Perfmon & Windows 2008

[RootX]

Γρήγορη ερώτηση,

με ποιον counter μπορώ να παρακολουθήσω ποιο process/service είναι υπεύθυνο για cpu util spikes; Το perfmon των windows 2008 θα χρησιμοποιήσω.

Ευχαριστώ

[nucleus]

Αν και είναι από τα windows 7 μιας και δεν έχω windows 2008

-Process Performance object

The Process performance object consists of counters that monitor running application program and system processes. All the threads in a process share the same address space and have access to the same data.

-Counter

% Processor Time is the percentage of elapsed time that all of process threads used the processor to execution instructions. An instruction is the basic unit of execution in a computer, a thread is the object that executes instructions, and a process is the object created when a program is run. Code executed to handle some hardware interrupts and trap conditions are included in this count.

Στο παράθυρο Αdd Counters δεν έχει επιλογή κάτω αριστερά για Show Description?

Mε αυτο tickαρισμένο πήρα τις παραπάνω περιγραφές.

Αν θες υπάρχουν και διαφορετικές επιλογές

% Privileged Time is the percentage of elapsed time that the process threads spent executing code in privileged mode. When a Windows system service is called, the service will often run in privileged mode to gain access to system-private data. Such data is protected from access by threads executing in user mode. Calls to the system can be explicit or implicit, such as page faults or interrupts. Unlike some early operating systems, Windows uses process boundaries for subsystem protection in addition to the traditional protection of user and privileged modes. Some work done by Windows on behalf of the application might appear in other subsystem processes in addition to the privileged time in the process.

% User Time is the percentage of elapsed time that the process threads spent executing code in user mode. Applications, environment subsystems, and integral subsystems execute in user mode. Code executing in user mode cannot damage the integrity of the Windows executive, kernel, and device drivers. Unlike some early operating systems, Windows uses process boundaries for subsystem protection in addition to the traditional protection of user and privileged modes. Some work done by Windows on behalf of the application might appear in other subsystem processes in addition to the privileged time in the process.

[RootX]

Έχω ένα VM που από την στιγμή που εγκαταστήσαμε AV, στις 6:30 κάθε πρωί και για 5 λεπτά έχει 100% cpu util - υποπτεύομαι κάποιο από τα AV processes.

Τις επιλογές που έχει το perfmon τις γνωρίζω(πάνω-κάτω) ήλπιζα σε κάποιον counter που να κάνει track αυτό που θέλω να πετύχω ακριβώς.

Έβαλα να καταγράφει τα %processor & user time για τα processes που υποπτεύομαι, αύριο θα ξέρω εάν διάλεξα τους σωστούς counters