cpu time consumed by a process and its threads

Question

I am trying to understand the math of CPU time consumed by various threads in an application. The .time command below tells me that my process is up for about 7 minutes which to my understanding is basically the CPU time this process has overall consumed. Based on that, the time consumed by individual threads should add up to 7 minutes also but it`s much more than 7 minutes.

0:140> .time
Debug session time: Fri May  8 15:05:16.000 2015 (UTC - 4:00)
System Uptime: 22 days 17:00:27.560
Process Uptime: 0 days 0:06:45.000
  Kernel time: 0 days 0:00:23.000
  User time: 0 days 0:26:24.000
0:140> !runaway
 User Mode Time
  Thread       Time
   8:39f4      0 days 0:01:46.236
 126:1184      0 days 0:01:45.394
 136:b9c       0 days 0:01:42.851
 117:37c8      0 days 0:01:42.009
 132:fb8       0 days 0:01:38.046
 135:4a94      0 days 0:01:33.834
 131:3dd0      0 days 0:01:31.525
 134:5850      0 days 0:01:30.964
 133:239c      0 days 0:01:30.839
 139:34b8      0 days 0:01:17.438
 141:381c      0 days 0:01:02.197
 127:221c      0 days 0:01:00.528
 140:5514      0 days 0:01:00.263
 142:17b8      0 days 0:00:58.172
 143:46ac      0 days 0:00:57.377
 146:43d4      0 days 0:00:31.933
   0:2580      0 days 0:00:31.715
   4:3c98      0 days 0:00:24.663
   3:2ab4      0 days 0:00:24.117
   5:35c0      0 days 0:00:23.353
   2:3084      0 days 0:00:22.916
 148:596c      0 days 0:00:22.729
 119:5b58      0 days 0:00:04.586
  19:56a4      0 days 0:00:04.336
  86:4bfc      0 days 0:00:03.712
 130:51f0      0 days 0:00:03.697
 106:20cc      0 days 0:00:03.369
 118:27f0      0 days 0:00:03.229
  49:56a0      0 days 0:00:03.213
 121:55f8      0 days 0:00:03.198
 120:1b58      0 days 0:00:03.073
  30:49c0      0 days 0:00:02.542
  28:4b04      0 days 0:00:02.496
  26:1410      0 days 0:00:02.449
  52:3750      0 days 0:00:02.418
 114:140       0 days 0:00:02.386
  27:4c5c      0 days 0:00:02.277
  21:2748      0 days 0:00:02.277
  36:26dc      0 days 0:00:02.262
  70:5a78      0 days 0:00:02.246
  68:232c      0 days 0:00:02.230
  62:37d8      0 days 0:00:02.230
  93:5b18      0 days 0:00:02.215
  92:3ea8      0 days 0:00:02.199
  82:106c      0 days 0:00:02.199
  76:5010      0 days 0:00:02.199
 125:1480      0 days 0:00:02.168
 107:4c44      0 days 0:00:02.106
  90:59d4      0 days 0:00:02.106
  24:2128      0 days 0:00:02.074
  85:34a4      0 days 0:00:01.872
  17:22cc      0 days 0:00:01.825

Answer 1

Process uptime displayed by .time is the time since process start until the debug session time (which is the time of dump creation in case of post mortem debugging or the current time in case of live debugging).

For the individual threads, !runaway shows the CPU user time by default (and as reported). You can show the kernel time by !runaway 2 and thread uptime by !runaway 4 or everything by !runaway 7:

0:003> !runaway
 User Mode Time
  Thread       Time
   0:21d8      0 days 0:00:00.015
   3:21ac      0 days 0:00:00.000
   2:14f0      0 days 0:00:00.000
   1:1ec8      0 days 0:00:00.000
0:003> !runaway 7
 User Mode Time
  Thread       Time
   0:21d8      0 days 0:00:00.015
   3:21ac      0 days 0:00:00.000
   2:14f0      0 days 0:00:00.000
   1:1ec8      0 days 0:00:00.000
 Kernel Mode Time
  Thread       Time
   3:21ac      0 days 0:00:00.000
   2:14f0      0 days 0:00:00.000
   1:1ec8      0 days 0:00:00.000
   0:21d8      0 days 0:00:00.000
 Elapsed Time
  Thread       Time
   0:21d8      0 days 0:12:34.919
   1:1ec8      0 days 0:12:34.858
   2:14f0      0 days 0:12:34.851
   3:21ac      0 days 0:12:16.039

The sum of user time and kernel time needn't match to the user time and kernel time reported for the process since there might have been threads that no longer exist.

The sum of thread uptime and process uptime probably never matches, since several threads can run in parallel. However, the highest thread uptime (probably thread 0) should not exceed the process uptime.

Answer 2

Process Uptime is the amount of wall clock (I think) time that passed between the first thread starting and the last thread ending.

You need to look at User time: 0 days 0:26:24.000, that is what all those lines should add up to. To get the total CPU time used you need to do User Time + Kernel Time