Weekly quickTIP

Encore Performance

How to get PerfMon to do what you need from the command line.

In my column "Paging Mr. Perfmon," I expressed my surprise at how many administrators still don't have Perfmon counters installed on all their servers. Remember that I said how it is difficult to measure and compare performance on servers without some form of performance monitoring enabled.

Most of the feedback from that column related to admins' desire to really learn more about Performance Logs and Alerts. PL&A is a handy tool, and you can't beat the price. But there are some much-needed tricks to making it work just right. Possibly the most important of these is the desire by many to run it from the command line. Luckily, native with the operating system is a tool called logman.exe that enables just this functionality.

Logman can configure nearly every setting for a Perfmon counter set. Use it with the following syntax:

Logman.exe VERB {collection name} {options}

The collection name is the name of the Perfmon counter set you're interested in creating or manipulating. For the VERB, choose from these:

Create [counter|trace] Create a new collection.

Start an existing collection and set the begin time to manual.


Stop an existing collection and set the end time to manual.

Delete Delete an existing collection.
Query Query collection properties. If no collection_name is given all collections are
Update Update an existing collection properties.

Like with file shares on a server, there is a specific syntax to Perfmon counter addressing. For a simple counter like % Processor Time on the local system, the proper addressing is:

\Processor(_Total)\% Processor Time

For more complicated counters that include object instances and remote machines, the addressing can look like this (it's line-wrapped here, but you'd type this as a single line):


An example of a counter that includes more of the elements above would be to measure % Processor Time for a particular Terminal Services session on a remote computer:

\\Server1\Terminal Services Session(RDP-Tcp 3039)\% Processor Time

Tech Help—Just An
E-Mail Away

Got a Windows, Exchange or virtualization question or need troubleshooting help? Or maybe you want a better explanation than provided in the manuals? Describe your dilemma in an e-mail to the MCPmag.com editors at [email protected]; the best questions get answered in this column and garner the questioner with a nifty Redmond T-shirt.

When you send your questions, please include your full first and last name, location, certifications (if any) with your message. (If you prefer to remain anonymous, specify this in your message, but submit the requested information for verification purposes.)

Where I have found the best use of this tool is in starting and stopping counters through scheduled tasks. Performance counters suffer from averaging effects when they run at times no one is using the server. To prevent nighttime lack-of-use from negatively skewing your results, use logman with the "start" and "stop" switch from a scheduled task to relegate your performance measurement to only your business hours.

About the Author

Greg Shields is Author Evangelist with PluralSight, and is a globally-recognized expert on systems management, virtualization, and cloud technologies. A multiple-year recipient of the Microsoft MVP, VMware vExpert, and Citrix CTP awards, Greg is a contributing editor for Redmond Magazine and Virtualization Review Magazine, and is a frequent speaker at IT conferences worldwide. Reach him on Twitter at @concentratedgreg.

comments powered by Disqus
Most   Popular