How to pull the information that Resource Monitor () provides? The troubleshooters and problem solvers


#

How to pull the information that Resource Monitor (ResMon.exe) provides?

Applies to:
Windows Vista
Windows Server 2008
Windows 7
Windows Server 2008 R2

A common question that we get asked is how to pull the information that Resource Monitor (ResMon.exe) provides.

In ResMon, we are able to see the following five (5) tabs:

Overview
CPU
Disk
Network
Memory

CPU
Processes
Services
Associated Handles
Associated Modules

Memory
Processes
Physical Memory

Disk
Processes with Disk Activity
Disk Activity
Storage

Network
Processes with Network Activity
Network Activity
TCP Connections
Listening Ports

How do you capture these set of data for consumption?
All of these are ETW data that is collected and outputed on a nice visual tool.

To be able to view the ETW providers that are running when you fire off Resmon, just open Perfmon.
Performance Data Collector Sets WDC.GUID
Note: Where the guid is different for different systems.

Inside of the of WDC.GUID Event Trace Session , we see that the following ETW providers are collected:

Microsoft-WIndows-Kernel-Disk
0xffffffffffffffff 0xffffffff

Microsoft-Windows-Kernel-File
0x10 0xffffffff
Note: 0x10 denotes Kernel_File_Keyword_Filename

Microsoft-Windows-Kernel-Network
0xffffffffffffffff 0xffffffff

Microsoft-Windows-Kernel-Process
0x20 0xffffffff
Note:0x20 denotes WinEvent_Keyword_Thread

And their buffer size is set this way:
64KB Buffer size
16 Minimum buffers
38 Maximum buffers

Stream mode:
Real Time

So, this is looking good for me since ETW providers are something that I could collect using many different on/off (Controller/Consumer) tools such as:
TraceLog.exe (Controller) (SDK)
TraceRpt.exe (Consumer) (SDK)
Logman (Controller)(built-in)
XPerf (Controller) (WPT)
XPerfView (Consumer) (WPT)

In this segment, I ll just go thru setting up via Logman.

Start, Run, CMD (Run as admin)
logman.exe /?

logman start WDC -p 0xffffffffffffffff 0xff -bs 64 -nb 16 38 -max 10 -ets
logman start WDC -p Microsoft-WIndows-Kernel-Disk 0xffffffffffffffff 0xff -bs 64 -nb 16 38 -max 10 -ets
logman start WDC -p Microsoft-Windows-Kernel-File 0x10 0xff -bs 64 -nb 16 38 -max 10 -ets
logman start WDC -p Microsoft-Windows-Kernel-Process 0x20 0xff -bs 64 -nb 16 38 -max 10 -ets

Note:
-mode trace_mode Event Trace Session logger mode. For more
information visit
http://go.microsoft.com/fwlink/?LinkID=136464
-ln logger_name Logger name for Event Trace Sessions.
-[-]p provider [flags [level]] A single Event Trace provider to enable.
The terms Flags and Keywords are
synonymous in this context.
-pf filename File listing multiple Event Trace providers
to enable.
-[-]rt Run the Event Trace Session in real-time mode.
-bs value Event Trace Session buffer size in kb.
-nb min max Number of Event Trace Session buffers.
-[-]max value Maximum log file size in MB or number of
records for SQL logs.
-o path|dsn!log Path of the output log file or the DSN and
log set name in a SQL database. The default
path is %systemdrive%\PerfLogs\Admin .

-[-]v nnnnnn|mmddhhmm Attach file versioning information to the
end of the log name.

-ets Send commands to Event Trace Sessions

directly without saving or scheduling.

But we don t want to run four (4) different trace sessions to collect the one (1) WDC trace session.

I went ahead and created a new file in Notepad called WDC_Providers.txt which contained the following 4 lines:

0xffffffffffffffff 0xff
Microsoft-WIndows-Kernel-Disk 0xffffffffffffffff 0xff
Microsoft-Windows-Kernel-File 0x10 0xff
Microsoft-Windows-Kernel-Process 0x20 0xff

logman start WDC -pf C:\Perflogs\WDC_Providers.txt -bs 64 -nb 16 38 -max 10 -ets

which works fine.

Now, we just need to clean up a little bit such as putting the output directory of the file, and the trace mode.

logman start WDC -pf C:\Perflogs\WDC_Providers.txt -bs 64 -nb 16 38 -max 10 -mode newfile -o c:\PerfLogs\output%d.etl -ets

If you want to stop

You should have an .etl file in c:\perflogs.


Leave a Comment

Your email address will not be published. Required fields are marked *