Quick Start

Running monitoring

Runtime Flow installer requires admin rights and installs for all users. Open a solution in Visual Studio and click Run on the Runtime Flow toolbar. Runtime Flow launches the StartUp Project using the Debug settings for the current configuration and begins monitoring function calls:

Running monitoring

To monitor a Silverlight 4 application, specify your preferred browser and a startup page in the Customized Run dialog:

Firefox Customized Run settings

To monitor an ASP.NET application you should start an ASP.NET development server under Runtime Flow monitoring and then browse to the application in a web browser. Visual Studio 2010 example:

Customized Run settings to start ASP.NET monitoring in VS 2010

Exploring control flow

Function calls are displayed in the tree with threads as roots (including thread names if present). Repeated function calls are shown as dup with repetition count. Repeated calls of a group of functions are shown as mdup.

Function parameters and return values of complex types are displayed as dots. Strings longer than 260 characters are trimmed to not overrun the screen. When number of elements in an array is more than 10, the first nine elements are displayed + number of skipped element + the last element. When an exception occurs the function return value is displayed as Ex with thrown object information.

The Clear command on the Runtime Flow toolbar removes all functions except currently executing ones and removes finished threads.

The Expand command expands the whole tree one level further, the Expand below command expands nodes for the selected function further and the Collapse command collapses the whole tree one level up.

The search field allows you to search for classes, functions, parameters and return values.

Runtime Summary

The Runtime Summary window lists all classes and functions that were used during a program run organized by modules and namespaces. All elements are alphabetically sorted. New functions are added in real time and removed by the Clear command the same way as in the Runtime Flow window.

The search field allows you to search for namespaces, classes and functions. Each new search continues from the selected node. The Locate in flow toolbar button finds the selected class or function in the Runtime Flow window. Press the Locate in flow button again to find the next occurrence.

Monitoring level

Full monitoring monitors each function call. Summary only detects only the first function usage - the Runtime Flow window is empty in this mode and the Runtime Summary window shows almost the same content as in the full monitoring mode except for the Clear command usage. In the Full monitoring mode, after clearing the events, each function call adds a function to the summary window. In the Summary only mode – only functions that were never used before will be added to the summary window when called.

Summary only monitoring is very fast and well suited for application reconnaissance with the empty monitoring filter.

Monitoring filter

All common filtering tasks can be executed by using the Include and Exclude buttons in the toolbars. The buttons in the Runtime Flow toolbar allow filtering by function and the buttons in the Runtime Sumary toolbar allow filtering by function, class, namespace and module.

The monitoring filter is applied at the beginning of a monitoring session. You can use == and != between Module, Class, Function and a filter string. If the filter string contains spaces or special characters it should be quoted: Module == "C:\Program Files\SurF.exe".

You can use the ! unary operator to negate expression and ||, && for OR and AND operations.

A filter string allows tail matching after delimiter. Thus Module == SurF.exe matches "C:\Program Files\SurF.exe", but not "C:\Program Files\OverSurF.exe". During matching, class name contains its namespace: Class == FileSystemWatcher matches System.IO.FileSystemWatcher due to the tail matching.

A filter string allows prefix matching by using * at the end: Module == C:\*. It also allows filtering by namespace: Class == System.IO.*.

When monitoring a C++/CLR application, "native" functions are represented as the class <Module> and "native" class included in function name. Thus to exclude classes and functions in the std namespace use Function != std.*.

true and false constants can be used to quickly enable or disable part of a filter. For example, adding || true at the end of a filter enables monitoring of all functions without deleting the whole filter expression.