1

I have seen similar question by other users, but could not find a one related to an executable.

Situation: Terminal server where 10-15 users log in and run applications. For this instance, we want to monitor the memory used by 32-bit IE vs 64-bit IE for multiple users over a period of hours, and dump it to file so a graph can be made and things can be compared.

I played with RAMMap, tasklist, procmon, perfmon and could not quite achieve what I was looking for.

How do you achieve this?

Thank You

1 Answer 1

1

I'd capture the data with a Performance Monitor "Data Collector Set", then either parse the output myself (if I wanted something quick-and-dirty) or run it through Microsoft's (PAL) tool. (I can't say that PAL is going to have a template for doing exactly what you want, but if you're willing to spend them time it's a pretty flexible tool.) Logging the "Process" object should get you what you need, in terms of raw data.

I lean toward PerfMon because, at the root of it, you're looking for time-series data. That's exactly what PerfMon does. The other tools you mentioned don't generate simple time-series data, and you'd need to do significant parsing of the output in order to get the data.

Your success with PerfMon is going to be based on parsing the data. Gathering the data is no problem, but you're probably going to have to do some work to get actionable information out of that data.

Edit:

The "Process" object doesn't get you user or the architecture (x64 vs x86) of the process. For that, I'd recommend enabling audit process tracking. Your event log will include the full path of the executable, and the user starting the process. It's more data to correlate, for sure, but it would get you what you need.

1
  • Just tried to do that. It does let me filter by process IE, but could not see an option to separate IE32-bit and IE64-bit. Also, could not see separation by users. Oct 17, 2014 at 6:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .