threads have calls that exist exclusively within libraries that ship with the OS, such as ntdll.dll and kernel32.dll.
source to share
You can use the Windows Productivity Tool to view the ThreadCreate events. On Vista upwards, you can get stacks for each thread creation so you can see what code is creating the thread.
Collect the trace with:
xperf -on base -stackwalk ThreadCreate
Run your script, write out the trace with:
xperf -stop -d mylog.etl
Viewing the trace file with
xperf mylog.etl
In the Trace menu, set the appropriate symbol path and load symbols. You can use Microsoft Symbol Server to get publicly available symbols for the operating system.
In the Process Runtime section, right-click and select Thread Pivot Table. You can add columns to create stack stack and custom stack size. Expand the process, you will see all the threads created, the stack that created that thread and the size of the stack.
source to share
Process Explorer can display threads as well as their call stack. Very useful if you want to test a process without attaching a real debugger.
source to share