windows - Log %CPU by Process over time

10
2014-03
  • PhantomDrummer

    Is there any easy way on Windows to log %CPU time per process over time to a file for later analysis?

    As far as I can see...

    1. Task manager shows me the %CPU per process but only visually - no way to save to a file.
    2. Perfmon will let me save to a file, and will additionally create a time-based file (taking snapshots at specified time intervals) - which is almost what I want, except that as far as I can see it can't break down the %CPU by process.
    3. Process Explorer will let me break down by process, but it will only save the file as a snapshot of a single point in time

    So, none of these are quite what I need: I need to get a file that contains something like 'top 10 processes by CPU, every 15 seconds, until I stop the monitoring' The reason I need this because I have a machine on which some process is causing occasional brief spikes in CPU usage several times a day and I need to find out which process is the culprit.

    Can anything do that, or have I missed some feature of perfmon or process explorer?

    • Answers
  • Oliver Salzburg

    Process Monitor can do that for you.

    You'll first might want to enable collection of profiling events:

    enter image description hereenter image description here

    Then, simply collect data for as long as you want (you may want to set up filters and enable Drop filtered events if you plan to collect for extended periods of time). Then go to Tools -> Process Activity Summary:

    enter image description here

    You'll now get a list of all active processes you recorded, with their activity over time. enter image description here

    You can then open the details for a single process (by double-clicking on it) and inspect the timestamps for certain events in the graph:

    enter image description here


    • Related Question

    Remove Process Explorer's "Open File - Security Warning"
  • lance

    I'm on XP Pro w/ IE8 installed. When I launch procexp.exe (Process Explorer 11.33), I see a dialog warning me about the program I'm about to launch (the title of the dialog reads "Open File - Security Warning").

    I need to launch Process Explorer w/o this prompt. How can I do this?

    Some options which are not available to me (per the workstation's keepers):

    • Change my OS (I have to stay at XP Pro)
    • Change my IE version (I have to stay w/ 8)
    • Changing Attachment Manager Group Policy (i.e.: using gpedit.msc, go to User Configuration -> Administrative Templates -> Windows Components -> Attachment Manager and Add "*.exe" to one of the "Inclusion List" settings.
    • Manually adding .exe to the "LowRiskFileTypes" in the registry

    EDIT: When I right-click the file and choose Properties, there is no "Unblock" button.


    • Related Answers
  • Hello71

    I believe right clicking the file, clicking Properties, and clicking Unblock will solve the problem. (unless it's a different dialog)

  • Niclas Lindgren

    What happens if copy (in the normal explorer) the procexp to a new file and launch that one? That usually fixes the problem for me (unless the file is block, then you have to unblock it as well).

    The block is merely some side data in the NTFS stream so you can use "streams" from sysinternals if you want to fix that, if the normal explorer is fighting with you.

  • Boobie

    When you downloaded the exe with IE8, it set an NTFS security flag on this file. There is nothing you can do to fix it from that point onward if your workstation is locked down.

    You can simply re-download the file using a different method which does not set the security flag in the first place. Firefox has an about:config option to disable the security flag. Google Chrome does not have the option to disable it.

    I recommend you use a command-line tool like 'wget' or 'curl' to download the file. Or an ftp program.. Or any one of a million other ways of putting this file on your computer which does NOT involve "downloading it with IE8"