Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We just set up Nagios monitoring for some of our Windows (2003) servers, when looking at one of the servers I noticed this on the CPU graph

CPU Graph

There is clearly a (or more than one) process that is using 100% of one CPUs capacity, is there any way to identify this process? Task manager/perfmon only show total CPU usage, but our total usage is under 30% yet individual cores spike to 100% constantly.

share|improve this question
up vote 2 down vote accepted

I frequently use perfmon for such things. You can easily add per process counters and set it to record activity over time.

Additionally, the performance counter api is accessible via wmi namespace at win32_perfformatteddata* classes, for which you could write a script to execute and report perfdata back to your rrdtool instance (as that graph you've posted looks). Also take a look at nagios Exchange and munin's web page for add-ons that might fit your needs. (On train... Sorry for lack of linkage)

share|improve this answer
I'm not sure how this would help us, we don't know which process is using 100% of a single CPU, and without monitoring every process I'm not sure how we'd find that out. – Smudge Oct 14 '11 at 10:38
Right. Monitor every process with a performance counter locally with perfmon. The counters are actually already attched to the processes, so the only overhead that is introduced is the hdd i/o that occurs from logging the performance counter data to file. How else do you expect to figure this out other than being able to review per process cpu usage? – mbrownnyc Oct 14 '11 at 10:41

If you do not need a solution for constant monitoring but solely for troubleshooting, take a look at Process Explorer - it will give you per-process history graphs.

BTW: you are not necessarily seeing process thread execution time eating your CPU's cycles. This might be kernel time (i.e. used by drivers, interrupts, DPCs etc) - you should enable the display of kernel times in task manager to rule this out.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.