Time Travel Debugging FAQ

On Monday 09/25, we announced Time Travel Debugging (TTD) as a public preview at CppCon. See the TTD @ CppCon blog for a link to the CppCon video. TTD is integrated into WinDbg Preview and allows you to record the execution of an app or process, replay it both forwards and backwards, and use queries to search through the entire trace.

Since the release, we have received a ton of great questions about TTD, many of which have answers that we are broadly sharing in this Frequently Asked Questions (FAQ). Over the coming months we will endeavor to keep the FAQ up to date, so check here first if you have TTD questions or issues. If you have a new TTD burning question, let us know by adding a comment or use the Feedback Hub following the instructions below.

General

Where can I learn more about TTD?

TTD help content is published on docs.microsoft.com. Use the https://aka.ms/ttd link to go there now. You can provide feedback on our TTD documentation by clicking "Comments" or "Edit" on any docs.microsoft.com page. See https://aka.ms/BlogTTDPreview for more info on TTD and links to videos.

How can I provide feedback about TTD?

We are counting on your feedback as we continue to improve TTD. We are using the Feedback Hub to help us prioritize what improvements to make. The voice of our customers does impact feature prioritization. We are listening so make your voice heard.

You can easily provide feedback directly in WinDbg Preview by clicking the Feedback Hub button on the Home ribbon. You can also open the Feedback Hub from Start and select Category = Developer Platform and Subcategory = Debugging Tools for Windows (WinDbg, KD, CDB, NTSD, TTD). See https://aka.ms/BlogTTDPreview for Feedback Hub instructions.

Will TTD be open source?

For now, TTD will not be open source. We are evaluating open source future opportunities for a number of our debugging solutions.

I prefer Visual Studio (VS), when is TTD coming to VS?

WinDbg is the first debugger to include TTD. We are looking at including TTD features in a future version of Visual Studio. Please email TTDVS@microsoft.com if you would like to see TTD in Visual Studio.

Get Started

Where can I download TTD from?

TTD is included in the latest version of WinDbg Preview. You can install WinDbg Preview from the Store https://aka.ms/WinDbgPreview.

Does TTD in WinDbg Preview need to be installed on Admin account?

To use TTD, you need to run the debugger elevated. Install WinDbg Preview using an account that has administrator privileges and use that account when recording in the debugger. In order to run the debugger elevated, right-click on the WinDbg Preview icon in the Start menu and then select More > Run as Administrator.

Why does TTD only work on Windows 10?

TTD functionality is part of the WinDbg Preview app which requires Windows 10 Anniversary Update or later. For now, you can only use TTD to record and replay on a Windows 10 machine.

Is there a TTD download available outside of Store? My company blocks Store apps.

For now, the only supported way to install TTD is via WinDbg Preview in the Store. We are looking at other deployment methods like including TTD in a future SDK/WDK.

Record

What is the performance impact of recording?

Recording an application or process is relatively expensive. The actual performance overhead varies based upon the amount and type of code being executed during recording. You can expect about a 10x-20x performance hit in typical recording scenarios. Sometimes there will not be a noticeable slowdown but for more resource intensive operations (i.e. File Open dialog) you can see the impact of recording.

How big can the TTD trace files get? How can I estimate the size of TTD trace files before recording?

TTD trace files can get big and you need to make sure that adequate free disk space is available. Recording an app or process for even a few minutes can quickly grow the TTD trace file to several gigabytes. See TTD help content (https://aka.ms/ttd#trace-file-basics) for more information. We are working on a blog post to provide more details on TTD trace file size. We will include a link here once the TTD trace file size blog post is published.

Is there a maximum size for TTD trace files? Can I set a maximum size for TTD trace files or use a ring buffer?

For now, you cannot set the maximum size for the TTD trace file. We have been testing a ring buffer (a.k.a. circular buffer) internally. We will evaluate providing more control over TTD trace file sizes in a future release.

Replay

Does TTD work both locally and remotely?

TTD is local only and does not work remotely connected to another machine. After recording, you can copy the TTD trace file to your local machine for replay. Note: The machine where you replay the TTD trace must support all instructions from the record machine (i.e. AVX instructions). This restriction may be lifted in the future.

Does TTD require kernel-mode connection or can it work in user-mode?

TTD is user-mode only for now.

Can I use TTD to debug managed code apps? How can I get sos.dll to work correctly for debugging managed code?

Yes, nearly everything that works during a live debugging session works with TTD record & replay sessions. You can use the SOS debugging extension (sos.dll) running in 64 bit mode to debug managed code using TTD in WinDbg Preview.

Query & Commands

How can I query my traces in WinDbg Preview?

The query features are available through the data model which can be accessed using the dx command or the Model tab in the ribbon, using @$cursession.TTD as a starting point. See /en-us/windows-hardware/drivers/debugger/time-travel-debugging-object-model for more information.

Why am I seeing "UnknownOrMissingSymbols" as the function names when I query my trace?

The data model extension needs full symbol information in order to provide function names, parameter values, etc. When full symbol information is not available it uses "UnknownOrMissingSymbols" as the function name. We are working on a fix so that exported function names will be used. This fix will be available in an upcoming release of WinDbg Preview.

Is there a way to start seeing query results sooner?

Not yet but we are actively working on returning query results faster.

Why didn't the query return anything for calls to a DLL?

There are several reasons this can occur. The top reasons are:

1. The syntax for the call isn't quite right.  Try verifying the call syntax by using the x command: "x <call>". If the module name returned by x is in uppercase, use that.
2. The DLL is not loaded yet and is loaded later in the trace.  Workaround: travel to a point in time after the DLL is loaded and redo the query.
3. The call is inlined which the query engine is unable to track today.

Querying traces seems powerful but can it do more?

Yes! There are many opportunities to improve queries. If you are particularly passionate about something that you want available from the query system use the Feedback Hub to make your voice heard!