Tip

Process Monitor eases Windows troubleshooting of performance problems

Although a number of built-in Windows troubleshooting tools exist for diagnosing performance problems, they might not always be sufficient. Tools such as Performance Monitor, Task Manager and Resource Monitor can trace a performance problem to a specific process, but they lack the granularity to see inside the troublesome process. Thankfully, a free Windows Sysinternals tool called Process Monitor is able to do what native operating system diagnostics cannot.

You can see what the Sysinternals Process Monitor looks like in Figure 1. The bulk of the space within the screen capture is made up of log entries. Process Monitor is designed to log process-related information, and it can actually build logs that are multiple gigabytes in size.

Figure 1: This is the Process Monitor interface.
Figure 1: Windows Process Monitor logs activities.

As you can see, the Windows Process Monitor is designed to give insight into what a process is doing. For example, you can see the time, the process name and process ID, the operation's path and result, and some details such as the offset, length and priority of the operation.

Needless to say, having this information at your disposal can go a long way toward helping you to diagnose performance problems. It is worth noting, however, that the Sysinternals Process Monitor interface is fully customizable. You can add information to the display, as well as remove any unwanted data.

To do so, choose Select Columns from the Options menu. You'll see a series of checkboxes that allow you to choose the columns that you want to view. Figure 2 shows the available options.

Figure 2: You can add and remove columns from
the Process Monitor display.
Figure 2: Control the columns displayed.

Process Monitor, which is designed for Windows XP and newer OS versions, can log vast amounts of data. The real key to Windows troubleshooting is to be able to cut through the clutter and find the information that is really important.

The first trick is to log only as much data as you absolutely have to. As soon as you open Process Monitor, it begins collecting data. It's a good idea to halt the data collection process once you know that the performance problem that you are trying to troubleshoot has occurred.

The option for starting or stopping the data collection process is found on the File menu. Incidentally, this menu also contains an option to save the data you have collected in case you need to look at it again later.

Even if you manage to stop the data collection process rather quickly, the Process Monitor can still log quite a bit of data. Thankfully, there are several tools that help you make sense of the collected data. You'll find these tools on the Tools menu.

One particularly helpful tool is the Process Tree, shown in Figure 3. It displays all of the processes that were running at the time that the data was collected, and it shows how the processes are related to one another.

Figure 3: The Process Tree displays the relationship between the various processes.
Figure 3: See how processes are related.

More on Windows troubleshooting

Take another look at Windows Sysinternals for useful tools

Sysinternals Process Explorer can reveal system usage

Get insight into Sysinternals from Russinovich book

Troubleshooting tips and tools for Windows 7

Why Windows Sysinternals tools are essential to desktop admins

How to troubleshoot Windows XP

The Tools menu also offers a number of different summary views. For instance, there is a process activity summary, a file summary and a network summary. These views can help you quickly get a feel for what is going on with a system.

As you zero in on the performance problem, you will likely need a filter. The filter is designed to help you locate relevant events while hiding irrelevant events. There is even a highlighting feature that calls attention to certain events.

One of the filter's best features is actually found on the Tools menu. The Count Occurrences option allows you to count the number of times that a particular value has occurred. You can select a column, click on a value for that column and click the Count button to see the number of times that the value has occurred. Double-clicking on the item will filter the output to show only those occurrences.

As you can see, the Windows Sysinternals Process Monitor is a great tool for Windows troubleshooting. The key to using it effectively is to know how to use the filter and the other built-in tools to cut through the clutter and find the data that can help you diagnose a desktop performance problem.

This was first published in February 2014

There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.