Task Manager shows this second. A counter log shows the last hour, the spike nobody was watching and the trend after a change. logman records it, relog converts it, and you read the numbers instead of guessing.
Create a collector with **logman create counter**, start and stop it, then convert the result with **relog -f csv** and read it with **Import-Csv**. Sampling every 5 seconds for ten minutes catches most spikes.
**Get-Counter -ListSet** lists what the machine can measure. Four counters cover most investigations: processor time, available memory, disk queue length and the object you suspect.
Get-Counter -ListSet * | Where-Object CounterSetName -match 'Processor|Memory|PhysicalDisk|Network' | Select-Object CounterSetName
Get-Counter -ListSet 'Processor' | Select-Object -ExpandProperty Counter**logman** writes the same data as the graphical collector set, with the settings visible in the command you ran. **-si 5** is the sample interval and **-cnf** the end time.
New-Item -ItemType Directory C:\Perf -Force | Out-Null
logman create counter PerfLog -f csv -o C:\Perf\perf -si 5 -cnf 00:10:00 -c "\Processor(_Total)\% Processor Time" "\Memory\Available MBytes" "\PhysicalDisk(_Total)\Avg. Disk Queue Length" "\System\Processor Queue Length"
logman start PerfLog
logman query PerfLogA log without the event in it proves nothing. Note the wall clock time when the slowdown starts, then read the matching rows in the CSV — that is where the value spikes.
Get-Date -Format o
:: reproduce the slow copy, game load or compile now, then
logman stop PerfLog
Get-ChildItem C:\Perf | Select-Object Name,Length,LastWriteTimeThe native collector format is binary. **relog** turns it into CSV with one row per sample, and the first three lines of a logman CSV are headers and metadata.
relog C:\Perf\perf_000001.blg -f csv -o C:\Perf\perf.csv -y
Get-Content C:\Perf\perf.csv -TotalCount 5
Import-Csv C:\Perf\perf.csv | Select-Object -First 3 | Format-ListThe header row carries the machine name and the counter path, so the column names are ugly but usable. Picking the column by pattern keeps the command the same on every PC.
$rows = Import-Csv C:\Perf\perf.csv
$col = ($rows[0].psobject.Properties | Where-Object Name -like '*Processor Time').Name
$rows | Sort-Object { [double]$_.$col } -Descending | Select-Object -First 5
$mem = ($rows[0].psobject.Properties | Where-Object Name -like '*Available MBytes').Name
$rows | Measure-Object -Property $mem -Minimum -AverageCollectors keep running after you forget them. Delete the collector, keep one CSV with the timestamp in its name, and store it beside your notes.
logman delete PerfLog
Copy-Item C:\Perf\perf.csv ("C:\Perf\keep-{0}.csv" -f (Get-Date -f yyyyMMdd-HHmm))
Get-ChildItem C:\Perf | Select-Object Name,LengthA previous run left it behind. Delete it with logman delete <name> and create it again; the settings are in the command anyway.
The output folder needs write access for the account running the collector, and -o takes a prefix, not a full filename with extension.
That counter describes queued requests, not latency. Record Average Disk sec/Transfer as well before blaming the drive.
The header contains the machine name and the counter path with escaped backslashes. Rename the properties after import or use -f TSV for a simpler split.
Ten minutes around the event beats 24 hours of noise. Long logs mainly prove that nothing happened.
Reading counters works for most sets, creating a collector needs elevation because it registers a data collector set.
Delete the collector with logman delete PerfLog and remove the files under C:\Perf that you do not need. Nothing else was changed on the system.
Free · no account needed · tracks your progress