---

Windows provides two extremely powerful built-in tools for performance diagnosis:

• PerfMon (Performance Monitor)
• Resource Monitor (ResMon)

Both are essential for SRE, DevOps, Performance Engineering, .NET Developers, Windows Admins, and Troubleshooting Teams.

Even though they complement each other, they serve different purposes, work in different ways, and are used in different scenarios.

This tutorial explains:

✔ What each tool is
✔ Why it exists
✔ When to use which one
✔ Architecture
✔ Key features
✔ Deep comparison
✔ Step-by-step usage
✔ Counters, views, and analysis
✔ Use cases
✔ Advantages & Limitations

---

🔵 1. Introduction

Windows performance diagnostics usually require two types of tools:

1. Long-term, counter-based, low-overhead monitoring → PerfMon
2. Real-time, process-level investigation → Resource Monitor

Understanding both is mandatory to diagnose:

• High CPU
• Memory leaks
• Disk I/O bottlenecks
• Network latency
• API/server slowdown
• SQL and .NET GC pressure
• Thread deadlocks
• Suspicious connections

---

🔵 2. What is PerfMon (Performance Monitor)?

PerfMon is a counter-based performance analysis tool built into Windows.

PerfMon Allows You To:

• Monitor thousands of Windows Performance Counters
• Track CPU, Memory, Disk, Network metrics
• Monitor .NET CLR (GC, Exceptions, Threads)
• Monitor IIS, SQL Server, Application Pools
• Create Data Collector Sets to log data over hours/days
• Collect trends during load testing
• Export performance logs (BLG/CSV)

PerfMon is the official tool for Windows performance engineering.

---

🔵 3. What is Resource Monitor (resmon.exe)?

Resource Monitor is a real-time diagnostic and troubleshooting tool.

ResMon Provides:

• Per-process CPU usage
• Disk activity per file
• Network activity per connection
• Memory usage, hard faults, Working Set
• Handles, Modules, Threads
• TCP/IP remote address mapping
• Live graphs for CPU, Disk, Memory, Network

ResMon is essentially Task Manager on steroids.

---

🔵 4. Why Windows Provides Two Different Tools

These tools solve different problems:

🎯 PerfMon = Deep, long-term performance analysis

• Long-term capture
• Low overhead
• Counter-based
• Used for load testing and metrics correlation
• Supports .NET, SQL, IIS counters

🎯 Resource Monitor = Immediate process-level diagnosis

• Instant
• Real-time
• Shows files, ports, connections, and threads
• Shows EXACTLY which process is the culprit
• Used for troubleshooting

Both tools complement each other, not replace each other.

---

🔵 5. PerfMon Architecture vs Resource Monitor Architecture

PerfMon Architecture

Performance Counters → PerfMon Collector → Graph / Report / DCS Logs

PerfMon uses:

• CPU counters
• Memory counters
• Disk counters
• Network counters
• .NET CLR counters
• SQL performance counters
• IIS counters

It reads metrics exposed through Windows Performance Counter API.

---

Resource Monitor Architecture

Windows Kernel → ResMon → Real-time CPU/Disk/Memory/Network Data

ResMon reads data directly from:

• I/O Manager
• Memory Manager
• NTFS driver
• TCP/IP stack
• Scheduler

It displays:

• Which file is being accessed
• Which IP/port a process is talking to
• How many bytes/sec a process is consuming

---

🔵 6. PerfMon — Key Capabilities

✔ Tracks metrics historically
✔ Supports Data Collector Sets
✔ Records 1–24 hour logs
✔ Helps in load test analysis
✔ Shows slow API correlations
✔ Supports over 5000 counters
✔ Lightweight, low overhead
✔ Supports Remote Server Monitoring
✔ Provides reports

PerfMon is used by:

• Performance Engineers
• SRE
• DevOps
• QA Load Test Teams
• .NET Developers
• DBAs

---

🔵 7. Resource Monitor — Key Capabilities

✔ REAL-TIME (per second) monitoring
✔ Per-process insights
✔ Per-file disk activity
✔ Per-port network activity
✔ Thread and handle analysis
✔ Network connections with remote IP mapping
✔ Deadlock detection via “Analyze Wait Chain”
✔ Hard Faults/sec per process
✔ Suspend/Kill process
✔ Filter entire UI by one process

Resource Monitor is essential for:

• Investigating immediate spikes
• Debugging suspicious traffic
• File-level disk analysis
• Thread starvation & deadlocks
• Live troubleshooting

---

🔵 8. PerfMon vs Resource Monitor: Detailed Feature Comparison

Feature	PerfMon	Resource Monitor
Real-Time Monitoring	✔ Yes	✔ Yes (more granular)
Historical Logging	✔ Yes (DCS)	✘ No
.NET CLR Counters	✔ Yes	✘ No
SQL/IIS Counters	✔ Yes	✘ No
Per-Process Details	Partial	✔ Full
Per-Thread Details	✘ No	✔ Yes
Per-File Disk I/O	✘ No	✔ Yes
Per-Port Network	✘ No	✔ Yes
Disk Queue Length	✔ Yes	✔ Per Process
Hard Faults	✔ System-wide	✔ Per-process
Long-term load testing	✔ Yes	✘ No
Quick troubleshooting	Medium	✔ Best
Deadlock detection	✘ No	✔ Analyze Wait Chain

---

🔵 9. How to Use PerfMon (Step-by-Step)

Step 1 — Launch

Win + R → perfmon

Step 2 — Open Performance Monitor (Graph)

➜ Add counters using the + icon

Step 3 — Add critical counters

• CPU
• Memory
• Disk
• Network
• .NET CLR
• SQL

Step 4 — Create Data Collector Set (DCS)

• User Defined → New
• Add counters
• Set sample interval (1 sec / 5 sec)
• Save to BLG

Step 5 — Run Load Test / Production Debug

PerfMon will collect data in background.

Step 6 — Analyze Reports

Reports → User Defined → Performance Logs

PerfMon is used for long-term, in-depth analysis.

---

🔵 10. How to Use Resource Monitor (Step-by-Step)

Step 1 — Launch

Win + R → resmon

Step 2 — Overview Tab

Shows combined CPU, Disk, Memory, Network activity.

Step 3 — CPU Tab

• Identify high CPU process
• Expand Threads
• Use “Analyze Wait Chain”
• See loaded modules

Step 4 — Memory Tab

• Watch Hard Faults/sec
• Sort by Private KB / Working Set
• Detect leaks

Step 5 — Disk Tab

• Sort by Total B/sec
• View file access paths
• See disk queue length

Step 6 — Network Tab

• Sort by network usage
• See remote IPs & ports
• Find connection failures

Resource Monitor is for immediate diagnosis.

---

🔵 11. Use Cases (Side-by-Side)

✔ High CPU

• PerfMon → CPU trend
• ResMon → identify problem process immediately

✔ Memory Leak

• PerfMon → long-term memory curve
• ResMon → which process grows live

✔ Slow Disk

• PerfMon → Disk latency & queue length
• ResMon → which file/process is hammering disk

✔ Slow API

• PerfMon → server load correlation
• ResMon → network connection slowdown

✔ SQL Server Slowness

• PerfMon → SQL counters
• ResMon → see disk load from SQL process

✔ Malware or Suspicious Traffic

• PerfMon → cannot detect
• ResMon → shows exact port & IP

---

🔵 12. Advantages & Limitations

PerfMon Advantages

• Very low overhead
• Huge range of counters
• Long-duration monitoring
• Perfect for load tests
• Excellent for .NET/SQL apps

PerfMon Limitations

• No real-time per-process details
• Cannot see file paths
• No per-port network data
• Requires setup

---

Resource Monitor Advantages

• Real-time, instant insights
• Shows per-file, per-thread, per-port activity
• Great for immediate incident response
• Perfect for debugging slow servers

Resource Monitor Limitations

• Cannot log long-term
• No deep counters (.NET/IIS/SQL)
• Not suitable for load test correlation
• No report automation

---

🔵 13. When to Use Which Tool (Decision Guide)

Use PERFMON if you need:

• Historical performance trends
• Load test metrics
• Deep OS and .NET counters
• SQL/IIS performance visibility
• Long-term bottleneck analysis
• Day-to-day performance engineering

Use RESOURCE MONITOR if:

• System is slow RIGHT NOW
• Need to see exact process causing trouble
• Disk or network is acting strange
• Memory leaking at this moment
• Suspicious connections
• You need quick root cause

---

🔵 14. Summary

PerfMon and Resource Monitor are complementary tools:

• PerfMon = deep, long-term analysis
• ResMon = real-time process-level diagnosis

Together, they provide the complete Windows performance toolbox needed for:

• SRE
• DevOps
• Windows Admins
• Developers
• Performance Testers

PerfMon helps you understand WHY things happen.
Resource Monitor helps you catch WHAT is happening right now.

---