Subject: Procmon Durations wrong?
Posted: 15 June 2013 at 12:47pm
Timing Resolution/granularity
Consider the two APIs GetTickCount() and QueryPerformanceCounter()... I'll let you google the details... or bing it, you can bing that sh** too.
The timestamps ProcMon provides are, more than likely, created using a call to GetTickCount(). In contrast, the duration column would be calculated by taking the difference between two calls to QueryPerformanceCounter() (e.g. duration = t2 - t1).
@skelker
Looking at the last set of data you provided I would say that everything is in working order. If you add the duration to the timestamp (both data points taken from the same row in your table) the result will equal the timestamp of the next row (+/- error; see topic #1).
I suspect the dataset from the post before that (your first post, skelker) has a typo in the data.
