I'm using perfmon's "PhysicalDisk\% Idle Time" to determine when the disk is being used heavily. The question is, what's the best/quickest way to narrow down what was using the disk?

I'm aware of the following perfmon counters but they each have issues:

  • Memory\Pages/sec: useful if disk usage was due to paging, useless otherwise.
  • Process\IO Data Bytes/sec: includes non-disk IO as well (eg network), doesn't include processes started after perfmon setup, and it can be time consuming to match processes with their perfmon id.

Resource Monitor's Disk tab gives very useful information, but unfortunately it does not offer historical logging. It can not tell me why, for example, "% Idle Time" was 0 for 20 seconds at 10am.

The information I'm after is:

  1. Which processes were using the disk the most?
  2. What files were they accessing?

Install PAL, run it for a day, and let it analyze the data captured.

  • I tried PAL. From my brief test, it was good at pointing out that the disk was being used heavily, but could not tell me which files this was due to. – Jon Mar 16 '12 at 3:45

Process Monitor from microsoft's sysinternals will do this in real time, or you can leave it running for as long as necessary. You can also save your config, and the entire program is easily scriptable.


There are 5 buttons on the top, turn off all but the one that looks like a file cabinet. (file system access)

You can right click on a program's name in the list and tell the program to exclude that item, so you can ignore system processes like DLLHost.

Any programs that access the drive will immediately show up in this list.

Good luck.!

Alternately, use the following batch file in a scheduled task to log for a while and then close.

set Delaytime=3

start Procmon.exe /quiet /accepteula /minimized /backingfile log.pml

ping -n %Delaytime% -w 1000 > NUL

start Procmon.exe /quiet /accepteula /minimized /terminate

Just change Delaytime to the number of seconds you want to log, and then later open log.pml.

  • Procmon is a bit too heavy-weight to run on production servers all the time. It logs every access to a file, whereas I just want a summary of the heaviest process/file access over periods of 3-5 seconds. – Jon Mar 16 '12 at 1:36
  • 1
    Good point. I included the attached script to adjust for that. Sometimes you really do need to see everything to track down a problem, and the original question included a rather precise time. I assumed that running procmon for one short window (as short as 2 seconds) would be a better choice than leaving pal running for 24 hours. – eldorel Mar 16 '12 at 8:09
  • It looks like they've added a /Runtime parameter so the ping trick here is no longer needed. – Spivonious Jul 30 '19 at 14:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.