Retrieving top x process consuming most CPU, Memory, Disk and Network

Question

Retrieving top x process consuming most CPU, Memory, Disk and Network

Darren Rose 306

Hi

I need to obtain top x processes using the most CPU, Memory, Disk and Network.

CPU I have working using Performance Counters and % Processor Time

Memory I have working using Process.GetProcesses and looking at either PrivateMemorySize64 or WorkingSet64 - not yet sure best one to use

But I am struggling for Disk or Network as lots of solutions use Win32_PerfRawData_PerfProc_Process but values here cover both network and disk combined not separately

Thanks

Accepted answer

1 additional answer

Your answer

Answer 1

As TCPView calls

GetExtendedUdpTable and GetExtendedTcpTable

but also

OpenTrace, StartTrace, ... with "NT Kernel Logger", it can be complicated to do the same thing in VB.NET, then to simplify, I did this test with the help of ChatGPT and Microsoft.Diagnostics.Tracing.TraceEvent Nuget Package

You can ask ChatGPT (or Copilot) to change aggregation (PID instead of PID + Protocol) and do the same thing for disk

(KernelTraceEventParser.Keywords.DiskIO or KernelTraceEventParser.Keywords.FileIO)

Imports Microsoft.Diagnostics.Tracing.Parsers
Imports Microsoft.Diagnostics.Tracing.Session
Imports System.Collections.Concurrent
Imports System.Diagnostics

Public Class Form1

    Public Class TrafficStat
        Public Property Sent As Long
        Public Property Received As Long
    End Class

    Private Shared ProcessTraffic As New ConcurrentDictionary(Of Tuple(Of Integer, String), TrafficStat)()
    Private Shared traceSession As TraceEventSession

    Private grid As DataGridView
    Private refreshTimer As System.Windows.Forms.Timer

    Public Sub New()
        InitializeComponent()
    End Sub

    Private Sub Form1_Load(sender As Object, e As EventArgs) Handles MyBase.Load
        ' Add Manifest file with requireAdministrator
        If Not IsAdministrator() Then
            MessageBox.Show("Please run this app as Administrator!", "Admin Rights Needed", MessageBoxButtons.OK, MessageBoxIcon.Warning)
            Return
        End If

        Text = "TCP/UDP Process Monitor"
        Width = 800
        Height = 600

        grid = New DataGridView() With {
            .Dock = DockStyle.Fill,
            .ReadOnly = True,
            .AutoGenerateColumns = False,
            .AllowUserToAddRows = False
        }

        grid.Columns.Add(New DataGridViewTextBoxColumn() With {.HeaderText = "PID", .DataPropertyName = "PID"})
        grid.Columns.Add(New DataGridViewTextBoxColumn() With {.HeaderText = "Process", .DataPropertyName = "ProcessName", .Width = 200})
        grid.Columns.Add(New DataGridViewTextBoxColumn() With {.HeaderText = "Protocol", .DataPropertyName = "Protocol"})
        grid.Columns.Add(New DataGridViewTextBoxColumn() With {.HeaderText = "Sent Bytes", .DataPropertyName = "SentBytes"})
        grid.Columns.Add(New DataGridViewTextBoxColumn() With {.HeaderText = "Received Bytes", .DataPropertyName = "ReceivedBytes"})
        grid.Columns.Add(New DataGridViewTextBoxColumn() With {.HeaderText = "Total Bytes", .DataPropertyName = "TotalBytes"})

        Controls.Add(grid)

        StartETWListener()

        refreshTimer = New System.Windows.Forms.Timer() With {.Interval = 2000}
        AddHandler refreshTimer.Tick, AddressOf RefreshProcessList
        refreshTimer.Start()
    End Sub

    Private Shared Sub StartETWListener()
        traceSession = New TraceEventSession("MyKernelNetworkSession")

        ' Enable Network TCPIP events (covers both v4 and v6 when you subscribe correctly)
        traceSession.EnableKernelProvider(KernelTraceEventParser.Keywords.NetworkTCPIP)

        Task.Run(Sub()
                     Dim kernel = traceSession.Source.Kernel

                     ' TCP IPv4
                     AddHandler kernel.TcpIpRecv, Sub(data)
                                                      Dim pid = data.ProcessID
                                                      Dim size = data.size
                                                      Dim protocol = "TCP"

                                                      Dim key = Tuple.Create(pid, protocol)
                                                      ProcessTraffic.AddOrUpdate(key, New TrafficStat With {.Sent = 0, .Received = size},
                                                                                  Function(k, oldStat)
                                                                                      oldStat.Received += size
                                                                                      Return oldStat
                                                                                  End Function)
                                                  End Sub

                     AddHandler kernel.TcpIpSend, Sub(data)
                                                      Dim pid = data.ProcessID
                                                      Dim size = data.size
                                                      Dim protocol = "TCP"

                                                      Dim key = Tuple.Create(pid, protocol)
                                                      ProcessTraffic.AddOrUpdate(key, New TrafficStat With {.Sent = size, .Received = 0},
                                                                                  Function(k, oldStat)
                                                                                      oldStat.Sent += size
                                                                                      Return oldStat
                                                                                  End Function)
                                                  End Sub

                     ' TCP IPv6
                     AddHandler kernel.TcpIpRecvIPV6, Sub(data)
                                                          Dim pid = data.ProcessID
                                                          Dim size = data.size
                                                          Dim protocol = "TCPv6"

                                                          Dim key = Tuple.Create(pid, protocol)
                                                          ProcessTraffic.AddOrUpdate(key, New TrafficStat With {.Sent = 0, .Received = size},
                                                                                      Function(k, oldStat)
                                                                                          oldStat.Received += size
                                                                                          Return oldStat
                                                                                      End Function)
                                                      End Sub

                     AddHandler kernel.TcpIpSendIPV6, Sub(data)
                                                          Dim pid = data.ProcessID
                                                          Dim size = data.size
                                                          Dim protocol = "TCPv6"

                                                          Dim key = Tuple.Create(pid, protocol)
                                                          ProcessTraffic.AddOrUpdate(key, New TrafficStat With {.Sent = size, .Received = 0},
                                                                                      Function(k, oldStat)
                                                                                          oldStat.Sent += size
                                                                                          Return oldStat
                                                                                      End Function)
                                                      End Sub

                     ' UDP IPv4
                     AddHandler kernel.UdpIpRecv, Sub(data)
                                                      Dim pid = data.ProcessID
                                                      Dim size = data.size
                                                      Dim protocol = "UDP"

                                                      Dim key = Tuple.Create(pid, protocol)
                                                      ProcessTraffic.AddOrUpdate(key, New TrafficStat With {.Sent = 0, .Received = size},
                                                                                 Function(k, oldStat)
                                                                                     oldStat.Received += size
                                                                                     Return oldStat
                                                                                 End Function)
                                                  End Sub

                     AddHandler kernel.UdpIpSend, Sub(data)
                                                      Dim pid = data.ProcessID
                                                      Dim size = data.size
                                                      Dim protocol = "UDP"

                                                      Dim key = Tuple.Create(pid, protocol)
                                                      ProcessTraffic.AddOrUpdate(key, New TrafficStat With {.Sent = size, .Received = 0},
                                                                                 Function(k, oldStat)
                                                                                     oldStat.Sent += size
                                                                                     Return oldStat
                                                                                 End Function)
                                                  End Sub

                     ' UDP IPv6
                     AddHandler kernel.UdpIpRecvIPV6, Sub(data)
                                                          Dim pid = data.ProcessID
                                                          Dim size = data.size
                                                          Dim protocol = "UDPv6"

                                                          Dim key = Tuple.Create(pid, protocol)
                                                          ProcessTraffic.AddOrUpdate(key, New TrafficStat With {.Sent = 0, .Received = size},
                                                                                      Function(k, oldStat)
                                                                                          oldStat.Received += size
                                                                                          Return oldStat
                                                                                      End Function)
                                                      End Sub

                     AddHandler kernel.UdpIpSendIPV6, Sub(data)
                                                          Dim pid = data.ProcessID
                                                          Dim size = data.size
                                                          Dim protocol = "UDPv6"

                                                          Dim key = Tuple.Create(pid, protocol)
                                                          ProcessTraffic.AddOrUpdate(key, New TrafficStat With {.Sent = size, .Received = 0},
                                                                                      Function(k, oldStat)
                                                                                          oldStat.Sent += size
                                                                                          Return oldStat
                                                                                      End Function)
                                                      End Sub

                     traceSession.Source.Process()
                 End Sub)
    End Sub

    Private Shared Function IsAdministrator() As Boolean
        Dim identity = System.Security.Principal.WindowsIdentity.GetCurrent()
        Dim principal = New System.Security.Principal.WindowsPrincipal(identity)
        Return principal.IsInRole(System.Security.Principal.WindowsBuiltInRole.Administrator)
    End Function


    Private Sub RefreshProcessList()
        Dim processes = Process.GetProcesses().ToDictionary(Function(p) p.Id, Function(p) p.ProcessName)

        Dim stats = ProcessTraffic.
            Select(Function(kvp)
                       Dim key = kvp.Key ' Tuple(Of Integer, String)
                       Dim pid = key.Item1
                       Dim protocol = key.Item2

                       Dim stat = kvp.Value

                       Dim processName As String = Nothing
                       processes.TryGetValue(pid, processName)

                       Return New ProcessStat With {
                           .PID = pid,
                           .ProcessName = If(processName, "Unknown"),
                           .Protocol = protocol,
                           .SentBytes = stat.Sent,
                           .ReceivedBytes = stat.Received,
                           .TotalBytes = stat.Sent + stat.Received
                       }
                   End Function).
            OrderByDescending(Function(p) p.TotalBytes).
            ToList()

        grid.DataSource = stats
    End Sub

    Private Class ProcessStat
        Public Property PID As Integer
        Public Property ProcessName As String
        Public Property Protocol As String
        Public Property SentBytes As Long
        Public Property ReceivedBytes As Long
        Public Property TotalBytes As Long
    End Class

End Class

Darren Rose 306 Reputation points

2025-03-17T13:59:15.9066667+00:00

thank you , will give it a try later today
Darren Rose 306 Reputation points

2025-03-17T20:36:12.91+00:00

Thank you, that is very useful indeed and has led me in the right direction - thanks @Castorix31

Answer 2

Jiachen Li-MSFT 34,206 Microsoft External Staff

Hi @Darren Rose ,

You can use performance counters like IO Read Bytes/sec and IO Write Bytes/sec to track per-process disk activity.


    Dim diskCounter As New PerformanceCounter("Process", "IO Data Bytes/sec", "_Total")
    Dim networkCounter As New PerformanceCounter("Process", "IO Other Bytes/sec", "_Total")

    Console.WriteLine("Disk I/O: " & diskCounter.NextValue() & " bytes/sec")
    Console.WriteLine("Network I/O: " & networkCounter.NextValue() & " bytes/sec

Best Regards.

Jiachen Li

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Darren Rose 306 Reputation points

2025-03-14T13:20:22.67+00:00

same issue with that as I indicated in my question, as per snippet from Microsoft documentation below IO Read Bytes/sec includes disk AND network, so it is not just disk

"IO Read Bytes/sec: Shows the rate at which the process is reading bytes from I/O operations. This counter counts all I/O activity generated by the process to include file, network and device I/O's"
Jiachen Li-MSFT 34,206 Reputation points Microsoft External Staff

2025-03-14T14:37:11.29+00:00

Hi @Darren Rose ,

You can consider using Event Tracing for Windows (ETW) in .NET to get the process's disk IO.

Event Tracing for Windows (ETW) provides application programmers the ability to start and stop event tracing sessions, instrument an application to provide trace events, and consume trace events. Trace events contain an event header and provider-defined data that describes the current state of an application or operation. You can use the events to debug an application and perform capacity and performance analysis.
Castorix31 88,376 Reputation points

2025-03-15T10:31:19.39+00:00

I have code with GetProcessIoCounters for disk and GetExtendedTcpTable for network, but I'm not sure if IO_COUNTERS retrieves data for disk only (otherwise it can also be done with NtQuerySystemInformation and SYSTEM_PROCESS_INFORMATION)

[Edit] I compared with Sysinternals tools (Process Explorer, TCPView) and GetProcessIoCounters seems to read disk I/O only)
Darren Rose 306 Reputation points

2025-03-15T13:22:08.2566667+00:00

@Castorix31 Thanks for reply, would be useful to see that code if at all possible?
Castorix31 88,376 Reputation points

2025-03-15T14:48:23.2866667+00:00

It is old code, I will try to clean it a bit (and you will have to complete it, like adding GetExtendedUdpTable, IPv6, sort, ... to get similar results as in TCPView...)
Darren Rose 306 Reputation points

2025-03-15T14:49:51.6133333+00:00

okay thank you
Castorix31 88,376 Reputation points

2025-03-16T09:38:42.9233333+00:00

Well, after more testing, GetProcessIoCounters display values like Process Explorer from Process I/O, not from Process Disk (when you right click on column header to choose columns), so I don't think it is what you want for Disk ? I also tested ETW and I don't get same values as Process Explorer either
Darren Rose 306 Reputation points

2025-03-16T12:58:49.9466667+00:00

Okay thanks for taking the time to look. It does seem it is hard to find a solution that just shows disk or just network, they all seems to combine them
Castorix31 88,376 Reputation points

2025-03-16T16:02:46.09+00:00

Networks only seems to work with GetExtendedTcpTable + GetExtendedUdpTable (wih AF_INET + AF_INET6)

I only tested GetExtendedTcpTable with AF_INET; I will try to add GetExtendedUdpTable

(the listed processes should be about the same as in TCPView)

Share via

Retrieving top x process consuming most CPU, Memory, Disk and Network

1 additional answer

Your answer