Share via

How often should Perfmon Sample?

Applies to:

Windows 2000

Windows Server 2003

Windows XP

Windows Server 2008

Windows Vista

Windows Server 2008 R2

Windows 7

Windows 8 Preview


Often, we end-up with perfmon log (.blg) files that are pretty big, in the 350+ MB files.

Have you tried opening a perfmon log that is about 750 MB in size? 

The opening of the .blg file is not so bad.  But when you start trying to add a counter, the time it takes is like forever. 

Note:  This happens even on a machine that has 16GB of RAM and an i7 core which is not too bad for today’s standards for a desktop or a laptop.

Setting the collection interval is very critical to collecting enough data and not collecting too much data.


Note:  The sample interval is set to 15 seconds by default.

So what should you do?

Use the following table to correctly set the interval. (This is only a guideline)


Note: If you do set it to 1 second, it could tax your system.

There is only a few reasons that you should ever set it to a 1 second interval such as trying to find the parent process of a process.


You should always setup two (2) perfmon logs.

One called ShortInterval (choose any of the ones from 2 seconds to 5 seconds)

A second one called LongInterval (choose any of the ones from 10 seconds to 7200 seconds).


Why should you always setup two (2) perfmon logs?

To make sure that you have a nice overview over a long period of time, so you could spot trending. 

Such as when backups run, the amount of disk i/o, cpu and memory consumption goes up.


when it’s normal business hours from 8:00 a.m. until 5:00 p.m. (or 9:00 a.m. until 6:00 p.m.) you could see what the load looks like.


The short period of time, is for being able to see items such as something kicking off that triggers the problem that you are seeing.


if you are troubleshooting high disk i/o, since disk i/o’s are done in the milliseconds (ms).


Once you have set the sample interval, make sure that you limit the file size to 350 MB Binary Circular.



The key is to stop the perfmon as soon as the problem has occurred.

Don’t forget to make your life easier by using my colleagues Clint Huffman’s PAL (Performance Analysis of Logs) to setup the counters using the templates available there and doing an analysis (