Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to perform an ad hoc capture of data using perfmon.exe for a process that runs during the night.

I know the name of the executable--lets call it Foo.exe.

If the process were currently running, I would go to the Add Counters dialog in perfmon, switch to the Process object, and select the Foo instance from the list. However, it's not currently running.

Is it possible to set up perfmon so that it will capture process data for this process when it starts, and if so, how would I configure it to do so?

share|improve this question
up vote 2 down vote accepted

One of the advantages of using the binary logging file format is that it will capture data for processes which start after the log file has started (this is not the case for CSV.)

Of course, you'll get a lot of extra data about all the processes you don't care about - you could mitigate this by scheduling a perfmon task that runs only around the time that Foo.exe runs. You could also use a script to filter out the data just for the one process using logparser.

share|improve this answer
So the approach would be to add the Process object, with all counters, and start the log with a binary format. Then, any process that starts during this period will be logged (including Foo.exe). Once the logging is finished, the data can simply be post-processed to filter it to only the records for Foo.exe. Is that right? – Jason Jones Jan 27 '11 at 22:50
@jason - That is correct FYI - A more efficient method may be to use a powershell script to get the data just for the foo process. Here are some useful links: – Chris Jan 28 '11 at 13:59
Yep, that's what I had ended up doing after I couldn't figure out how to make perfmon do what I needed, but for the sake of curiosity, I had to ask here in case I was missing something. – Jason Jones Feb 1 '11 at 3:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.