Hardware Profiling With VTune - Admin Rights Problem

[staylor]

Hi There
We trying to get VTune running fully with admin rights in order to collect hardware events. We have to use Defendpoint to elevate VTune exe file and it's child processes and while VTune launches its unable to collect the hardware events. We get an error saying "To collect hardware events, run with admin rights". 

Can someone advise if there is other VTune processes that need tobe elevated in order to collect the hardware events?

Thanks

Stephen

[JaideepK_Intel]

Hi,

Thank you for posting in intel communities.

We assume you are opening Vtune as normal user may be because of that you are unable to run hardware event base analysis.

please look at the below screenshot

Please try to run/open Vtune as an administrator so that you can run the hardware event base analysis, shown in the below picture.

If this resolves your issue, make sure to accept this as a solution. This would help others with similar issue. Thank you!

Thanks,

Jaideep

[staylor]

Hi Jaideep

Thanks for your reply.
We're unable to use the "run as administrator" option instead, we have a Defendpoint profile created which is configured to allow the VTune exe file run in elevated mode, which is meant to mimic running as an administrator.
Do you know how the hardware event base analysis determines that its being as an administrator?

Kind Regrads

Stephen

[JaideepK_Intel]

Hi,

I hope you are doing well.

Dev Team is working on your issue from their end. We will get back to you with an update.

Thanks,

Jaideep

[JaideepK_Intel]

Hi,

I hope you are doing well.

We got an update from the engineering team, i.e., to run most of the vTune analysis, we need administrator privileges on Windows and root privileges on Linux.

Thanks,

Jaideep

[JaideepK_Intel]

Hi,

Good day to you.

Using CLI:

I hope you can run the command prompt as an administrator, please run the command prompt as administrator and set the environment variables as shown below.

cd C:\Program Files (x86)\Intel\oneAPI\vtune\latest\env (default installation path for vtune)

vars.bat

Now run vtune application.

example :

vtune -collect uarch-exploration <path to the application>

Administrator/root privileges are required to run vtune application.

Thanks,

Jaideep

[staylor]

Hi Jaideep

Thanks for the info, we are unable to run the cmd prompt elevated or with admin rights as our desktops are Locked down in our environment.

I have managed to VTune to open with elevated permissions using Avecto Defendpoint and no longer getting the error saying "To collect hardware events, run with admin rights". 
I can run VTune and collect most of the profile stats.
The only item I have outstanding is I see the message below when running the profile and so far not been able find the exe files that are used to perform that function. Do you or the team know which exe files are used to try to get the thread handle and attach to the process?

"Failed to get a thread handle when attaching to the process due to os error (access denied). Data for the thread will not be collected."

Thanks 

Stephen

[JaideepK_Intel]

Hi,

It is good to know you are able to run Vtune. Can you please elaborate on your issue (steps to reproduce) so that we can try to reproduce the same?

1. Please provide the exact steps to reproduce your issue.
2. Please provide a sample reproducer and screenshots of the error you are facing.

Thanks,

Jaideep

[staylor]

HI Jaideep

The Avecto Defendpoint works by elevating specific executables which in turn allows the process to run with admin rights.
If I create a new project, choose any exe file to profile, start the profile capture we are seeing the "Failed to get a thread handle when attaching to the process due to os error (access denied). Data for the thread will not be collected." message  straight away. I've attached a screenshot. 

Therefore, to try to prevent the message I'm thinking that maybe there are other exe files apart from the list below that need to added to our Avecto Defendpoint policy that would stop the message from appearing.

c:\program files (x86)\intel\oneapi\vtune\latest\socwatch\64\socwatch.exe

c:\program files (x86)\intel\oneapi\vtune\latest\bin64\ipmwatch\ipmwatch.exe

c:\program files (x86)\intel\oneapi\vtune\latest\bin64\pin.exe

C:\Program Files (x86)\Intel\oneAPI\vtune\latest\bin64\sep.exe

C:\Program Files (x86)\Intel\oneAPI\vtune\latest\bin64\amplxe-runss.exe

C:\Program Files (x86)\Intel\oneAPI\vtune\latest\bin64\vtune-gui.exe

C:\Program Files (x86)\Intel\oneAPI\vtune\latest\bin64\vtune.exe
C:\Program Files (x86\Intel\oneAPI\vtune\latest\bin64\vtune-agent.exe
C:\Program Files (x86\Intel\oneAPI\vtune\latest\bin64 \vtune-backend.exe
C:\Program Files (x86)\Intel\oneAPI\vtune\latest\bin64\vtune-worker.exe

C:\Program Files (x86)\Intel\oneAPI\vtune\latest\bin64\vtune-server.exe

C:\Program Files (x86)\Intel\oneAPI\vtune\latest\bin64\amplxe-sepreg.exe

C:\Program Files (x86)\Intel\oneAPI\vtune\latest\bin64\amplxe-gpuetwreg.exe

Kind Regards

Stephen

[JaideepK_Intel]

Hi,

We are working on your issue and we will get back to you with an update.

Thanks,

Jai

[JaideepK_Intel]

Hi,

I hope you are doing well.

Sorry for the delay, still we are team is working on this issue and we will get back to you with an update.

Regards,

Jaideep

[JaideepK_Intel]

Hi,

I hope you are doing well.

Got an update from the engineering team: Intel Vtune is not going to work as expected under Avecto defend a point, if you give access to the entire Vtune directory then also Vtune may not behave as expected.

Can we go head and close this case?

Regards,

Jaideep

[staylor]

Hi Jaideep

Thanks for the reply.

One last thing to confirm, the person running Vtune needs to be an Administrator of the Windows machine in order to run Vtune properly?

Kind Regards

Stephen

[JaideepK_Intel]

Hi,

For some analysis like user mode sampling, threading doesn't need admin privileges but most of the other analysis need administrator/root privileges to run Vtune. I hope this helps.

Can we go ahead and close this case?

Have a great day ahead.

Thanks,

Jaideep

[staylor]

Hi Jaideep

Thanks for the feedback, and yes the ticket can now be closed.

Thanks for your help.

Kind Regards

Stephen

[JaideepK_Intel]

Hi,

Thanks for the confirmation, If you need any additional information, please post a new question as this thread will no longer be monitored by Intel.

Regards,

Jaideep