Windows perfmon Recipe

1. Run } perfmon or Performance Monitor
2. Expand Performance } Data Collector Sets
3. Right click on User Defined } New } Data Collector Set
   1. Provide a name
   2. Ensure "Create from a template (Recommended)" is selected
   3. Click Next
   4. Choose "System Performance"
   5. Click Finish
4. Right click the newly created data collector set and click Properties
   1. Click the "Directory" tab and note down the folder where the logs will be written
   2. Click the Stop Condition tab
   3. Uncheck Overall duration
   4. Check Maximum Size and change the maximum size based on available disk space in megabytes, e.g. 1024 for one gigabyte
   5. Click OK
5. Expand the User Defined folder and select the newly created data collector set
6. Right click on Performance Counter } Properties
   1. Click on the File tab
   2. Check Circular
   3. Click OK
7. Do the same steps for NT Kernel
8. Under the User Defined folder, click on the the newly created data collector set
9. Right click: Start
   • If you receive the following error, then this probably means some other process is running an NT Kernel trace which we generally don't need, so expand the User Defined folder, select your data collector set, right click on NT Kernel, click Delete, and then try starting the data collector set again.

     When attempting to start the Data Collector Set the following system error occurred: The Data Collector Set or one of its dependencies is already in use.

10. Reproduce the issue
11. After the problem has been captured, go back to perfmon and right click on the data collector set and click Stop
12. Wait about 30 seconds after clicking stop because some files are asynchronously generated.
13. Gather and upload the entire directory (e.g. C:\PerfLogs\Admin\Test\myhost_20260101-000001) which should include:
    • Performance Counter.blg
    • NtKernel.etl
    • report.html
    • report.xsl
    • report.xml
    • rules.log

Notes:

• This procedure has been tested on recent versions of Windows Server 2025, Windows Server 2022, Windows Server 2019, Windows Server 2016, and Windows 11.
• To gather per-process counters, it's generally recommended first to enable PID-based counter names with ProcessNameFormat=2 and then common per-process counters are % Processor Time, % User Time, % Privileged Time, Page Faults/sec, IO Data Bytes/sec, and Thread Count

Previous Section (Windows pktmon on a port Recipe) | Next Section (Windows 11 perfmon Recipe) | Back to Table of Contents