Windows Performance Monitor (PerfMon): Complete Guide to Monitoring and Troubleshooting Performance

QUICK ANSWER

Windows Performance Monitor, commonly called PerfMon, is a built-in Windows tool for viewing and recording CPU, memory, storage, network, process, application, and system performance data. Open it by pressing Windows + R, entering perfmon, and selecting OK.

PerfMon is most useful when Task Manager shows that a computer is slow but does not explain why. You can inspect live performance counters, record activity over time with a Data Collector Set, and compare the results with a normal baseline to identify persistent bottlenecks, resource exhaustion, application problems, or abnormal system behavior.

What Is Windows Performance Monitor?

Windows Performance Monitor is a Microsoft Management Console snap-in included with supported versions of Windows 10, Windows 11, and Windows Server. Its executable is perfmon.exe.

PerfMon collects data exposed by Windows, device drivers, services, and compatible applications. It can:

• Display performance statistics in real time.
• Record selected counters over minutes, hours, or days.
• Compare current performance with a previously recorded baseline.
• Monitor local or remote Windows computers when permissions and network configuration allow it.
• Generate reports from Data Collector Sets.
• Collect performance counters, event-tracing data, and system configuration information.
• Support scripted or scheduled collection through tools such as logman.exe and typeperf.exe.

PerfMon observes and records activity; it does not automatically repair the underlying problem.

Why PerfMon Is Useful

Task Manager provides a convenient overview of current resource usage. PerfMon is designed for deeper investigation.

Common uses include:

• Finding which resource is limiting application performance.
• Investigating intermittent slowdowns that disappear before an administrator connects.
• Recording evidence during a workload, backup, login storm, or scheduled job.
• Detecting gradual memory growth that may indicate a leak.
• Correlating CPU, memory, storage, and network activity.
• Comparing performance before and after a configuration change.
• Establishing normal operating baselines for servers and workstations.
• Supplying performance evidence to application vendors or support teams.
• Monitoring application-specific counters installed by products such as web servers or database systems.

Its main benefit is correlation. For example, a slow application accompanied by high disk latency and a growing disk queue suggests a different problem from a slow application accompanied by sustained processor saturation.

How PerfMon Works

Performance providers and consumers

A performance provider is a Windows component, driver, service, or application that publishes measurements. PerfMon is a consumer that requests those measurements and displays or records them.

Installed applications can add their own performance objects and counters, so available counters vary between computers.

Objects, counters, and instances

Performance data is organized into three important levels:

Component	Meaning	Example
Object or counter set	The resource or component being measured	Processor, Memory, PhysicalDisk
Counter	A particular measurement	% Processor Time, Available MBytes
Instance	A specific occurrence of an object	_Total, CPU 0, a disk, or a process

A typical local counter path is:

\Processor(_Total)\% Processor Time

A remote counter path can include a computer name:

\\SERVER01\Processor(_Total)\% Processor Time

The _Total instance normally represents an aggregate across the applicable instances. The * wildcard selects all instances where supported.

Sampling and calculated values

PerfMon reads counters at a configured interval. Some counters are point-in-time measurements, while rate and percentage counters may require multiple samples before Windows can calculate a meaningful value.

A one-second interval is suitable for short interactive investigations. Longer collections commonly use intervals such as 5, 15, 30, or 60 seconds to reduce overhead and log growth. The correct interval depends on how brief the suspected problem is.

Microsoft advises that Windows performance counters are intended for administrative and diagnostic collection, not high-frequency application profiling. They are not designed to be collected more frequently than once per second. Use Event Tracing for Windows (ETW), Windows Performance Recorder, and Windows Performance Analyzer when subsecond timing or detailed execution analysis is required.

How to Open Performance Monitor

Start the full console

1. Press Windows + R.
2. Enter:

perfmon

3. Select OK.

You can also search for Performance Monitor from the Start menu.

The main console contains:

• Monitoring Tools
• Performance Monitor
• Data Collector Sets
• Reports

Useful PerfMon startup commands

Run these commands from the Run dialog, Command Prompt, or PowerShell:

Command	Purpose
perfmon	Opens the complete Performance Monitor console
perfmon /sys	Opens the Performance Monitor view
perfmon /res	Opens Resource Monitor
perfmon /report	Starts the System Diagnostics Data Collector Set and displays its report
perfmon /rel	Opens Reliability Monitor

Some diagnostic collections and system-level counters may require administrator privileges.

How to Monitor Performance in Real Time

1. Open perfmon.
2. Expand Monitoring Tools.
3. Select Performance Monitor.
4. Select the green + button or press Ctrl+N to add counters.
5. Select a performance object.
6. Choose the required counter and instance.
7. Select Add, and then select OK.
8. Use the toolbar to switch between line, histogram, and report views.

Select a counter below the graph to see its current, average, minimum, maximum, and duration values. Display properties allow you to change the sample interval, graph scale, colors, and other visual settings.

A counter line at the top of the graph does not automatically mean the value is 100. PerfMon can apply a scale factor so counters with very different ranges remain visible. Check the counter’s reported values and scale before interpreting the graph.

Recommended Starting Counters

Counter availability and names can vary by Windows version, installed components, and display language. Use the Add Counters dialog or typeperf -q to confirm the names installed on the target computer.

Area	Counter	What it helps reveal
CPU	\Processor Information(_Total)\% Processor Utility	Overall processor utilization when available
CPU	\Processor(_Total)\% Processor Time	Time the processors are busy
CPU	\Processor(_Total)\% Privileged Time	CPU time used by the kernel and drivers
CPU	\System\Processor Queue Length	Threads waiting for processor time
Memory	\Memory\Available MBytes	Physical memory immediately available
Memory	\Memory\% Committed Bytes In Use	Committed virtual memory relative to the commit limit
Memory	\Memory\Pages/sec	Paging activity; interpret with other memory counters
Storage	\PhysicalDisk(*)\Avg. Disk sec/Read	Average read latency
Storage	\PhysicalDisk(*)\Avg. Disk sec/Write	Average write latency
Storage	\PhysicalDisk(*)\Disk Transfers/sec	Storage operations per second
Storage	\PhysicalDisk(*)\Current Disk Queue Length	Outstanding storage requests at the instant sampled
Network	\Network Interface(*)\Bytes Total/sec	Total traffic through each interface
Network	\Network Interface(*)\Output Queue Length	Packets waiting to be sent
Process	\Process(*)\% Processor Time	CPU consumption by process
Process	\Process(*)\Working Set - Private	Physical memory private to a process
Process	\Process(*)\Private Bytes	Private committed virtual memory owned by a process
System	\System\Context Switches/sec	Thread-switching activity
System	\System\System Up Time	Time since Windows started

On Windows 11 and later, consider using Process V2 counters when available. Traditional Process counters identify instances by executable name, which can produce confusing instance matching when several processes have the same name or when processes start and stop.

Do not diagnose from one counter

No individual number proves that a component is faulty. Interpret related counters together and consider:

• How long the condition persists.
• The number of logical processors.
• Available physical memory and the commit limit.
• Storage technology, workload, and vendor expectations.
• Network adapter speed and protocol overhead.
• Virtualization and storage-layer behavior.
• The application’s expected workload.
• Whether the problem occurs during a scheduled task.
• The system’s normal baseline.

Short spikes are often normal. Sustained abnormal values that coincide with a reported slowdown are more useful evidence.

How to Create a Data Collector Set

A Data Collector Set records performance information for later analysis. This is the preferred approach for intermittent problems.

Create a basic counter log through the GUI

1. Open Performance Monitor as an administrator when system-wide collection requires elevation.
2. Expand Data Collector Sets.
3. Right-click User Defined.
4. Select New > Data Collector Set.
5. Enter a descriptive name, such as Application Slowdown.
6. Select Create manually (Advanced).
7. Select Performance counter, and then select Next.
8. Add only the counters relevant to the investigation.
9. Choose a sampling interval.
10. Select a storage location with sufficient free space.
11. Select an appropriate account if prompted.
12. Save the collector set.
13. Right-click it and select Start.
14. Reproduce or wait for the problem.
15. Right-click the collector set and select Stop.

Performance counter logs commonly use the binary .blg format. Keep the exact start and stop times, affected user or application, workload, and observed symptoms with the log.

Choose an appropriate interval

Scenario	Practical starting interval
Short interactive reproduction	1–5 seconds
Intermittent issue over several hours	5–15 seconds
Long-running baseline	30–60 seconds
Very brief or subsecond issue	Use ETW/WPR instead of faster PerfMon sampling

These are starting points, not universal requirements. More counters, shorter intervals, and longer collection periods produce larger logs and additional collection overhead.

Review a recorded log

1. Open Performance Monitor.
2. Right-click the graph and select Properties.
3. Open the Source tab.
4. Select Log files.
5. Add the .blg file.
6. Select the time range.
7. Add the counters you want to examine.

When too many samples are displayed, PerfMon can combine data points to fit the graph. Compare the displayed graph with minimum and maximum values, or narrow the time range, so a short spike is not hidden by summarization.

Command-Line Collection

List installed counters

To list available counter objects and counters:

typeperf -q

To include installed instances:

typeperf -qx

To query a particular object:

typeperf -qx PhysicalDisk

Counter names are localized on some Windows installations. Copying an English counter path to a Windows installation using another display language may produce a “No valid counters” error.

Display live counter data

The following command samples total processor time every second until you press Ctrl+C:

typeperf "\Processor(_Total)\% Processor Time"

To collect 60 samples at five-second intervals in CSV format:

typeperf "\Processor(_Total)\% Processor Time" "\Memory\Available MBytes" -si 5 -sc 60 -f CSV -o "C:\PerfLogs\QuickCheck.csv"

Create the output directory first and run with suitable permissions.

Create a reusable counter log with Logman

From an elevated Command Prompt:

logman create counter "KB-Baseline" -c "\Processor(_Total)\% Processor Time" "\Memory\Available MBytes" "\PhysicalDisk(_Total)\Avg. Disk sec/Transfer" -si 00:00:05 -f bin -o "C:\PerfLogs\KB-Baseline.blg"

Start collection:

logman start "KB-Baseline"

Stop collection:

logman stop "KB-Baseline"

Display its configuration and status:

logman query "KB-Baseline"

Delete the collector definition when it is no longer required:

logman delete "KB-Baseline"

Deleting the collector definition is separate from deleting previously generated log files.

Convert a BLG file to CSV

Use relog.exe when a binary log needs to be analyzed in a spreadsheet or another tool:

relog "C:\PerfLogs\KB-Baseline.blg" -f csv -o "C:\PerfLogs\KB-Baseline.csv"

CSV files are convenient for analysis but may be significantly larger than binary logs.

A Practical Troubleshooting Workflow

1. Define the symptom

Record:

• What is slow or failing.
• Which users, processes, or services are affected.
• When it started.
• Whether it is constant or intermittent.
• What changed before the problem appeared.
• How success or failure can be measured.

2. Check the obvious conditions

Before building a long collection, verify:

• Free disk space.
• Pending restarts and recent updates.
• Application and System event logs.
• Failed services.
• Backup, antivirus, update, or maintenance schedules.
• Whether the issue affects one application or the whole computer.

3. Collect a small correlated counter set

Start with system-wide CPU, memory, disk, and network counters. Add relevant process or application-specific counters without collecting every available counter.

4. Capture normal and problematic periods

A problematic capture becomes much more useful when compared with the same machine under a normal workload.

5. Correlate resources and processes

Examples include:

• High total CPU plus high per-process CPU identifies a likely CPU consumer.
• Low available memory plus rising private bytes may point toward an application leak.
• Sustained storage latency plus heavy process I/O may reveal storage contention.
• High network throughput near the adapter’s practical capacity may indicate network saturation.
• High privileged CPU time can indicate kernel, driver, security, or intensive I/O activity.

6. Change one variable at a time

After identifying a likely cause, make one supported change, repeat the same workload, and compare the new capture with the original baseline.

Permissions, Remote Monitoring, and Security

Standard users may be unable to access some counters, create Data Collector Sets, or control system-level collection.

Windows provides built-in groups for delegated access:

• Performance Monitor Users can view performance data but cannot create or modify Data Collector Sets.
• Performance Log Users can manage performance counters, logs, and alerts. Creating and modifying Data Collector Sets can also require the Log on as a batch job user right and appropriate Run As credentials.

Use these groups to provide the minimum necessary permissions instead of routinely granting local administrator rights.

Remote performance-counter access can depend on:

• The current user’s permissions on the target computer.
• Firewall rules and RPC availability.
• Required services and endpoints.
• Domain or workgroup authentication.
• Whether the counter provider supports remote collection.

Microsoft notes that direct remote counter access can be difficult to configure securely and is often disabled by default. WMI-based management or an approved monitoring agent may be more suitable in managed environments.

Performance logs can reveal computer names, process names, application activity, workload patterns, and infrastructure details. Store and transfer them as sensitive operational data.

Performance Impact and Limitations

PerfMon is generally suitable for normal diagnostic collection, but it is not free of cost or limitations:

• Collecting many counters at short intervals increases CPU, storage, and log-size overhead.
• Third-party counter providers can be slow, unavailable, or unreliable.
• Counter names and available objects vary by operating-system language and installed software.
• Averages can hide short-lived spikes.
• Some rate counters need at least two samples.
• Process instance names can change when processes start and stop.
• A high counter value does not necessarily identify the root cause.
• Remote collection requires additional security and network configuration.
• PerfMon is not a packet analyzer, application debugger, or subsecond profiler.
• Historical data exists only when it was recorded or supplied by another monitoring product.

Test long-running collectors before deploying them widely. Configure a defined stop condition, circular logging, or log rotation where appropriate, and monitor available disk space.

PerfMon Compared with Other Windows Tools

Tool	Best use
Task Manager	Fast overview of current application and resource use
Resource Monitor	Live investigation of CPU, disk, network, and memory activity
Performance Monitor	Custom counters, historical logging, baselines, and correlation
Reliability Monitor	Timeline of application failures, Windows failures, and updates
Event Viewer	Events, errors, warnings, auditing, and service diagnostics
Windows Performance Recorder and Analyzer	Detailed ETW tracing, startup analysis, latency, and application profiling
Enterprise monitoring platform	Centralized history, dashboards, retention, and alerting across many systems

These tools complement one another. PerfMon data is strongest when combined with timestamps from Event Viewer, Reliability Monitor, application logs, and user reports.

Common Problems and Troubleshooting

“No valid counters” appears

• Confirm the path with typeperf -q or typeperf -qx.
• Check spelling, object, instance, and counter names.
• Remember that counter names may be localized.
• Verify that the application or service providing the counter is installed and running.
• Test a known Windows counter to determine whether the issue affects one provider or the entire counter subsystem.

Avoid rebuilding the performance-counter registry as a first step. Commands such as lodctr /r modify counter registration and should be used only after confirming corruption, preserving the existing configuration, and following Microsoft or product-vendor guidance.

The graph is blank

• Confirm that the selected instance still exists.
• Wait for a second sample when the counter requires two samples.
• Check the graph’s time range and data source.
• Verify permissions.
• Confirm that the service or application publishing the counter is running.
• Review the counter scale and graph vertical range.

Access is denied

Run the console with the required administrative rights or add the account to the appropriate built-in performance group. For remote monitoring, verify permissions, firewall configuration, services, and authentication on the target computer.

A process counter disappears or changes instances

The process may have exited, restarted, or been renumbered because multiple processes share the same executable name. Include \Process(*)\ID Process in the collection to help correlate instances. On Windows 11 and later, use Process V2 counters when available.

The log file grows too quickly

• Increase the sampling interval.
• Reduce the number of counters and instances.
• Avoid wildcard collection when individual instances are sufficient.
• Configure a maximum size or circular binary log.
• Split long collections into multiple files.
• Store logs on a volume with sufficient free space.

The graph and maximum value do not match

PerfMon may be combining samples to fit a long time range into the graph. Narrow the displayed range and compare current, minimum, maximum, and average values rather than relying only on the drawn line.

FAQ

Is PerfMon included with Windows?

Yes. Performance Monitor is built into supported Windows 10, Windows 11, and Windows Server installations. No separate download is normally required.

Does PerfMon require administrator rights?

Basic local viewing may work without elevation, but some counters, Data Collector Sets, system diagnostics, and remote operations require additional permissions. Use the Performance Monitor Users or Performance Log Users groups for delegated access where appropriate.

Can PerfMon monitor another computer?

Yes, when the account, firewall, services, RPC endpoints, and counter provider permit remote access. Because direct remote counter access can be difficult to secure and maintain, WMI or an approved monitoring agent may be preferable.

What is the difference between PerfMon and Task Manager?

Task Manager provides a quick live summary. PerfMon offers selectable counters, precise sampling, long-term logging, saved Data Collector Sets, historical analysis, and application-specific measurements.

Which counters should I monitor first?

Begin with total CPU usage, available and committed memory, disk latency and activity, network throughput, and per-process CPU and memory. Add workload-specific counters only after defining the problem.

What sampling interval should I use?

Use one to five seconds for short reproductions, approximately five to fifteen seconds for intermittent issues over several hours, and longer intervals for baselines. Do not sample Windows performance counters more frequently than once per second; use ETW-based tools for finer detail.

Can PerfMon alert me when a counter crosses a threshold?

Data Collector Sets support performance-counter alerts and associated actions. Configure them cautiously: a fixed threshold may be misleading without a baseline, and any automated action should be tested and secured.

Can PerfMon prove that hardware is defective?

No. PerfMon can identify abnormal latency, saturation, errors exposed through counters, or resource contention, but hardware diagnosis may require vendor diagnostics, firmware logs, Event Viewer data, and physical testing.

Is a high Pages/sec value proof that the computer needs more RAM?

No. Paging activity alone does not prove memory pressure. Evaluate it with Available MBytes, committed memory, page-file activity, application behavior, and the timing of the slowdown.

FINAL RECOMMENDATION / CONCLUSION

Use PerfMon when you need evidence beyond a live Task Manager snapshot. Start with a small, relevant group of counters, capture both normal and problematic periods, and correlate sustained changes with exact symptom times. Treat generic threshold values as investigation clues rather than universal pass-or-fail rules.

For intermittent Windows performance problems, create a controlled Data Collector Set with an appropriate sampling interval, defined storage limit, and clear stop condition. Use least-privilege permissions, protect collected logs, and switch to Windows Performance Recorder and Windows Performance Analyzer when the investigation requires subsecond timing or detailed ETW analysis.

 

#Windows #PerfMon #PerformanceMonitor #Windows11 #Windows10 #WindowsServer #PerformanceCounters #SystemMonitoring #Troubleshooting #DataCollectorSets #CPU #Memory #DiskPerformance #NetworkMonitoring #Logman #Typeperf #ITSupport #SystemAdministration #PerformanceAnalysis #WindowsTools

SOURCES

• Microsoft Learn: PerfMon command
• Microsoft Learn: Troubleshoot performance problems in Windows
• Microsoft Learn: About Performance Counters
• Microsoft Learn: Specifying a Counter Path
• Microsoft Learn: Logman command
• Microsoft Learn: Logman create counter
• Microsoft Learn: Typeperf command
• Microsoft Learn: Relog command
• Microsoft Learn: Lodctr command
• Microsoft Learn: Active Directory security groups—Performance Log Users and Performance Monitor Users