System Monitor is your most important troubleshooting tool

System Monitor collects data from the internal operations of Windows. This is your key source of Windows troubleshooting information. Familiarize yourself with its functions by moving the mouse pointer to hover over the System Monitor toolbar to view the button tool tips.

New Counter Set Clear Display View Current Activity View Logged Data
View Graph View Histogram View Report Add  Delete Highlight
Properties  Freeze Display   Update Data

Use the Graph View to see 100 data points for each counter. By default, each counter is collected every second, but this time interval can be adjusted.  Use the Histogram view to identify high counters. In the following window, the process with the highest memory utilization in its working set is clearly identified.

Analyzing your system in real time is a challenge. System monitor only displays 100 data points and does not save the data. Use Logs and Alerts to make a permanent record of the data.

Keyboard Exercise

Start System Monitor from the Performance shortcut. If % Processor Time is not already selected, press the + Add button and select it. Drag the window around the screen and see how the graph goes up.

Security

Ordinary users can monitor their own machines. System Monitor can also monitor remote machines.
ç monitoring data

By default, administrators have the permissions necessary for remote monitoring.  Other users can do remote monitoring if they have the following permissions.

Read access to

• %SystemRoot%\System32\PerfcLanguageID.dat
• %SystemRoot%\System32\PerfcLanguageID.dat
• HKLM\System\CurrentControlSet\Control\SecurePipeServers\winreg
• HKLM\Software\Microsoft\Windows NT\CurrentVersion\Perflib

Full Control to HKLM\System\CurrentControlSet\Services\SysmonLog\Log Queries

To create counter logs, you need permissions to start and configure services. Administrators have this by default. The best way to give this permission to users is to use the Security Configuration snap-in.