Windows perfmon Recipe

  1. Run } perfmon or Performance Monitor
  2. Expand Performance } Data Collector Sets
  3. Right click on User Defined } New } Data Collector Set
    1. Provide a name
    2. Ensure "Create from a template (Recommended)" is selected
    3. Click Next
    4. Choose "System Performance"
    5. Click Finish
  4. Right click the newly created data collector set and click Properties
    1. Click the "Directory" tab and note down the folder where the logs will be written
    2. Click the Stop Condition tab
    3. Uncheck Overall duration
    4. Check Maximum Size and change the maximum size based on available disk space in megabytes, e.g. 1024 for one gigabyte
    5. Click OK
  5. Expand the User Defined folder and select the newly created data collector set
  6. Right click on Performance Counter } Properties
    1. Change Log format to Comma Separated
    2. If desired, you may change Sample interval from the default of 1 second to something larger
    3. Click on the File tab
    4. Check Circular
    5. Click OK
  7. Right click on the NT Kernel row and click Delete
  8. Under the User Defined folder, click on the the newly created data collector set
  9. Right click: Start
  10. Reproduce the issue
  11. After the problem has been captured, go back to perfmon and right click on the data collector set and click Stop
  12. Wait about 30 seconds after clicking stop because some files are asynchronously generated.
  13. Gather and upload the entire directory (e.g. C:\PerfLogs\Admin\Test\myhost_20260101-000001). Files might include the following and the most important are the *.blg files:
    • Performance Counter.blg
    • NtKernel.etl
    • report.html
    • report.xsl
    • report.xml
    • rules.log

Notes:

  • This procedure has been tested on recent versions of Windows Server 2025, Windows Server 2022, Windows Server 2019, Windows Server 2016, and Windows 11.
  • To gather per-process counters, it's generally recommended first to enable PID-based counter names with ProcessNameFormat=2 and then common per-process counters are % Processor Time, % User Time, % Privileged Time, Page Faults/sec, IO Data Bytes/sec, and Thread Count