Re: Getting Peak Commit from NtQuerySystemInformation

Hi Mark,

On 3/3/2010 3:02 AM, Mark Tolonen wrote:
> "Mike Driscoll"<[email protected]>  wrote in message
> news:[email protected]...
>    
>> Hi,
>>
>> I was tasked with finding a way to query our workstations for their Peak
>> Commit Charge. According to the sysinternals forum:
>>
>> "The only way I'm aware of that one can get this detail is from the
>> uMmPeakCommitLimit member of the SYSTEM_PERFORMANCE_INFORMATION
>> structure one passes to NtQuerySystemInformation when calling it with
>> the SystemPerformanceInformation type." (see
>> http://forum.sysinternals.com/forum_posts.asp?TID=15540&PID=75852)
>>
>> I started with this question on the PyWin32 mailing list, but it turns
>> out that they don't expose the functionality inside
>> NtQuerySystemInformation so that's why I came here. Unfortunately, I'm a
>> complete newb when it comes to ctypes. While I did find that this worked
>> "ctypes.windll.ntdll.NtQuerySystemInformation", I don't know how to go
>> on and actually query the object. Can someone give me a clue?
>>
>> I'm running Python 2.5 on Windows XP. Thanks!
>>
>> - Mike
>>      
> REALLY quick and dirty...
>
> Notes:
>
>     2 is the enumeration value of SystemPerformanceInformation out of
> winternl.h.
>
>     SYSTEM_PERFORMANCE_INFOMRATION is an opaque structure of 312 bytes.
>     Some DDK header probably has the details...I didn't look.
>
>     NTSTATUS WINAPI NtQuerySystemInformation(
>       __in          SYSTEM_INFORMATION_CLASS SystemInformationClass,
>       __in_out      PVOID SystemInformation,
>       __in          ULONG SystemInformationLength,
>       __out_opt     PULONG ReturnLength
>     );
>
> C:\>python
> Python 2.6.4 (r264:75708, Oct 26 2009, 08:23:19) [MSC v.1500 32 bit (Intel)]
> on win32
> Type "help", "copyright", "credits" or "license" for more information.
>    
>>>> import ctypes
>>>> nt=ctypes.windll.ntdll.NtQuerySystemInformation
>>>> b=ctypes.create_string_buffer(312) # create a writable buffer
>>>> u=ctypes.c_ulong(0) # create a writable ulong.
>>>> nt(2,b,312,ctypes.byref(u))
>>>>          
> 0
>    
>>>> b.raw
>>>>          
> '\xe8A\xd2\x00\xc4\x02\x00\x00)Q\xe03\x1c\x00\x00\x00\t"\xafM\x03\x00\x00\x00nqy\xb1\x00\x00\x00\x00\xdc\xba\x95\x01\xec
> \\\xc6\x00\xfc\x17\xd7\x04\xb7\xdd\x08\x00ew\x03\x00pc\x11\x00C\xfa\x04\x00\xc1\xa4\'\x0b3:\n\x00\x9b2"\x04\x00\x00\x00\
> x00\xbcE\x97\x05\x14\xb9G\x005#\x10\x00\x00\x00\x00\x00\x00\x00\x00\x002\xf3\x0b\x004\xbf\x00\x00\xd1\x18\x02\x002B\x00\
> x00ZH\x00\x00j"\x00\x00\x18iE\x04\xd6!C\x04\x96\n\xfb\x02\xd2\x88\xf8\x02\xde\xa1\x01\x004\x02\x00\x00\x19\x0b\x00\x00\x
> eb\x00\x00\x001\xb1\xfb#\xd0\xd9\x10\x14\xa6\x1b\x01\x00\xf9\x94\x00\x00\xb3G\x00\x00\xd8\x00\x00\x00\x00\x00\x00\x00\xe
> b\x08\xc9\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0
> 0\x00\x84\x1c\x9e\x01\x00\x00\x00\x00sx\x02\x00\xcb\xa34\x00\x06\x00\x00\x00\xafb\x14\x00K\n\x00\x00M+\x00\x00\xc0Q\x00\
> x00\x0c\x01\xf0\x00\x81\x07\x00\x00\xbb\xbc\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\
> x1c"\x00\xf2\x8d\x07\x00h\xb3*\x00(n\x14\x00W\x08]\x00\x96\xb7pD\x00\x00\x00\x00\x00\x00\x00\x00\x1d\xc6i\xbe'
>
> The "struct" module can help decode this if you find the structure
> definition.  ctypes can also be used to declare the structure correctly and
> pass it directly as a parameter, but if you only need, say, a DWORD at
> offset 0x40 in this structure then you can do:
>
>    
>>>> import struct
>>>> struct.unpack('L',b.raw[0x40:0x40+4])
>>>>          
> (670259,)
>
> Hope this helps...I'm off to bed.
> -Mark
>
>    
Hmmm...this is kind of close to what Task Manager returns. I get 1102070 
when I run your script whereas Task Manager reports 1473824. Do you 
think there's some kind of byte to kilobyte conversion I need to do or 
something? Thanks for your help!

- Mike

------------------------------------------------------------------------------
Download Intel&#174; Parallel Studio Eval
Try the new software tools for yourself. Speed compiling, find bugs
proactively, and fine-tune applications for parallel performance.
See why Intel Parallel Studio got high marks during beta.
http://p.sf.net/sfu/intel-sw-dev