A short freeze leaves nothing in Task Manager. Windows Performance Recorder writes an ETW trace of CPU, disk and drivers, and the timeline shows which thread blocked the frame.
Start **wpr -start GeneralProfile -filemode**, reproduce the stutter for 30 seconds, stop with **wpr -stop C:\trace.etl**, then read the CPU timeline in Windows Performance Analyzer.
**wpr** ships with Windows and fails cleanly if a session is already recording. The status query is the fastest way to find a leftover trace from an earlier attempt.
wpr -?
wpr -status
wpr -cancel**-filemode** writes to disk instead of a memory buffer, so a longer capture does not lose events. The General profile covers CPU, disk and drivers without the size of the full verbose set.
wpr -start GeneralProfile -filemode
wpr -status
Get-DateA trace is only as useful as the workload. Do the exact action that stutters, keep it under a minute, and note the time so you can find the window in the timeline.
# start the game or the app, trigger the stutter three times
Start-Sleep -Seconds 30
wpr -status**-stop** ends the session and writes the ETL. A trace written into the system drive while a game runs on the same drive adds noise, so save it to a second volume when possible.
wpr -stop D:\stutter.etl
Get-Item D:\stutter.etl | Select-Object Name,Length,LastWriteTime
wpr -statusThe CPU Usage (Sampled) graph is the first stop, and the DPC/ISR graph is the second. A spike with high DPC time points at a driver, not at the application.
# open the ETL in Windows Performance Analyzer
# Graphs: CPU Usage (Sampled), DPC/ISR, Disk Usage
# zoom to the timestamp you noted
Start-Process "C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\wpa.exe" -ArgumentList 'D:\stutter.etl'A module that appears in the same 200 ms window as every stutter is the suspect. Compare the timestamps of the three reproductions before you change any setting.
# WPA: select the spike > Stack column > group by Module
# note the process and the module that owns the stack
Get-Process | Sort-Object CPU -Descending | Select-Object -First 10 Name,Id,CPUThe shell is not elevated. Start PowerShell or Command Prompt as administrator; ETW kernel providers need that.
File mode with a long capture grows fast. Keep captures under a minute and delete old ETL files from the target drive.
The ETL was written but the symbols are missing. Set the symbol path to the Microsoft symbol server in WPA, then reopen the trace.
The capture did not cover the event. Start the trace before the workload, leave it running through three repetitions, and check the timestamps.
No. Perfmon records counters over time; WPR records events, stacks and scheduling. Perfmon answers how much, WPR answers why.
WPA is part of the Windows Performance Toolkit. The ETL itself opens only there, so install the toolkit or hand the file to someone who has it.
It adds overhead and cannot capture everything without cost. Keep the profile narrow and compare behaviour, not absolute frame rates.
Run wpr -cancel to end any session and delete the ETL file. The recorder changes nothing in the system configuration.
Free · no account needed · tracks your progress