Windows perfmon Recipe
- Run } perfmon or Performance Monitor
- Expand Performance } Data Collector Sets
- Right click on User Defined } New } Data Collector Set
- Provide a name
- Ensure "Create from a template (Recommended)" is selected
- Click Next
- Choose "System Performance"
- Click Finish
- Right click the newly created data collector set and click
Properties
- Click the "Directory" tab and note down the folder where the logs will be written
- Click the Stop Condition tab
- Uncheck Overall duration
- Check Maximum Size and change the maximum size based on available disk space in megabytes, e.g. 1024 for one gigabyte
- Click OK
- Expand the User Defined folder and select the newly created data collector set
- Right click on
Performance Counter} Properties- Change
Log formattoComma Separated - If desired, you may change
Sample intervalfrom the default of 1 second to something larger - Click on the File tab
- Check Circular
- Click OK
- Change
- Right click on the
NT Kernelrow and click Delete - Under the User Defined folder, click on the the newly created data collector set
- Right click: Start
- Reproduce the issue
- After the problem has been captured, go back to perfmon and right click on the data collector set and click Stop
- Wait about 30 seconds after clicking stop because some files are asynchronously generated.
- Gather and upload the entire directory (e.g.
C:\PerfLogs\Admin\Test\myhost_20260101-000001). Files might include the following and the most important are the*.blgfiles:Performance Counter.blgNtKernel.etlreport.htmlreport.xslreport.xmlrules.log
Notes:
- This procedure has been tested on recent versions of Windows Server 2025, Windows Server 2022, Windows Server 2019, Windows Server 2016, and Windows 11.
- To gather per-process counters, it's generally recommended first to
enable
PID-based counter names with
ProcessNameFormat=2and then common per-process counters are % Processor Time, % User Time, % Privileged Time, Page Faults/sec, IO Data Bytes/sec, and Thread Count