WPAExporter exports [Root] for New Thread Stack even though WPA GUI shows full call stack

Daniel Nguyen 0 Reputation points
2026-01-23T00:44:58.2133333+00:00

I’m exporting New Thread Stack / Ready Thread Stack data from an ETL using WPAExporter, but the exported output only shows [Root] for some rows, even though the WPA GUI shows the full call stack after loading symbols.

Microsoft® Windows® Performance Analyzer
11.7.383.39833

Microsoft® Performance Toolkit SDK
1.2.2.5750

Event Tracing for Windows
15.2.215.53015

What I do:

  1. Open ETL in WPA GUI
  2. Load symbols
  3. In the table that contains New Thread Stack, expanding stack dropdown shows callstack as expected. User's image

When I export using WPAExporter:

wpaexporter -i bmark.etl -symbols -tti -tle -profile callstack.wpaProfile

I get a CSV that looks like the following:

New Process,New Thread Id,New Thread Stack,Ready Thread Stack,...
Idle (0),0,[Idle],n/a,...
benchmark_2.exe (17448),,,,,,...
svchost.exe (4668),6784,[Root],,,,,
spoolsv.exe (4920),11340,[Root],,,,,

_NT_SYMBOL_PATH is set to exactly the same paths used in the WPA GUI:

srv*C:\Symbols*http://msdl.microsoft.com/download/symbols;srv*C:\Users\danngu01\source\repos\benchmark_2\ARM64\Debug;srv*C:\Users\danngu01\source\sandbox\etl\bmark_2.etl.NGENPDB

Am I missing something?

Thank you.

Windows development | Windows Performance Toolkit
0 comments No comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.