Leveraging Performance Counters in Windows PerfMon

Monitor Windows performance It's a fundamental task for any system administrator, support technician, or advanced user looking to identify and resolve bottlenecks or slowdowns in the applications and services running on their computer. While there are many tools for this purpose, the Performance Monitor (PerfMon) built into Windows stands out for its versatility and in-depth analysis capabilities.

The performance counters in PerfMon PerfMon counters allow you to capture metrics at different levels, analyze resource usage trends, and quickly identify anomalies in CPU, memory, disk, network, and processes, both in short intervals and over time. Mastering PerfMon and its counters provides deep insight into the actual state of the system and is key to anticipating, diagnosing, and resolving performance issues in both desktop and server environments.

What is PerfMon and why is it so useful?

PerfMon, also known as Performance Monitor, is a utility included in Windows that, unlike basic tools such as Task Manager, allows you to monitor and record hundreds of system metrics in great detail. Thanks to its performance counters, you can analyze everything from CPU usage to disk latency to memory usage by specific process. This is especially useful for detecting intermittent problems, memory leaks, or analyzing the impact of certain applications or workloads.

One of PerfMon's key advantages is that it can record data continuously and on a scheduled basis, making it easy to compare data across time periods and correlate events that affect performance. It also offers visual and data export tools for further in-depth analysis.

Basic concepts: objects, counters and instances

To understand PerfMon, it is essential to understand the structure of its metrics, which is composed of "objects" (system components), "counters" (statistics about those objects), and "instances" (unique replicas of a resource).

• Object: It refers to the component that manages performance data, such as Memory, CPU, Physical Disk, Process, etc.
• Accountant: It is a specific metric about the chosen object; for example, % CPU usage or average disk operation duration.
• Instance: A specific unit within the object (for example, a specific physical disk or an individual process).

Main areas to monitor and their recommended counters

PerfMon can monitor virtually any aspect of your system, but for effective monitoring, it's best to focus on key areas such as CPU, Memory, Disk, Network, and Processes. Below are the most useful counters for each:

1. CPU (Processor)

• % Processor Time: Total CPU usage time. Sustained values above 90% on uniprocessor systems or 80% on multiprocessor systems require investigation.
• % Privileged Time: Indicates There that the system kernel is running. Above 30% may indicate problems with web or application servers.
• % Interrupt Time: Reflects interruptions generated by hardware.
• % DPC Time: Time spent completing I/O operations. If it exceeds 25%, it may indicate hardware bottlenecks.
• Interrupts/sec and DPCs Queued/sec: To analyze interruptions and deferred calls.

2. Memory

• % Committed Bytes In Use: Percentage of virtual memory in use. If it consistently exceeds 80%, the paging file may need to be expanded.
• Available Bytes: Available physical memory. If it falls below 5% of the RAM normally installed, it should be investigated.
• Pool Nonpaged Bytes / Paged Bytes: Memory pool sizes; useful for detecting leaks.
• Committed Bytes: Committed memory that has space reserved in the paging file.
• System Cache Bytes: System cache size.

3. Disc

• %Idle Time: Indicates the amount of time the disk remains inactive; low values indicate disk saturation.
• Avg. Disk Queue Length: Average disk queue length, essential for detecting bottlenecks.
• Avg. Disk sec/Read and Avg. Disk sec/Write: They measure the latency of operations (read/write) in milliseconds.
• Disk Reads/sec and Disk Writes/sec: Operations per second.
• % Free Space on logical disk: To control how much space is available on the partitions.

4. Red

• Network interface: Bytes transmitted and received, packets dropped or with errors.

5. Process

• Private Bytes: Private memory used by the process.
• Handle Count: Number of object identifiers maintained by the process.
• Thread Count: Number of active threads in that process.
• Working Set: Physical memory currently in use by the application.
• Virtual Bytes: Reserved virtual memory.

How to start PerfMon and add counters

There are several ways to open Performance Monitor:

• Pressing Windows + R and writing perfmon.
• From the Start menu, search for “performance monitor.”
• Throwing perfmon.exe from the line of commands.

To add counters:

1. Open the PerfMon main window and select the panel Performance monitor.
2. Press the icon + or right-click on the chart area and choose Add counters.
3. Select the object, the specific counter, and the instance you want to monitor (for example, “explorer.exe” process in the “Process” object).
4. Click on Add and when you're done, press Accept.

Immediately, the values of the selected counters will begin to be represented in the central graph, allowing for a visual analysis of the system's behavior and the monitored processes.

Advanced Configuration: Data Collector Sets and Metric Logging

PerfMon allows you to not only monitor in real time, but also record data for later analysis. To do this, you need to create a "data collector set."

1. In the tree on the left, right-click on Data collector sets, Select User Defined and choose New > Data Collector Set.
2. Choose a name for the set and select Create manually (advanced).
3. In the section of Create data records, Select Performance counter and add the interest counters.
4. Set the sampling interval (for example, every 30 seconds or 5 minutes, depending on the expected duration of the log or the type of issue being investigated).
5. Choose the path where to save the log files (it is important that it has enough space and is accessible).
6. Finish the wizard and start monitoring manually by right-clicking and Start in the newly created set.

This procedure allows you to collect performance data for later graphical analysis or integration with other tools.

PerfMon add-on tools and command line utilities

Apart from the PerfMon graphical interface, there are advanced utilities for working with performance counters directly from the command line:

Practical example: monitoring user input delay in remote desktop sessions

In addition to the classic counters, recent versions of Windows have added advanced counters, such as the "User Input Delay" counters for local and remote sessions. This counter measures the time it takes for a user's input (mouse, keyboard) to be processed by an application, which is essential for identifying why a remote or local desktop session responds slowly.

To enable this counter:

1. Run the following command as Administrator:
   reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v "EnableLagCounter" /t REG_DWORD /d 0x1 /f
2. Please restart the server for this to take effect.
3. Open PerfMon and add the corresponding counter: "User input delay per process" or "per session".

Adjust the sample interval to correlate with the registry settings if necessary, otherwise the values may not be correct.

Registry tweaks to optimize PerfMon and customize counter names

PerfMon allows you to modify some registry keys to fine-tune monitoring and customize the display of instance names or the sampling interval:

• LagCounterInterval: Adjusts the sampling interval of the input lag counters (in milliseconds).
• LagCounterImageNameFirst: Changes the instance name format to display the executable name first, followed by the SessionID:ProcessID, making it easier to sort and visually analyze.
• LagCounterShowUnknown: If active, displays all processes running as services or under the SYSTEM user.

How to determine the appropriate sampling interval?

The sampling interval directly impacts both the amount of detail captured and the size of the log files and resource consumption. To capture persistent or gradual problems, intervals of 30 seconds to several minutes are adequate. For transient problems, such as brief CPU spikes or disk latencies, a short interval of 5 to 15 seconds is preferable.

The duration of monitoring should correspond to the time it typically takes for the problem we want to diagnose to occur. It is important not to set intervals too short for long periods to avoid excessively large log files and possible performance impacts.

Data interpretation: thresholds and warning signals in the most commonly used meters

A critical part of using PerfMon correctly is knowing how to interpret the results and the threshold values that can be used to warn of potential problems:

Some notable examples:

• Memory: When % Committed Bytes In Use o Pool Nonpaged Bytes consistently exceed 80%, it is advisable to check the settings and look for leaks.
• Processor: Un % Processor Time maintained above 85% may indicate overload or uncontrolled processes.
• Disk: Average latencies of more than 0,020 seconds for reading and 0,004 seconds for writing indicate poor performance, while a %Idle Time low indicates saturation.
• Net: The presence of dropped or errored packets on the network interface, or high traffic values, should be investigated.

Related articles:

How to Optimize Windows 11 for Gaming and Improve Performance

Isaac

Passionate writer about the world of bytes and technology in general. I love sharing my knowledge through writing, and that's what I'll do on this blog, show you all the most interesting things about gadgets, software, hardware, tech trends, and more. My goal is to help you navigate the digital world in a simple and entertaining way.