v0.9.1

Fixes

A fixes-only release on top of 0.9.0. If you use 0.7.0 to 0.9.0, please update.

• Programs were wrongly reported as "held up". At a moment you flagged with Ctrl+Shift+F9, threads that were simply idle, waiting for their next message or event, could be reported as held up for about two seconds. With a browser, Discord or another Chromium- or Electron-based app open, one of them could even become the report's top suspect. Those idle waits no longer count; waits on locks, disks and memory paging still do. (Present since 0.7.0.)
• The window showed your Windows user name. After a run, the app showed the full path of the saved report, which starts with C:\Users\<your name>. People post screenshots of this window, so it now shows only the file name; Show report file still opens the folder.

Verifying this download

gh attestation verify WTFIsStalling.exe --repo Tyberious/WTFIsStalling proves the file was built by this repository's release workflow from the tagged commit; sha256sum -c SHA256SUMS.txt checks the files. The executables are not code-signed yet, so SmartScreen may warn: More info -> Run anyway. If an antivirus blocks the download, please open an issue with the detection name.

Download

WTFIsStalling.exe is the app. wtfis-cli.exe is the same engine for the console.

v0.9.0

What's new

0.9.0 makes the verdicts sharper and puts the program you were using at the center of the report.

The program you were using comes first

The tool notes once a second which program's window is in front (the process only, never window titles). When that program was among those kept waiting, at a stall, a moment you flagged or behind a slow disk, the report names it first: "the program you were using, game.exe, waited 1.2 s". At a flagged moment it also says when your program was not among them, which points the search elsewhere.

Sharper verdicts

• Short stalls get the same checks as whole-PC freezes: which device interrupts stopped or kept arriving, whether the timer that wakes sleeping threads kept firing, and which slow disk requests coincided. A stall where the measuring thread was itself waiting for a disk read is now called what it is.
• One busy core is no longer averaged away. CPU starvation is judged per processor, counting interrupt-level work as busy, so "one core was busy while the others idled" is said, with what held it.
• Context for every stall: which priority range a waiting thread was in, and whether the processor was throttled or memory was nearly full at that moment.
• A freeze that coincided with a slow drive is noted on that drive's finding too. Requests that were only slowed down by the freeze are not held against the drive.
• Severity weighs how much of the PC a stall held. A stall on 1 of 32 processors no longer rates like the whole PC stopping; whole-PC freezes are always High.

More detail where it helps

• The files that waited on disk say which programs waited on them.
• The driver table says whether each driver's interrupts arrived message-signaled or on a shared line, and the device table shows each device's message-signaled interrupt limit where Windows has one set.
• The comparison with your previous run keeps more numbers per finding and prints the three most telling. Data files from 0.7.0 and 0.8.0 still compare.
• Long durations read as seconds ("84.7 s", not "84718 ms").
• A changelog covering every release.

Fixes

• At a flagged moment, the list of waiting programs showed the whole run's waits instead of that moment's.
• A few report sentences had a long run of spaces in the middle.

Known limits

The new per-core, throttling and memory context lines, and a filter's own code in a slow request's path, have only been tested on synthetic data so far: they did not come up on the test PC. If a report looks wrong, please open an issue and attach it.

Verifying this download

gh attestation verify WTFIsStalling.exe --repo Tyberious/WTFIsStalling proves the file was built by this repository's release workflow from the tagged commit; sha256sum -c SHA256SUMS.txt checks the files. The executables are not code-signed yet, so SmartScreen may warn: More info -> Run anyway. If an antivirus blocks the download, please open an issue with the detection name.

Download

WTFIsStalling.exe is the app. wtfis-cli.exe is the same engine for the console.

v0.8.0

What's new

A slow drive is now explained all the way down. When a disk (especially a hard drive) makes the PC hang, 0.8.0 answers what exactly Windows was waiting for:

What the stuck request was, and who was stuck behind it

• What it was: a program's own code or memory being read back from disk, the file cache fetching or writing a file, the file system's own bookkeeping ($Mft: something was listing or creating lots of files), or a file's contents.
• Who was waiting for it: the programs whose threads went to sleep on that drive and woke the moment the request finished, with how long they waited in total.
• Lock chains: when a program waited on a lock held by another program that was itself waiting on the drive, the report says so in one line.
• Head thrashing (hard drives): when several programs made the drive's head jump between far-apart places at once, so each got a fraction of the drive, the report names them.

Inside the drive, or waiting in Windows?

A small extra trace of Windows' storage driver times every request below the driver stack. Each slow request is split into time inside the drive and time waiting in Windows before it reached the drive, and drive retries, failed reads/writes and resets during the run are reported. A busy drive working through its queue is described as exactly that, not as a faulty drive. Drives that are not on Windows' StorPort driver (older USB "BOT" enclosures) are reported as not measured. --no-storage-trace turns it off.

Which drivers were in the path

The trace now carries module-level call stacks for disk requests and slow page faults: driver names in call order, never function names. A slow request says which drivers it went through, and the disk finding lists the file-system filters (antivirus, backup, cloud sync, encryption) in the path of the slow requests. Being in the path is never called the cause, since every file access on Windows passes through several filters, and Microsoft Defender is never something to turn off.

--deep also records where every waiting program was blocked ("was blocked in FLTMGR.SYS -> Ntfs.sys"). It costs more (on a busy 32-thread PC, about 120,000 extra events a second and roughly twice the tool's own processor use), so it is opt-in and off in light mode.

Fixes

• Privacy: paths in the Recycle Bin printed the Windows account's security ID and the names of files inside deleted folders, and a file whose name started with $ made its folder path public. Both are closed.
• A hard drive kept busy seeking between programs was blamed on "the drive itself, its cable or its firmware"; it is now reported as busy, with the programs named.
• Ordinary file reads through the file cache were described as "paging", which reads like a memory problem; they are now described as the file cache fetching the file.

Cost

Measured on a 32-thread PC under heavy disk load: the storage trace adds about 750-1,750 events a second and the default call stacks about 1,000, against roughly 250,000-370,000 a second the tool already records; neither changed the tool's own processor use measurably, and no events were lost. The report's "THIS TOOL'S OWN COST" block shows the numbers for your PC.

Known limits

Lock chains, drive retries and resets, and a filter's own code showing up in a slow request's path have been tested only on recorded and synthetic data: they did not occur on the test PC. If a report looks wrong, please open an issue and attach it.

Verifying this download

gh attestation verify WTFIsStalling.exe --repo Tyberious/WTFIsStalling proves the file was built by this repository's release workflow from the tagged commit; sha256sum -c SHA256SUMS.txt checks the files. The executables are not code-signed yet, so SmartScreen may warn: More info -> Run anyway. If an antivirus blocks the download, please open an issue with the detection name.

Download

WTFIsStalling.exe is the app. wtfis-cli.exe is the same engine for the console.

v0.7.0

What's new

A big one. 0.7.0 is about PCs with more than one thing wrong, and about saying what kind of problem a stall is before blaming anything.

The whole PC stopping is now its own finding

When every processor stops at the same instant (cursor and audio freeze together), that is one event, not a pile of separate stalls blamed on whatever happened to be running. The report says how often it happens and how long it lasts, which device interrupts went quiet and which kept arriving, and what it could not explain.

Before it blames a driver or says "the CPU was held", it now checks whether ordinary interrupt work kept flowing during the stall. If it did, nothing was holding the processor, and the report says the thread simply was not woken instead of accusing a bystander.

A report you can act on when there are layers of problems

Findings are grouped by symptom (the whole PC stops, short interruptions, one program waits, worth knowing), with a short plan and an order of attack: change one thing, run again. Severity follows how often something happens, not just how bad the worst one was. A clean PC with a few background notes now simply says nothing needs fixing.

Before and after

Every run is compared with your previous one automatically: better, worse, new, gone, or about the same, with the numbers. Runs of different lengths are compared per minute. A problem that did not show up is never called "fixed", and findings that look back over a week of event logs say that a fix cannot show there yet.

More of the "why"

• Which thread was kept waiting, and by what. Every thread switch is traced, so the report can tell "nothing woke it" (timer, firmware, power management) from "it was woken and then not given a processor", and can say which thread a starved program was stuck behind. (--no-switches turns it off.)
• The picture stopped updating. A second, small trace listens to the graphics kernel: at a stall or a moment you flag, the report says how long no new frame reached the screen, which program's frames stopped, and whether Windows was asking for video memory to be freed. (--no-gpu-trace)
• File names for slow disk requests and hard page faults. Program and system files are named; personal files are shown only as "(a .pdf file)", because reports get pasted into forums.
• A late wake-up with idle CPUs is not "CPU starvation". When a disk request or a page fault covers the delay, the report says the thread was blocked on that drive, and it counts as a finding instead of "a one-off, ignore it".
• Hardware-access tools: RGB, fan, monitoring and tuning utilities that talk to the hardware directly are listed with the program behind each driver. Common and not a problem by itself, so it is only raised when it could explain something else in the report.
• Third-party network filters (VPNs, security suites) are named with their author.
• Devices on legacy line-based interrupts where message-signaled interrupts are available, with careful advice: forcing it through the registry can stop a device or the PC from starting.
• Drivers that fire on a timer below the stall threshold are detected as periodic.

Kinder to the PC it measures

• The report shows what the tool itself cost (processor time of both of its processes, events processed and lost).
• Light mode for small PCs: on by itself with 4 logical CPUs or fewer, or on battery (--light / --no-light).
• More than 64 logical CPUs (all processor groups) and P-core / E-core labels.

Less noise

Repeated slow events from the same disk, driver or program fold into roll-up lines in the event log, so a long download to a hard drive no longer produces endless "slow disk write" lines. An outlier still gets its own line. (Thanks for the report.)

Fixes

• A comparison between runs of different lengths could read "about the same" when the rate had dropped twelvefold.
• An NVMe drive was called "busy" at 30 MB/s, which blamed programs for a drive that was slow with almost nothing asked of it. The threshold now depends on the kind of drive.
• "spare 0%" for drives (often behind USB bridges) that do not report it now reads "spare not reported".
• Personal file names could leak through alternate path forms; several smaller fixes from a bug pass.

Known limits

The whole-PC freeze logic and the "picture stopped" finding are tested against recorded and synthetic data; neither has been confirmed on many real machines yet. If a report looks wrong, please open an issue and attach it. What did not make this release is tracked in #19.

Verifying this download

gh attestation verify WTFIsStalling.exe --repo Tyberious/WTFIsStalling proves the file was built by this repository's release workflow from the tagged commit; sha256sum -c SHA256SUMS.txt checks the files. The executables are not code-signed yet, so SmartScreen may warn: More info -> Run anyway. If an antivirus blocks the download, please open an issue with the detection name.

Download

WTFIsStalling.exe is the app. wtfis-cli.exe is the same engine for the console.

WTFIsStalling 0.6.0

What's new

The tool can now see the graphics card. Once a second it records, for each GPU, how busy it is, how much video memory is in use, and which program is responsible. No extra permissions needed.

• "Video memory is full": when VRAM runs out, Windows moves textures into ordinary RAM and every trip back is a hitch. The report names the program holding the memory and how much of its graphics data was pushed out, and starts the advice with the cheapest fix (texture quality).
• At the moments you flag with Ctrl+Shift+F9, it says which side to look at: the GPU was working flat out (lower GPU-heavy settings or cap the frame rate), or it had spare capacity (the hitch is on the CPU side or inside the game, and lowering graphics settings will not help).
• When video memory can be ruled out, the report says so with the numbers instead of listing it as a possibility.
• A GRAPHICS section in the details shows each card's load and peak video memory.

A busy GPU by itself is never reported as a problem: that is what a game is supposed to look like.

Fixes from a full code review

• Flagged moments could go missing. If the cause of a moment you flagged was "the CPU went dark" (firmware) or could not be identified, the report did not mention it at all. Every flagged moment now shows up in the result.
• The tool left the Windows timer resolution raised after you clicked Stop, until the window was closed. It is now released the moment monitoring ends, so "changes nothing on the system" is true again.
• A crash could have left the kernel trace running in the background. The trace now shuts itself down no matter how a run ends.
• Windows processes are no longer called programs you can close. A stall attributed to System said "Close this program". It now says what it is (the Windows kernel doing a driver's work) and points at the driver behind it; the same goes for svchost, Defender, dwm and other parts of Windows. (Thanks for the report.)
• When a disk's slow requests were evenly split between "the disk was busy" and "the drive itself was slow", the advice now follows the drive.

Verifying this download

gh attestation verify WTFIsStalling.exe --repo Tyberious/WTFIsStalling proves the file was built by this repository's release workflow from the tagged commit; sha256sum -c SHA256SUMS.txt checks the files. The executables are not code-signed yet, so SmartScreen may warn: More info -> Run anyway. If an antivirus blocks the download, please open an issue with the detection name.

Download

WTFIsStalling.exe is the app. wtfis-cli.exe is the same engine for the console.

WTFIsStalling 0.5.1

What's new

Stalls are tied to hardware errors. When a stall, or a moment you flagged with "I felt it", happens within 2 seconds of a hardware error Windows logged (WHEA: memory, processor, PCI Express), the report says so in that hardware finding. Stalls where "the CPU went dark" get the explanation that goes with it: the firmware was busy handling that error.

Crashes and sudden power loss. Unexpected shutdowns from the last 7 days are reported: blue screens with their stop code and name (for example 0x9F DRIVER_POWER_STATE_FAILURE), and separately restarts or power loss with no blue screen, which point at the power supply, heat or an unstable overclock. Someone simply holding the power button is not counted as a crash.

Firmware speed caps. Windows' "firmware limited the processor's speed" event now backs up a CPU throttling finding. It only counts by itself when it fired during the run, because some PCs log it at every boot.

The details section lists the count for every kind of event-log entry checked, so a clean log is visible too.

Also: SHA256SUMS.txt now works with sha256sum -c on Linux, macOS and Git Bash.

Please report odd output

These event-log paths could only be tested against constructed events, because the development PC has none of them. If a report misses something you can see in Event Viewer, please open an issue with the report file.

Verifying this download

gh attestation verify WTFIsStalling.exe --repo Tyberious/WTFIsStalling proves the file was built by this repository's release workflow from the tagged commit. The executables are not code-signed yet, so SmartScreen may warn: More info -> Run anyway. If an antivirus blocks the download, please open an issue with the detection name.

Download

WTFIsStalling.exe is the app. wtfis-cli.exe is the same engine for the console.

WTFIsStalling 0.5.0

What's new

Drivers are named after the device they drive. A finding used to say rtwlane.sys - Wi-Fi adapter driver. It now names your actual hardware and tells you how old its driver is:

1. [HIGH] rtwlane.sys  -  Realtek 8822CE Wireless LAN 802.11ac PCI-E NIC
     - Blamed for 14 stalls (worst 11.80 ms, 121 ms in total).
     - Driver version 2024.10.138.3, dated 2021-03-04 (5 years old), from Realtek.
   What to try:
     Start here: this driver is 5 years old. Install the current one from Realtek or from the
     support page of your PC or motherboard model ...

• The driver's version, date, age and provider come straight from Windows' device database.
• Third-party drivers two or more years old get "update it" as the first thing to try, because that is so often the whole fix.
• Windows' own built-in drivers all carry a placeholder date, so no age is claimed for them; the report says they are kept current by Windows Update.
• The driver table in the details lists which device each third-party driver belongs to.
• Drivers with no device behind them (filter drivers, antivirus, the kernel) keep their existing description.

Fixed: a graphics driver reset found in the event log now lands in the same finding as stalls blamed on that driver, instead of a separate one.

Verifying this download

gh attestation verify WTFIsStalling.exe --repo Tyberious/WTFIsStalling proves the file was built by this repository's release workflow from the tagged commit. Checksums are in SHA256SUMS.txt. The executables are not code-signed yet (free open-source signing has been applied for), so SmartScreen may warn: More info -> Run anyway. If an antivirus blocks the download, please open an issue with the detection name.

Download

WTFIsStalling.exe is the app. wtfis-cli.exe is the same engine for the console.

WTFIsStalling 0.4.1

Why this release exists

Microsoft Defender's cloud service blocked the 0.4.0 download for at least one person as Trojan:Win32/Wacatac.B!ml. The !ml suffix means a machine-learning guess about an unfamiliar file, not a match against known malware; scanning the very same file with Defender on demand finds nothing. New, unsigned tools that ask for administrator rights and read low-level system data get this a lot. 0.4.1 removes what such models dislike and adds ways to check the download yourself.

What changed

• Drives are never opened for reading or writing. SATA SMART data now comes from a Windows query that needs no access rights to the disk at all, like everything else the tool reads about drives.
• The executables say what they are: product name, description, version, source link and an icon.
• Build provenance. GitHub now attests that these exact files were built by this repository's release workflow from the tagged commit. With the GitHub CLI:
  gh attestation verify WTFIsStalling.exe --repo Tyberious/WTFIsStalling
• Code signing is on its way. The release pipeline is ready for free open-source signing by SignPath Foundation; the application is pending, so these files are still unsigned.

No change to what the tool detects; see 0.4.0 for that.

If your antivirus still objects

Whether Defender's cloud model likes 0.4.1 better cannot be tested in advance. If a download is blocked, please open an issue with the detection name (Windows Security > Protection history) so it can be reported as a false positive.

Download

WTFIsStalling.exe is the app. wtfis-cli.exe is the same engine for the console.

Windows SmartScreen may warn about a new unsigned program: More info -> Run anyway. Checksums are in SHA256SUMS.txt.

WTFIsStalling 0.4.0

What's new

This release asks a second question next to "what stalled the PC?": is the hardware itself unwell?

Why a disk was slow, not just that it was. Each slow request is explained from the traffic around it:

• The disk was busy, and which programs were moving the data. Windows' own background work (Defender, Search indexing, Windows Update, background tasks) is named as such, with the setting that actually controls it, instead of "close it".
• The drive was asleep and had to wake up, with the power settings that stop that.
• A program forced its writes out to the drive.
• The disk had nothing else to do and was slow anyway: the drive, its cable or its firmware.

Drive health. Temperature, the NVMe health log (critical warnings, media errors, wear, thermal throttling) and SATA SMART (bad sectors, CRC cable errors) are read when monitoring starts and again when it stops. Counters that moved while you were monitoring are flagged as the cause; lifetime totals are only background. Serial numbers are never read, so reports stay safe to post.

What Windows itself logged in the last 7 days

• Hardware errors (WHEA): corrected memory errors (unstable XMP/EXPO, a bad stick), corrected processor errors (undervolt, PBO, overclock), PCI Express link errors with the device in that slot named (riser cables, GPU, NVMe), and fatal errors that crashed the PC
• Storage errors: drive resets, retried I/O, bad blocks, paging errors, surprise disconnects
• Graphics driver resets: "display driver stopped responding and has recovered"

The details section lists every drive's health line and the event-log counts, so a clean bill of health is visible too.

Please report odd output

The hardware-error, SATA SMART and graphics-reset paths could only be tested against the documented formats, because the development PC is healthy and has no SATA drive. They are written to stay silent rather than guess when something cannot be read. If a report looks wrong on your PC, or misses an error you know is in Event Viewer, please open an issue with the report file.

Download

WTFIsStalling.exe is the app. wtfis-cli.exe is the same engine for the console.

Windows SmartScreen may warn about a new unsigned program: More info -> Run anyway. Checksums are in SHA256SUMS.txt.

WTFIsStalling 0.3.0

What's new

Slow disks are named, not numbered. Instead of "Disk 2", the report now says which drive it is: drive letters, model, how it is connected, size, firmware version and how full each volume is, for example:

Disk 2 (D:), SOLIDIGM SSDPFKKW020X7 - responding slowly / NVMe SSD, 2.0 TB, firmware 001C. D: 94% full.

Advice that fits the drive. A USB drive, a hard drive, an NVMe SSD and a SATA SSD each get different things to try, and a nearly full volume is called out first because that alone makes drives slow.

The event log and the disk latency table show the drive letters too. Serial numbers are deliberately not read, since reports get pasted into forums.

Download

WTFIsStalling.exe is the app. wtfis-cli.exe is the same engine for the console.

Windows SmartScreen may warn about a new unsigned program: More info -> Run anyway. Checksums are in SHA256SUMS.txt.