3 The System performance object consists of counters that apply to more than one instance of a component processors on the computer. 5 The Memory performance object consists of counters that describe the behavior of physical and virtual memory on the computer. Physical memory is the amount of random access memory on the computer. Virtual memory consists of the space in physical memory and on disk. Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory. Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes. 7 % Processor Time is the percentage of elapsed time that the processor spends to execute a non-Idle thread. It is calculated by measuring the duration of the idle thread is active in the sample interval, and subtracting that time from interval duration. (Each processor has an idle thread that consumes cycles when no other threads are ready to run). This counter is the primary indicator of processor activity, and displays the average percentage of busy time observed during the sample interval. It is calculated by monitoring the time that the service is inactive, and subtracting that value from 100%. 9 % Total DPC Time is the average percentage of time that all processors spend receiving and servicing deferred procedure calls (DPCs). (DPCs are interrupts that run at a lower priority than the standard interrupts). It is the sum of Processor: % DPC Time for all processors on the computer, divided by the number of processors. System: % Total DPC Time is a component of System: % Total Privileged Time because DPCs are executed in privileged mode. DPCs are counted separately and are not a component of the interrupt count. This counter displays the average busy time as a percentage of the sample time. 11 File Read Operations/sec is the combined rate of file system read requests to all devices on the computer, including requests to read from the file system cache. It is measured in numbers of reads. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval. 13 File Write Operations/sec is the combined rate of the file system write requests to all devices on the computer, including requests to write to data in the file system cache. It is measured in numbers of writes. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval. 15 File Control Operations/sec is the combined rate of file system operations that are neither reads nor writes, such as file system control requests and requests for information about device characteristics or status. This is the inverse of System: File Data Operations/sec and is measured in number of operations perf second. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval. 17 File Read Bytes/sec is the overall rate at which bytes are read to satisfy file system read requests to all devices on the computer, including reads from the file system cache. It is measured in number of bytes per second. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval. 19 File Write Bytes/sec is the overall rate at which bytes are written to satisfy file system write requests to all devices on the computer, including writes to the file system cache. It is measured in number of bytes per second. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval. 21 File Control Bytes/sec is the overall rate at which bytes are transferred for all file system operations that are neither reads nor writes, including file system control requests and requests for information about device characteristics or status. It is measured in numbers of bytes. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval. 23 % Total Interrupt Time is the average percentage of time that all processors spend receiving and servicing hardware interrupts during sample intervals, where the value is an indirect indicator of the activity of devices that generate interrupts. It is the sum of Processor: % Interrupt Time for of all processors on the computer, divided by the number of processors. DPCs are counted separately and are not a component of the interrupt count. This value is an indirect indicator of the activity of devices that generate interrupts, such as the system timer, the mouse, disk drivers, data communication lines, network interface cards and other peripheral devices. 25 Available Bytes is the amount of physical memory, in bytes, available to processes running on the computer. It is calculated by adding the amount of space on the Zeroed, Free, and Standby memory lists. Free memory is ready for use; Zeroed memory consists of pages of memory filled with zeros to prevent subsequent processes from seeing data used by a previous process; Standby memory is memory that has been removed from a process' working set (its physical memory) on route to disk, but is still available to be recalled. This counter displays the last observed value only; it is not an average. 27 Committed Bytes is the amount of committed virtual memory, in bytes. Committed memory is the physical memory which has space reserved on the disk paging file(s). There can be one or more paging files on each physical drive. This counter displays the last observed value only; it is not an average. 29 Page Faults/sec is the average number of pages faulted per second. It is measured in number of pages faulted per second because only one page is faulted in each fault operation, hence this is also equal to the number of page fault operations. This counter includes both hard faults (those that require disk access) and soft faults (where the faulted page is found elsewhere in physical memory.) Most processors can handle large numbers of soft faults without significant consequence. However, hard faults, which require disk access, can cause significant delays. 31 Commit Limit is the amount of virtual memory that can be committed without having to extend the paging file(s). It is measured in bytes. Committed memory is the physical memory which has space reserved on the disk paging files. There can be one paging file on each logical drive). If the paging file(s) are be expanded, this limit increases accordingly. This counter displays the last observed value only; it is not an average. 33 Write Copies/sec is the rate at which page faults are caused by attempts to write that have been satisfied by coping of the page from elsewhere in physical memory. This is an economical way of sharing data since pages are only copied when they are written to; otherwise, the page is shared. This counter shows the number of copies, without regard for the number of pages copied in each operation. 35 Transition Faults/sec is the rate at which page faults are resolved by recovering pages that were being used by another process sharing the page, or were on the modified page list or the standby list, or were being written to disk at the time of the page fault. The pages were recovered without additional disk activity. Transition faults are counted in numbers of faults; because only one page is faulted in each operation, it is also equal to the number of pages faulted. 37 Cache Faults/sec is the rate at which faults occur when a page sought in the file system cache is not found and must be retrieved from elsewhere in memory (a soft fault) or from disk (a hard fault). The file system cache is an area of physical memory that stores recently used pages of data for applications. Cache activity is a reliable indicator of most application I/O operations. This counter shows the number of faults, without regard for the number of pages faulted in each operation. 39 Demand Zero Faults/sec is the rate at which a zeroed page is required to satisfy the fault. Zeroed pages, pages emptied of previously stored data and filled with zeros, are a security feature of Windows that prevent processes from seeing data stored by earlier processes that used the memory space. Windows maintains a list of zeroed pages to accelerate this process. This counter shows the number of faults, without regard to the number of pages retrieved to satisfy the fault. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval. 41 Pages/sec is the rate at which pages are read from or written to disk to resolve hard page faults. This counter is a primary indicator of the kinds of faults that cause system-wide delays. It is the sum of Memory\\Pages Input/sec and Memory\\Pages Output/sec. It is counted in numbers of pages, so it can be compared to other counts of pages, such as Memory\\Page Faults/sec, without conversion. It includes pages retrieved to satisfy faults in the file system cache (usually requested by applications) non-cached mapped memory files. 43 Page Reads/sec is the rate at which the disk was read to resolve hard page faults. It shows the number of reads operations, without regard to the number of pages retrieved in each operation. Hard page faults occur when a process references a page in virtual memory that is not in working set or elsewhere in physical memory, and must be retrieved from disk. This counter is a primary indicator of the kinds of faults that cause system-wide delays. It includes read operations to satisfy faults in the file system cache (usually requested by applications) and in non-cached mapped memory files. Compare the value of Memory\\Pages Reads/sec to the value of Memory\\Pages Input/sec to determine the average number of pages read during each operation. 45 Processor Queue Length is the number of threads in the processor queue. Unlike the disk counters, this counter counters, this counter shows ready threads only, not threads that are running. There is a single queue for processor time even on computers with multiple processors. Therefore, if a computer has multiple processors, you need to divide this value by the number of processors servicing the workload. A sustained processor queue of less than 10 threads per processor is normally acceptable, dependent of the workload. 47 Thread State is the current state of the thread. It is 0 for Initialized, 1 for Ready, 2 for Running, 3 for Standby, 4 for Terminated, 5 for Wait, 6 for Transition, 7 for Unknown. A Running thread is using a processor; a Standby thread is about to use one. A Ready thread wants to use a processor, but is waiting for a processor because none are free. A thread in Transition is waiting for a resource in order to execute, such as waiting for its execution stack to be paged in from disk. A Waiting thread has no use for the processor because it is waiting for a peripheral operation to complete or a resource to become free. 49 Pages Output/sec is the rate at which pages are written to disk to free up space in physical memory. Pages are written back to disk only if they are changed in physical memory, so they are likely to hold data, not code. A high rate of pages output might indicate a memory shortage. Windows writes more pages back to disk to free up space when physical memory is in short supply. This counter shows the number of pages, and can be compared to other counts of pages, without conversion. 51 Page Writes/sec is the rate at which pages are written to disk to free up space in physical memory. Pages are written to disk only if they are changed while in physical memory, so they are likely to hold data, not code. This counter shows write operations, without regard to the number of pages written in each operation. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval. 53 The Browser performance object consists of counters that measure the rates of announcements, enumerations, and other Browser transmissions. 55 Announcements Server/sec is the rate at which the servers in this domain have announced themselves to this server. 57 Pool Paged Bytes is the size, in bytes, of the paged pool, an area of system memory (physical memory used by the operating system) for objects that can be written to disk when they are not being used. Memory\\Pool Paged Bytes is calculated differently than Process\\Pool Paged Bytes, so it might not equal Process\\Pool Paged Bytes\\_Total. This counter displays the last observed value only; it is not an average. 59 Pool Nonpaged Bytes is the size, in bytes, of the nonpaged pool, an area of system memory (physical memory used by the operating system) for objects that cannot be written to disk, but must remain in physical memory as long as they are allocated. Memory\\Pool Nonpaged Bytes is calculated differently than Process\\Pool Nonpaged Bytes, so it might not equal Process\\Pool Nonpaged Bytes\\_Total. This counter displays the last observed value only; it is not an average. 61 Pool Paged Allocs is the number of calls to allocate space in the paged pool. The paged pool is an area of system memory (physical memory used by the operating system) for objects that can be written to disk when they are not being used. It is measured in numbers of calls to allocate space, regardless of the amount of space allocated in each call. This counter displays the last observed value only; it is not an average. 63 Pool Paged Resident Bytes is the current size, in bytes, of the paged pool. The paged pool is an area of system memory (physical memory used by the operating system) for objects that can be written to disk when they are not being used. Space used by the paged and nonpaged pools are taken from physical memory, so a pool that is too large denies memory space to processes. This counter displays the last observed value only; it is not an average. 65 Pool Nonpaged Allocs is the number of calls to allocate space in the nonpaged pool. The nonpaged pool is an area of system memory area for objects that cannot be written to disk, and must remain in physical memory as long as they are allocated. It is measured in numbers of calls to allocate space, regardless of the amount of space allocated in each call. This counter displays the last observed value only; it is not an average. 67 Bytes Total/sec is the total rate of bytes sent to or received from the network by the protocol, but only for the frames (packets) which carry data. This is the sum of Frame Bytes/sec and Datagram Bytes/sec. 69 System Code Total Bytes is the size, in bytes, of the pageable operating system code currently in virtual memory. It is a measure of the amount of physical memory being used by the operating system that can be written to disk when not in use. This value is calculated by summing the bytes in Ntoskrnl.exe, Hal.dll, the boot drivers, and file systems loaded by Ntldr/osloader. This counter does not include code that must remain in physical memory and cannot be written to disk. This counter displays the last observed value only; it is not an average. 71 System Code Resident Bytes is the size, in bytes of the operating system code currently in physical memory that can be written to disk when not in use. This value is a component of Memory\\System Code Total Bytes, which also includes operating system code on disk. Memory\\System Code Resident Bytes (and Memory\\System Code Total Bytes) does not include code that must remain in physical memory and cannot be written to disk. This counter displays the last observed value only; it is not an average. 73 System Driver Total Bytes is the size, in bytes, of the pageable virtual memory currently being used by device drivers. Pageable memory can be written to disk when it is not being used. It includes physical memory (Memory\\System Driver Resident Bytes) and code and data paged to disk. It is a component of Memory\\System Code Total Bytes. This counter displays the last observed value only; it is not an average. 75 System Driver Resident Bytes is the size, in bytes, of the pageable physical memory being used by device drivers. It is the working set (physical memory area) of the drivers. This value is a component of Memory\\System Driver Total Bytes, which also includes driver memory that has been written to disk. Neither Memory\\System Driver Resident Bytes nor Memory\\System Driver Total Bytes includes memory that cannot be written to disk. 77 System Cache Resident Bytes is the size, in bytes, of the pageable operating system code in the file system cache. This value includes only current physical pages and does not include any virtual memory pages not currently resident. It does equal the System Cache value shown in Task Manager. As a result, this value may be smaller than the actual amount of virtual memory in use by the file system cache. This value is a component of Memory\\System Code Resident Bytes which represents all pageable operating system code that is currently in physical memory. This counter displays the last observed value only; it is not an average. 79 Announcements Domain/sec is the rate at which a domain has announced itself to the network. 81 Election Packets/sec is the rate at which browser election packets have been received by this workstation. 83 Mailslot Writes/sec is the rate at which mailslot messages have been successfully received. 85 Server List Requests/sec is the rate at which requests to retrieve a list of browser servers have been processed by this workstation. 87 The Cache performance object consists of counters that monitor the file system cache, an area of physical memory that stores recently used data as long as possible to permit access to the data without having to read from the disk. Because applications typically use the cache, the cache is monitored as an indicator of application I/O operations. When memory is plentiful, the cache can grow, but when memory is scarce, the cache can become too small to be effective. 89 Data Maps/sec is the frequency that a file system such as NTFS, maps a page of a file into the file system cache to read the page. 91 Sync Data Maps/sec counts the frequency that a file system, such as NTFS, maps a page of a file into the file system cache to read the page, and wishes to wait for the page to be retrieved if it is not in main memory. 93 Async Data Maps/sec is the frequency that an application using a file system, such as NTFS, to map a page of a file into the file system cache to read the page, and does not wait for the page to be retrieved if it is not in main memory. 95 Data Map Hits is the percentage of data maps in the file system cache that could be resolved without having to retrieve a page from the disk, because the page was already in physical memory. 97 Data Map Pins/sec is the frequency of data maps in the file system cache that resulted in pinning a page in main memory, an action usually preparatory to writing to the file on disk. While pinned, a page's physical address in main memory and virtual address in the file system cache will not be altered. 99 Pin Reads/sec is the frequency of reading data into the file system cache preparatory to writing the data back to disk. Pages read in this fashion are pinned in memory at the completion of the read. While pinned, a page's physical address in the file system cache will not be altered. 101 Sync Pin Reads/sec is the frequency of reading data into the file system cache preparatory to writing the data back to disk. Pages read in this fashion are pinned in memory at the completion of the read. The file system will not regain control until the page is pinned in the file system cache, in particular if the disk must be accessed to retrieve the page. While pinned, a page's physical address in the file system cache will not be altered. 103 Async Pin Reads/sec is the frequency of reading data into the file system cache preparatory to writing the data back to disk. Pages read in this fashion are pinned in memory at the completion of the read. The file system will regain control immediately even if the disk must be accessed to retrieve the page. While pinned, a page's physical address will not be altered. 105 Pin Read Hits is the percentage of pin read requests that hit the file system cache, i.e., did not require a disk read in order to provide access to the page in the file system cache. While pinned, a page's physical address in the file system cache will not be altered. The LAN Redirector uses this method for retrieving data from the cache, as does the LAN Server for small transfers. This is usually the method used by the disk file systems as well. 107 Copy Reads/sec is the frequency of reads from pages of the file system cache that involve a memory copy of the data from the cache to the application's buffer. The LAN Redirector uses this method for retrieving information from the file system cache, as does the LAN Server for small transfers. This is a method used by the disk file systems as well. 109 Sync Copy Reads/sec is the frequency of reads from pages of the file system cache that involve a memory copy of the data from the cache to the application's buffer. The file system will not regain control until the copy operation is complete, even if the disk must be accessed to retrieve the page. 111 Async Copy Reads/sec is the frequency of reads from pages of the file system cache that involve a memory copy of the data from the cache to the application's buffer. The application will regain control immediately even if the disk must be accessed to retrieve the page. 113 Copy Read Hits is the percentage of cache copy read requests that hit the cache, that is, they did not require a disk read in order to provide access to the page in the cache. A copy read is a file read operation that is satisfied by a memory copy from a page in the cache to the application's buffer. The LAN Redirector uses this method for retrieving information from the cache, as does the LAN Server for small transfers. This is a method used by the disk file systems as well. 115 MDL Reads/sec is the frequency of reads from the file system cache that use a Memory Descriptor List (MDL) to access the data. The MDL contains the physical address of each page involved in the transfer, and thus can employ a hardware Direct Memory Access (DMA) device to effect the copy. The LAN Server uses this method for large transfers out of the server. 117 Sync MDL Reads/sec is the frequency of reads from the file system cache that use a Memory Descriptor List (MDL) to access the pages. The MDL contains the physical address of each page in the transfer, thus permitting Direct Memory Access (DMA) of the pages. If the accessed page(s) are not in main memory, the caller will wait for the pages to fault in from the disk. 119 Async MDL Reads/sec is the frequency of reads from the file system cache that use a Memory Descriptor List (MDL) to access the pages. The MDL contains the physical address of each page in the transfer, thus permitting Direct Memory Access (DMA) of the pages. If the accessed page(s) are not in main memory, the calling application program will not wait for the pages to fault in from disk. 121 MDL Read Hits is the percentage of Memory Descriptor List (MDL) Read requests to the file system cache that hit the cache, i.e., did not require disk accesses in order to provide memory access to the page(s) in the cache. 123 Read Aheads/sec is the frequency of reads from the file system cache in which the Cache detects sequential access to a file. The read aheads permit the data to be transferred in larger blocks than those being requested by the application, reducing the overhead per access. 125 Fast Reads/sec is the frequency of reads from the file system cache that bypass the installed file system and retrieve the data directly from the cache. Normally, file I/O requests invoke the appropriate file system to retrieve data from a file, but this path permits direct retrieval of data from the cache without file system involvement if the data is in the cache. Even if the data is not in the cache, one invocation of the file system is avoided. 127 Sync Fast Reads/sec is the frequency of reads from the file system cache that bypass the installed file system and retrieve the data directly from the cache. Normally, file I/O requests invoke the appropriate file system to retrieve data from a file, but this path permits direct retrieval of data from the cache without file system involvement if the data is in the cache. Even if the data is not in the cache, one invocation of the file system is avoided. If the data is not in the cache, the request (application program call) will wait until the data has been retrieved from disk. 129 Async Fast Reads/sec is the frequency of reads from the file system cache that bypass the installed file system and retrieve the data directly from the cache. Normally, file I/O requests will invoke the appropriate file system to retrieve data from a file, but this path permits data to be retrieved from the cache directly (without file system involvement) if the data is in the cache. Even if the data is not in the cache, one invocation of the file system is avoided. If the data is not in the cache, the request (application program call) will not wait until the data has been retrieved from disk, but will get control immediately. 131 Fast Read Resource Misses/sec is the frequency of cache misses necessitated by the lack of available resources to satisfy the request. 133 Fast Read Not Possibles/sec is the frequency of attempts by an Application Program Interface (API) function call to bypass the file system to get to data in the file system cache that could not be honored without invoking the file system. 135 Lazy Write Flushes/sec is the rate at which the Lazy Writer thread has written to disk. Lazy Writing is the process of updating the disk after the page has been changed in memory, so that the application that changed the file does not have to wait for the disk write to be complete before proceeding. More than one page can be transferred by each write operation. 137 Lazy Write Pages/sec is the rate at which the Lazy Writer thread has written to disk. Lazy Writing is the process of updating the disk after the page has been changed in memory, so that the application that changed the file does not have to wait for the disk write to be complete before proceeding. More than one page can be transferred on a single disk write operation. 139 Data Flushes/sec is the rate at which the file system cache has flushed its contents to disk as the result of a request to flush or to satisfy a write-through file write request. More than one page can be transferred on each flush operation. 141 Data Flush Pages/sec is the number of pages the file system cache has flushed to disk as a result of a request to flush or to satisfy a write-through file write request. More than one page can be transferred on each flush operation. 143 % User Time is the percentage of elapsed time the processor spends in the user mode. User mode is a restricted processing mode designed for applications, environment subsystems, and integral subsystems. The alternative, privileged mode, is designed for operating system components and allows direct access to hardware and all memory. The operating system switches application threads to privileged mode to access operating system services. This counter displays the average busy time as a percentage of the sample time. 145 % Privileged Time is the percentage of elapsed time that the process threads spent executing code in privileged mode. When a Windows system service in called, the service will often run in privileged mode to gain access to system-private data. Such data is protected from access by threads executing in user mode. Calls to the system can be explicit or implicit, such as page faults or interrupts. Unlike some early operating systems, Windows uses process boundaries for subsystem protection in addition to the traditional protection of user and privileged modes. Some work done by Windows on behalf of the application might appear in other subsystem processes in addition to the privileged time in the process. 147 Context Switches/sec is the combined rate at which all processors on the computer are switched from one thread to another. Context switches occur when a running thread voluntarily relinquishes the processor, is preempted by a higher priority ready thread, or switches between user-mode and privileged (kernel) mode to use an Executive or subsystem service. It is the sum of Thread\\Context Switches/sec for all threads running on all processors in the computer and is measured in numbers of switches. There are context switch counters on the System and Thread objects. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval. 149 Interrupts/sec is the average rate, in incidents per second, at which the processor received and serviced hardware interrupts. It does not include deferred procedure calls (DPCs), which are counted separately. This value is an indirect indicator of the activity of devices that generate interrupts, such as the system clock, the mouse, disk drivers, data communication lines, network interface cards, and other peripheral devices. These devices normally interrupt the processor when they have completed a task or require attention. Normal thread execution is suspended. The system clock typically interrupts the processor every 10 milliseconds, creating a background of interrupt activity. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval. 151 System Calls/sec is the combined rate of calls to operating system service routines by all processes running on the computer. These routines perform all of the basic scheduling and synchronization of activities on the computer, and provide access to non-graphic devices, memory management, and name space management. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval. 153 Level 1 TLB Fills/sec is the frequency of faults that occur when reference is made to memory whose Page Table Entry (PTE) is not in the Translation Lookaside Buffer (TLB). On some computers this fault is handled by software loading the PTE into the TLB, and this counter is incremented. 155 Level 2 TLB Fills/sec is the frequency of faults that occur when reference is made to memory whose Page Table Entry (PTE) is not in the Translation Lookaside Buffer (TLB), nor is the page containing the PTE. On some computers this fault is handled by software loading the PTE into the TLB, and this counter is incremented. 157 % User Time is the percentage of elapsed time that the process threads spent executing code in user mode. Applications, environment subsystems, and integral subsystems execute in user mode. Code executing in user mode cannot damage the integrity of the Windows executive, kernel, and device drivers. Unlike some early operating systems, Windows uses process boundaries for subsystem protection in addition to the traditional protection of user and privileged modes. Some work done by Windows on behalf of the application might appear in other subsystem processes in addition to the privileged time in the process. 159 % Privileged Time is the percentage of elapsed time that the process threads spent executing code in privileged mode. When a Windows system service is called, the service will often run in privileged mode to gain access to system-private data. Such data is protected from access by threads executing in user mode. Calls to the system can be explicit or implicit, such as page faults or interrupts. Unlike some early operating systems, Windows uses process boundaries for subsystem protection in addition to the traditional protection of user and privileged modes. Some work done by Windows on behalf of the application might appear in other subsystem processes in addition to the privileged time in the process. 161 Enumerations Server/sec is the rate at which server browse requests have been processed by this workstation. 163 Enumerations Domain/sec is the rate at which domain browse requests have been processed by this workstation. 165 Enumerations Other/sec is the rate at which browse requests processed by this workstation are not domain or server browse requests. 167 Missed Server Announcements is the number of server announcements that have been missed due to configuration or allocation limits. 169 Missed Mailslot Datagrams is the number of Mailslot Datagrams that have been discarded due to configuration or allocation limits. 171 Missed Server List Requests is the number of requests to retrieve a list of browser servers that were received by this workstation, but could not be processed. 173 Virtual Bytes Peak is the maximum size, in bytes, of virtual address space the process has used at any one time. Use of virtual address space does not necessarily imply corresponding use of either disk or main memory pages. However, virtual space is finite, and the process might limit its ability to load libraries. 175 Virtual Bytes is the current size, in bytes, of the virtual address space the process is using. Use of virtual address space does not necessarily imply corresponding use of either disk or main memory pages. Virtual space is finite, and the process can limit its ability to load libraries. 177 Page Faults/sec is the rate at which page faults by the threads executing in this process are occurring. A page fault occurs when a thread refers to a virtual memory page that is not in its working set in main memory. This may not cause the page to be fetched from disk if it is on the standby list and hence already in main memory, or if it is in use by another process with whom the page is shared. 179 Working Set Peak is the maximum size, in bytes, of the Working Set of this process at any point in time. The Working Set is the set of memory pages touched recently by the threads in the process. If free memory in the computer is above a threshold, pages are left in the Working Set of a process even if they are not in use. When free memory falls below a threshold, pages are trimmed from Working Sets. If they are needed they will then be soft-faulted back into the Working Set before they leave main memory. 181 Working Set is the current size, in bytes, of the Working Set of this process. The Working Set is the set of memory pages touched recently by the threads in the process. If free memory in the computer is above a threshold, pages are left in the Working Set of a process even if they are not in use. When free memory falls below a threshold, pages are trimmed from Working Sets. If they are needed they will then be soft-faulted back into the Working Set before leaving main memory. 183 Page File Bytes Peak is the maximum number of bytes this process has used in the paging file(s). Paging files are used to store pages of memory used by the process that are not contained in other files. Paging files are shared by all processes, and the lack of space in paging files can prevent other processes from allocating memory. 185 Page File Bytes is the current number of bytes that this process has used in the paging file(s). Paging files are used to store pages of memory used by the process that are not contained in other files. Paging files are shared by all processes, and the lack of space in paging files can prevent other processes from allocating memory. 187 Private Bytes is the current size, in bytes, of memory that this process has allocated that cannot be shared with other processes. 189 % Processor Time is the percentage of elapsed time that all of process threads used the processor to execution instructions. An instruction is the basic unit of execution in a computer, a thread is the object that executes instructions, and a process is the object created when a program is run. Code executed to handle some hardware interrupts and trap conditions are included in this count. 191 % Processor Time is the percentage of elapsed time that all of process threads used the processor to execution instructions. An instruction is the basic unit of execution in a computer, a thread is the object that executes instructions, and a process is the object created when a program is run. Code executed to handle some hardware interrupts and trap conditions are included in this count. 193 % User Time is the percentage of elapsed time that this thread has spent executing code in user mode. Applications, environment subsystems, and integral subsystems execute in user mode. Code executing in user mode cannot damage the integrity of the Windows NT Executive, Kernel, and device drivers. Unlike some early operating systems, Windows NT uses process boundaries for subsystem protection in addition to the traditional protection of user and privileged modes. These subsystem processes provide additional protection. Therefore, some work done by Windows NT on behalf of your application might appear in other subsystem processes in addition to the privileged time in your process. 195 % Privileged Time is the percentage of elapsed time that the process threads spent executing code in privileged mode. When a Windows system service in called, the service will often run in privileged mode to gain access to system-private data. Such data is protected from access by threads executing in user mode. Calls to the system can be explicit or implicit, such as page faults or interrupts. Unlike some early operating systems, Windows uses process boundaries for subsystem protection in addition to the traditional protection of user and privileged modes. Some work done by Windows on behalf of the application might appear in other subsystem processes in addition to the privileged time in the process. 197 Context Switches/sec is the rate of switches from one thread to another. Thread switches can occur either inside of a single process or across processes. A thread switch can be caused either by one thread asking another for information, or by a thread being preempted by another, higher priority thread becoming ready to run. Unlike some early operating systems, Windows NT uses process boundaries for subsystem protection in addition to the traditional protection of user and privileged modes. These subsystem processes provide additional protection. Therefore, some work done by Windows NT on behalf of an application appear in other subsystem processes in addition to the privileged time in the application. Switching to the subsystem process causes one Context Switch in the application thread. Switching back causes another Context Switch in the subsystem thread. 199 Current Disk Queue Length is the number of requests outstanding on the disk at the time the performance data is collected. It also includes requests in service at the time of the collection. This is a instantaneous snapshot, not an average over the time interval. Multi-spindle disk devices can have multiple requests that are active at one time, but other concurrent requests are awaiting service. This counter might reflect a transitory high or low queue length, but if there is a sustained load on the disk drive, it is likely that this will be consistently high. Requests experience delays proportional to the length of this queue minus the number of spindles on the disks. For good performance, this difference should average less than two. 201 % Disk Time is the percentage of elapsed time that the selected disk drive was busy servicing read or write requests. 203 % Disk Read Time is the percentage of elapsed time that the selected disk drive was busy servicing read requests. 205 % Disk Write Time is the percentage of elapsed time that the selected disk drive was busy servicing write requests. 207 Avg. Disk sec/Transfer is the time, in seconds, of the average disk transfer. 209 Avg. Disk sec/Read is the average time, in seconds, of a read of data from the disk. 211 Avg. Disk sec/Write is the average time, in seconds, of a write of data to the disk. 213 Disk Transfers/sec is the rate of read and write operations on the disk. 215 Disk Reads/sec is the rate of read operations on the disk. 217 Disk Writes/sec is the rate of write operations on the disk. 219 Disk Bytes/sec is the rate bytes are transferred to or from the disk during write or read operations. 221 Disk Read Bytes/sec is the rate at which bytes are transferred from the disk during read operations. 223 Disk Write Bytes/sec is rate at which bytes are transferred to the disk during write operations. 225 Avg. Disk Bytes/Transfer is the average number of bytes transferred to or from the disk during write or read operations. 227 Avg. Disk Bytes/Read is the average number of bytes transferred from the disk during read operations. 229 Avg. Disk Bytes/Write is the average number of bytes transferred to the disk during write operations. 231 The Process performance object consists of counters that monitor running application program and system processes. All the threads in a process share the same address space and have access to the same data. 233 The Thread performance object consists of counters that measure aspects of thread behavior. A thread is the basic object that executes instructions on a processor. All running processes have at least one thread. 235 The Physical Disk performance object consists of counters that monitor hard or fixed disk drive on a computer. Disks are used to store file, program, and paging data and are read to retrieve these items, and written to record changes to them. The values of physical disk counters are sums of the values of the logical disks (or partitions) into which they are divided. 237 The Logical Disk performance object consists of counters that monitor logical partitions of a hard or fixed disk drives. Performance Monitor identifies logical disks by their a drive letter, such as C. 239 The Processor performance object consists of counters that measure aspects of processor activity The processor is the part of the computer that performs arithmetic and logical computations, initiates operations on peripherals, and runs the threads of processes. A computer can have multiple processors. The processor object represents each processor as an instance of the object. 241 % Total Processor Time is the average percentage of time that all processors on the computer are executing non-idle threads. This counter was designed as the primary indicator of processor activity on multiprocessor computers. It is equal to the sum of Process: % Processor Time for all processors, divided by the number of processors. It is calculated by summing the time that all processors spend executing the thread of the Idle process in each sample interval, subtracting that value from 100%, and dividing the difference by the number of processors on the computer. (Each processor has an Idle thread which consumes cycles when no other threads are ready to run). For example, on a multiprocessor computer, a value of 50% means that all processors are busy for half of the sample interval, or that half of the processors are busy for all of the sample interval. This counter displays the average percentage of busy time observed during the sample interval. It is calculated by monitoring the time the service was inactive, and then subtracting that value from 100%. 243 % Total User Time is the average percentage of non-idle time all processors spend in user mode. It is the sum of Processor: % User Time for all processors on the computer, divided by the number of processors. System: % Total User Time and System: % Total Privileged Time sum to % Total Processor Time, but not always to 100%. (User mode is a restricted processing mode designed for applications, environment subsystems, and integral subsystems. The alternative, privileged mode, is designed for operating system components and allows direct access to hardware and all memory. The operating system switches application threads to privileged mode to access operating system services). This counter displays the average busy time as a percentage of the sample time. 245 % Total Privileged Time is the average percentage of non-idle time all processors spend in privileged (kernel) mode. It is the sum of Processor: % Privileged Time for all processors on the computer, divided by the number of processors. System: % Total User Time and System: % Total Privileged Time sum to % Total Processor Time, but not always to 100%. (Privileged mode is an processing mode designed for operating system components which allows direct access to hardware and all memory. The operating system switches application threads to privileged mode to access operating system services. The alternative, user mode, is a restricted processing mode designed for applications and environment subsystems). This counter displays the average busy time as a percentage of the sample time. 247 Total Interrupts/sec is the combined rate of hardware interrupts received and serviced by all processors on the computer It is the sum of Processor: Interrupts/sec for all processors, and divided by the number of processors, and is measured in numbers of interrupts. It does not include DPCs, which are counted separately. This value is an indirect indicator of the activity of devices that generate interrupts, such as the system timer, the mouse, disk drivers, data communication lines, network interface cards and other peripheral devices. These devices normally interrupt the processor when they have completed a task or require attention. Normal thread execution is suspended during interrupts. Most system clocks interrupt the processor every 10 milliseconds, creating a background of interrupt activity. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval. 249 Processes is the number of processes in the computer at the time of data collection. This is an instantaneous count, not an average over the time interval. Each process represents the running of a program. 251 Threads is the number of threads in the computer at the time of data collection. This is an instantaneous count, not an average over the time interval. A thread is the basic executable entity that can execute instructions in a processor. 253 Events is the number of events in the computer at the time of data collection. This is an instantaneous count, not an average over the time interval. An event is used when two or more threads try to synchronize execution. 255 Semaphores is the number of semaphores in the computer at the time of data collection. This is an instantaneous count, not an average over the time interval. Threads use semaphores to obtain exclusive access to data structures that they share with other threads. 257 Mutexes counts the number of mutexes in the computer at the time of data collection. This is an instantaneous count, not an average over the time interval. Mutexes are used by threads to assure only one thread is executing a particular section of code. 259 Sections is the number of sections in the computer at the time of data collection. This is an instantaneous count, not an average over the time interval. A section is a portion of virtual memory created by a process for storing data. A process can share sections with other processes. 261 The Object performance object consists of counters that monitor logical objects in the system, such as processes, threads, mutexes, and semaphores. This information can be used to detect the unnecessary consumption of computer resources. Each object requires memory to store basic information about the object. 263 The Redirector performance object consists of counter that monitor network connections originating at the local computer. 265 Bytes Received/sec is the rate of bytes coming in to the Redirector from the network. It includes all application data as well as network protocol information (such as packet headers). 267 Packets Received/sec is the rate at which the Redirector is receiving packets (also called SMBs or Server Message Blocks). Network transmissions are divided into packets. The average number of bytes received in a packet can be obtained by dividing Bytes Received/sec by this counter. Some packets received might not contain incoming data (for example an acknowledgment to a write made by the Redirector would count as an incoming packet). 269 Read Bytes Paging/sec is the rate at which the Redirector is attempting to read bytes in response to page faults. Page faults are caused by loading of modules (such as programs and libraries), by a miss in the Cache (see Read Bytes Cache/sec), or by files directly mapped into the address space of applications (a high-performance feature of Windows NT). 271 Read Bytes Non-Paging/sec are those bytes read by the Redirector in response to normal file requests by an application when they are redirected to come from another computer. In addition to file requests, this counter includes other methods of reading across the network such as Named Pipes and Transactions. This counter does not count network protocol information, just application data. 273 Read Bytes Cache/sec is the rate at which applications are accessing the file system cache by using the Redirector. Some of these data requests are satisfied by retrieving the data from the cache. Requests that miss the Cache cause a page fault (see Read Bytes Paging/sec). 275 Read Bytes Network/sec is the rate at which applications are reading data across the network. This occurs when data sought in the file system cache is not found there and must be retrieved from the network. Dividing this value by Bytes Received/sec indicates the proportion of application data traveling across the network. (see Bytes Received/sec). 277 Bytes Transmitted/sec is the rate at which bytes are leaving the Redirector to the network. It includes all application data as well as network protocol information (such as packet headers and the like). 279 Packets Transmitted/sec is the rate at which the Redirector is sending packets (also called SMBs or Server Message Blocks). Network transmissions are divided into packets. The average number of bytes transmitted in a packet can be obtained by dividing Bytes Transmitted/sec by this counter. 281 Write Bytes Paging/sec is the rate at which the Redirector is attempting to write bytes changed in the pages being used by applications. The program data changed by modules (such as programs and libraries) that were loaded over the network are 'paged out' when no longer needed. Other output pages come from the file system cache (see Write Bytes Cache/sec). 283 Write Bytes Non-Paging/sec is the rate at which bytes are written by the Redirector in response to normal file outputs by an application when they are redirected to another computer. In addition to file requests, this count includes other methods of writing across the network, such as Named Pipes and Transactions. This counter does not count network protocol information, just application data. 285 Write Bytes Cache/sec is the rate at which applications on your computer are writing to the file system cache by using the Redirector. The data might not leave your computer immediately; it can be retained in the cache for further modification before being written to the network. This saves network traffic. Each write of a byte into the cache is counted here. 287 Write Bytes Network/sec is the rate at which applications are writing data across the network. This occurs when the file system cache is bypassed, such as for Named Pipes or Transactions, or when the cache writes the bytes to disk to make room for other data. Dividing this counter by Bytes Transmitted/sec will indicate the proportion of application data being to the network (see Transmitted Bytes/sec). 289 File Read Operations/sec is the rate at which applications are asking the Redirector for data. Each call to a file system or similar Application Program Interface (API) call counts as one operation. 291 Read Operations Random/sec counts the rate at which, on a file-by-file basis, reads are made that are not sequential. If a read is made using a particular file handle, and then is followed by another read that is not immediately the contiguous next byte, this counter is incremented by one. 293 Read Packets/sec is the rate at which read packets are being placed on the network. Each time a single packet is sent with a request to read data remotely, this counter is incremented by one. 295 Reads Large/sec is the rate at which reads over 2 times the server's negotiated buffer size are made by applications. Too many of these could place a strain on server resources. This counter is incremented once for each read. It does not count packets. 297 Read Packets Small/sec is the rate at which reads less than one-fourth of the server's negotiated buffer size are made by applications. Too many of these could indicate a waste of buffers on the server. This counter is incremented once for each read. It does not count packets. 299 File Write Operations/sec is the rate at which applications are sending data to the Redirector. Each call to a file system or similar Application Program Interface (API) call counts as one operation. 301 Write Operations Random/sec is the rate at which, on a file-by-file basis, writes are made that are not sequential. If a write is made using a particular file handle, and then is followed by another write that is not immediately the next contiguous byte, this counter is incremented by one. 303 Write Packets/sec is the rate at which writes are being sent to the network. Each time a single packet is sent with a request to write remote data, this counter is incremented by one. 305 Writes Large/sec is the rate at which writes are made by applications that are over 2 times the server's negotiated buffer size. Too many of these could place a strain on server resources. This counter is incremented once for each write: it counts writes, not packets. 307 Write Packets Small/sec is the rate at which writes are made by applications that are less than one-fourth of the server's negotiated buffer size. Too many of these could indicate a waste of buffers on the server. This counter is incremented once for each write: it counts writes, not packets. 309 Reads Denied/sec is the rate at which the server is unable to accommodate requests for Raw Reads. When a read is much larger than the server's negotiated buffer size, the Redirector requests a Raw Read which, if granted, would permit the transfer of the data without lots of protocol overhead on each packet. To accomplish this the server must lock out other requests, so the request is denied if the server is really busy. 311 Writes Denied/sec is the rate at which the server is unable to accommodate requests for Raw Writes. When a write is much larger than the server's negotiated buffer size, the Redirector requests a Raw Write which, if granted, would permit the transfer of the data without lots of protocol overhead on each packet. To accomplish this the server must lock out other requests, so the request is denied if the server is really busy. 313 Network Errors/sec is the rate at which serious unexpected errors are occurring. Such errors generally indicate that the Redirector and one or more Servers are having serious communication difficulties. For example an SMB (Server Manager Block) protocol error is a Network Error. An entry is written to the System Event Log and provide details. 315 Server Sessions counts the total number of security objects the Redirector has managed. For example, a logon to a server followed by a network access to the same server will establish one connection, but two sessions. 317 Server Reconnects counts the number of times your Redirector has had to reconnect to a server in order to complete a new active request. You can be disconnected by the Server if you remain inactive for too long. Locally even if all your remote files are closed, the Redirector will keep your connections intact for (nominally) ten minutes. Such inactive connections are called Dormant Connections. Reconnecting is expensive in time. 319 Connects Core counts the number of connections you have to servers running the original MS-Net SMB protocol, including MS-Net itself and Xenix and VAX's. 321 Connects LAN Manager 2.0 counts connections to LAN Manager 2.0 servers, including LMX servers. 323 Connects LAN Manager 2.1 counts connections to LAN Manager 2.1 servers, including LMX servers. 325 Connects Windows NT counts the connections to Windows 2000 or earlier computers. 327 Server Disconnects counts the number of times a Server has disconnected your Redirector. See also Server Reconnects. 329 Server Sessions Hung counts the number of active sessions that are timed out and unable to proceed due to a lack of response from the remote server. 331 The Server performance object consists of counters that measure communication between the local computer and the network. 333 The number of bytes the server has received from the network. Indicates how busy the server is. 335 The number of bytes the server has sent on the network. Indicates how busy the server is. 337 Thread Wait Reason is only applicable when the thread is in the Wait state (see Thread State). It is 0 or 7 when the thread is waiting for the Executive, 1 or 8 for a Free Page, 2 or 9 for a Page In, 3 or 10 for a Pool Allocation, 4 or 11 for an Execution Delay, 5 or 12 for a Suspended condition, 6 or 13 for a User Request, 14 for an Event Pair High, 15 for an Event Pair Low, 16 for an LPC Receive, 17 for an LPC Reply, 18 for Virtual Memory, 19 for a Page Out; 20 and higher are not assigned at the time of this writing. Event Pairs are used to communicate with protected subsystems (see Context Switches). 339 % DPC Time is the percentage of time that the processor spent receiving and servicing deferred procedure calls (DPCs) during the sample interval. DPCs are interrupts that run at a lower priority than standard interrupts. % DPC Time is a component of % Privileged Time because DPCs are executed in privileged mode. They are counted separately and are not a component of the interrupt counters. This counter displays the average busy time as a percentage of the sample time. 341 The number of sessions that have been closed due to their idle time exceeding the AutoDisconnect parameter for the server. Shows whether the AutoDisconnect setting is helping to conserve resources. 343 The number of sessions that have been closed due to unexpected error conditions or sessions that have reached the autodisconnect timeout and have been disconnected normally. 345 The number of sessions that have terminated normally. Useful in interpreting the Sessions Times Out and Sessions Errored Out statistics--allows percentage calculations. 347 The number of sessions that have been forced to logoff. Can indicate how many sessions were forced to logoff due to logon time constraints. 349 The number of failed logon attempts to the server. Can indicate whether password guessing programs are being used to crack the security on the server. 351 The number of times opens on behalf of clients have failed with STATUS_ACCESS_DENIED. Can indicate whether somebody is randomly attempting to access files in hopes of getting at something that was not properly protected. 353 The number of times accesses to files opened successfully were denied. Can indicate attempts to access files without proper access authorization. 355 The number of times an internal Server Error was detected. Unexpected errors usually indicate a problem with the Server. 357 The number of times the server has rejected blocking SMBs due to insufficient count of free work items. Indicates whether the MaxWorkItem or MinFreeWorkItems server parameters might need to be adjusted. 359 The number of times STATUS_DATA_NOT_ACCEPTED was returned at receive indication time. This occurs when no work item is available or can be allocated to service the incoming request. Indicates whether the InitWorkItems or MaxWorkItems parameters might need to be adjusted. 361 The number of successful open attempts performed by the server of behalf of clients. Useful in determining the amount of file I/O, determining overhead for path-based operations, and for determining the effectiveness of open locks. 363 The number of files currently opened in the server. Indicates current server activity. 365 The number of sessions currently active in the server. Indicates current server activity. 367 The number of searches for files currently active in the server. Indicates current server activity. 369 The number of bytes of non-pageable computer memory the server is using. This value is useful for determining the values of the MaxNonpagedMemoryUsage value entry in the Windows NT Registry. 371 The number of times allocations from nonpaged pool have failed. Indicates that the computer's physical memory is too small. 373 The maximum number of bytes of nonpaged pool the server has had in use at any one point. Indicates how much physical memory the computer should have. 375 The number of bytes of pageable computer memory the server is currently using. Can help in determining good values for the MaxPagedMemoryUsage parameter. 377 The number of times allocations from paged pool have failed. Indicates that the computer's physical memory or paging file are too small. 379 The maximum number of bytes of paged pool the server has had allocated. Indicates the proper sizes of the Page File(s) and physical memory. 381 Server Announce Allocations Failed/sec is the rate at which server (or domain) announcements have failed due to lack of memory. 383 Mailslot Allocations Failed is the number of times the datagram receiver has failed to allocate a buffer to hold a user mailslot write. 385 Mailslot Receives Failed indicates the number of mailslot messages that could not be received due to transport failures. 387 Mailslot Writes Failed is the total number of mailslot messages that have been successfully received, but that could not be written to the mailslot. 389 Bytes Total/sec is the rate the Redirector is processing data bytes. This includes all application and file data in addition to protocol information such as packet headers. 391 File Data Operations/sec is the rate at which the Redirector is processing data operations. One operation should include many bytes, since each operation has overhead. The efficiency of this path can be determined by dividing the Bytes/sec by this counter to obtain the average number of bytes transferred per operation. 393 Current Commands counts the number of requests to the Redirector that are currently queued for service. If this number is much larger than the number of network adapter cards installed in the computer, then the network(s) and/or the server(s) being accessed are seriously bottlenecked. 395 The number of bytes the server has sent to and received from the network. This value provides an overall indication of how busy the server is. 397 % Interrupt Time is the time the processor spends receiving and servicing hardware interrupts during sample intervals. This value is an indirect indicator of the activity of devices that generate interrupts, such as the system clock, the mouse, disk drivers, data communication lines, network interface cards and other peripheral devices. These devices normally interrupt the processor when they have completed a task or require attention. Normal thread execution is suspended during interrupts. Most system clocks interrupt the processor every 10 milliseconds, creating a background of interrupt activity. suspends normal thread execution during interrupts. This counter displays the average busy time as a percentage of the sample time. 399 The NWLink NetBIOS performance object consists of counters that monitor IPX transport rates and connections. 401 Packets/sec is the rate the Redirector is processing data packets. One packet includes (hopefully) many bytes. We say hopefully here because each packet has protocol overhead. You can determine the efficiency of this path by dividing the Bytes/sec by this counter to determine the average number of bytes transferred/packet. You can also divide this counter by Operations/sec to determine the average number of packets per operation, another measure of efficiency. 405 Context Blocks Queued per second is the rate at which work context blocks had to be placed on the server's FSP queue to await server action. 407 File Data Operations/ sec is the combined rate of read and write operations on all logical disks on the computer. This is the inverse of System: File Control Operations/sec. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval. 409 % Free Space is the percentage of total usable space on the selected logical disk drive that was free. 411 Free Megabytes displays the unallocated space, in megabytes, on the disk drive in megabytes. One megabyte is equal to 1,048,576 bytes. 413 Connections Open is the number of connections currently open for this protocol. This counter shows the current count only and does not accumulate over time. 415 Connections No Retries is the total count of connections that were successfully made on the first try. This number is an accumulator and shows a running total. 417 Connections With Retries is the total count of connections that were made after retrying the attempt. A retry occurs when the first connection attempt failed. This number is an accumulator and shows a running total. 419 Disconnects Local is the number of session disconnections that were initiated by the local computer. This number is an accumulator and shows a running total. 421 Disconnects Remote is the number of session disconnections that were initiated by the remote computer. This number is an accumulator and shows a running total. 423 Failures Link is the number of connections that were dropped due to a link failure. This number is an accumulator and shows a running total. 425 Failures Adapter is the number of connections that were dropped due to an adapter failure. This number is an accumulator and shows a running total. 427 Connection Session Timeouts is the number of connections that were dropped due to a session timeout. This number is an accumulator and shows a running total. 429 Connections Canceled is the number of connections that were canceled. This number is an accumulator and shows a running total. 431 Failures Resource Remote is the number of connections that failed because of resource problems or shortages on the remote computer. This number is an accumulator and shows a running total. 433 Failures Resource Local is the number of connections that failed because of resource problems or shortages on the local computer. This number is an accumulator and shows a running total. 435 Failures Not Found is the number of connection attempts that failed because the remote computer could not be found. This number is an accumulator and shows a running total. 437 Failures No Listen is the number of connections that were rejected because the remote computer was not listening for connection requests. 439 Datagrams/sec is the rate at which datagrams are processed by the computer. This counter displays the sum of datagrams sent and datagrams received. A datagram is a connectionless packet whose delivery to a remote is not guaranteed. 441 Datagram Bytes/sec is the rate at which datagram bytes are processed by the computer. This counter is the sum of datagram bytes that are sent as well as received. A datagram is a connectionless packet whose delivery to a remote is not guaranteed. 443 Datagrams Sent/sec is the rate at which datagrams are sent from the computer. A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed. 445 Datagram Bytes Sent/sec is the rate at which datagram bytes are sent from the computer. A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed. 447 Datagrams Received/sec is the rate at which datagrams are received by the computer. A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed. 449 Datagram Bytes Received/sec is the rate at which datagram bytes are received by the computer. A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed. 451 Packets/sec is the rate at which packets are processed by the computer. This count is the sum of Packets Sent and Packets Received per second. This counter includes all packets processed: control as well as data packets. 453 Packets Sent/sec is the rate at which packets are sent by the computer. This counter counts all packets sent by the computer, i.e. control as well as data packets. 455 Packets Received/sec is the rate at which packets are received by the computer. This counter counts all packets processed: control as well as data packets. 457 Frames/sec is the rate at which data frames (or packets) are processed by the computer. This counter is the sum of data frames sent and data frames received. This counter only counts those frames (packets) that carry data. 459 Frame Bytes/sec is the rate at which data bytes are processed by the computer. This counter is the sum of data frame bytes sent and received. This counter only counts the byte in frames (packets) that carry data. 461 Frames Sent/sec is the rate at which data frames are sent by the computer. This counter only counts the frames (packets) that carry data. 463 Frame Bytes Sent/sec is the rate at which data bytes are sent by the computer. This counter only counts the bytes in frames (packets) that carry data. 465 Frames Received/sec is the rate at which data frames are received by the computer. This counter only counts the frames (packets) that carry data. 467 Frame Bytes Received/sec is the rate at which data bytes are received by the computer. This counter only counts the frames (packets) that carry data. 469 Frames Re-Sent/sec is the rate at which data frames (packets) are re-sent by the computer. This counter only counts the frames or packets that carry data. 471 Frame Bytes Re-Sent/sec is the rate at which data bytes are re-sent by the computer. This counter only counts the bytes in frames that carry data. 473 Frames Rejected/sec is the rate at which data frames are rejected. This counter only counts the frames (packets) that carry data. 475 Frame Bytes Rejected/sec is the rate at which data bytes are rejected. This counter only counts the bytes in data frames (packets) that carry data. 477 Expirations Response is the count of T1 timer expirations. 479 Expirations Ack is the count of T2 timer expirations. 481 Window Send Maximum is the maximum number of bytes of data that will be sent before waiting for an acknowledgment from the remote computer. 483 Window Send Average is the running average number of data bytes that were sent before waiting for an acknowledgment from the remote computer. 485 Piggyback Ack Queued/sec is the rate at which piggybacked acknowledgments are queued. Piggyback acknowledgments are acknowledgments to received packets that are to be included in the next outgoing packet to the remote computer. 487 Piggyback Ack Timeouts is the number of times that a piggyback acknowledgment could not be sent because there was no outgoing packet to the remote on which to piggyback. A piggyback ack is an acknowledgment to a received packet that is sent along in an outgoing data packet to the remote computer. If no outgoing packet is sent within the timeout period, then an ack packet is sent and this counter is incremented. 489 The NWLink IPX performance object consists of counters that measure datagram transmission to and from computers using the IPX protocol. 491 The NWLink SPX performance object consist of counters that measure data transmission and session connections for computers using the SPX protocol. 493 The NetBEUI performance object consists of counters that measure data transmission for network activity which conforms to the NetBIOS End User Interface standard. 495 The NetBEUI Resource performance object consists of counters that track the use of buffers by the NetBEUI protocol. 497 Used Maximum is the maximum number of NetBEUI resources (buffers) in use at any point in time. This value is useful in sizing the maximum resources provided. The number in parentheses following the resource name is used to identify the resource in Event Log messages. 499 Used Average is the current number of resources (buffers) in use at this time. The number in parentheses following the resource name is used to identify the resource in Event Log messages. 501 Times Exhausted is the number of times all the resources (buffers) were in use. The number in parentheses following the resource name is used to identify the resource in Event Log messages. 503 The NBT Connection performance object consists of counters that measure the rates at which bytes are sent and received over the NBT connection between the local computer and a remote computer. The connection is identified by the name of the remote computer. 505 Bytes Received/sec is the rate at which bytes are received by the local computer over an NBT connection to some remote computer. All the bytes received by the local computer over the particular NBT connection are counted. 507 Bytes Sent/sec is the rate at which bytes are sent by the local computer over an NBT connection to some remote computer. All the bytes sent by the local computer over the particular NBT connection are counted. 509 Bytes Total/sec is the rate at which bytes are sent or received by the local computer over an NBT connection to some remote computer. All the bytes sent or received by the local computer over the particular NBT connection are counted. 511 The Network Interface performance object consists of counters that measure the rates at which bytes and packets are sent and received over a TCP/IP network connection. It includes counters that monitor connection errors. 513 Bytes Total/sec is the rate at which bytes are sent and received over each network adapter, including framing characters. Network Interface\\Bytes Received/sec is a sum of Network Interface\\Bytes Received/sec and Network Interface\\Bytes Sent/sec. 515 Packets/sec is the rate at which packets are sent and received on the network interface. 517 Packets Received/sec is the rate at which packets are received on the network interface. 519 Packets Sent/sec is the rate at which packets are sent on the network interface. 521 Current Bandwidth is an estimate of the current bandwidth of the network interface in bits per second (BPS). For interfaces that do not vary in bandwidth or for those where no accurate estimation can be made, this value is the nominal bandwidth. 523 Bytes Received/sec is the rate at which bytes are received over each network adapter, including framing characters. Network Interface\\Bytes Received/sec is a subset of Network Interface\\Bytes Total/sec. 525 Packets Received Unicast/sec is the rate at which (subnet) unicast packets are delivered to a higher-layer protocol. 527 Packets Received Non-Unicast/sec is the rate at which non-unicast (subnet broadcast or subnet multicast) packets are delivered to a higher-layer protocol. 529 Packets Received Discarded is the number of inbound packets that were chosen to be discarded even though no errors had been detected to prevent their delivery to a higher-layer protocol. One possible reason for discarding packets could be to free up buffer space. 531 Packets Received Errors is the number of inbound packets that contained errors preventing them from being deliverable to a higher-layer protocol. 533 Packets Received Unknown is the number of packets received through the interface that were discarded because of an unknown or unsupported protocol. 535 Bytes Sent/sec is the rate at which bytes are sent over each each network adapter, including framing characters. Network Interface\\Bytes Sent/sec is a subset of Network Interface\\Bytes Total/sec. 537 Packets Sent Unicast/sec is the rate at which packets are requested to be transmitted to subnet-unicast addresses by higher-level protocols. The rate includes the packets that were discarded or not sent. 539 Packets Sent Non-Unicast/sec is the rate at which packets are requested to be transmitted to non-unicast (subnet broadcast or subnet multicast) addresses by higher-level protocols. The rate includes the packets that were discarded or not sent. 541 Packets Outbound Discarded is the number of outbound packets that were chosen to be discarded even though no errors had been detected to prevent transmission. One possible reason for discarding packets could be to free up buffer space. 543 Packets Outbound Errors is the number of outbound packets that could not be transmitted because of errors. 545 Output Queue Length is the length of the output packet queue (in packets). If this is longer than two, there are delays and the bottleneck should be found and eliminated, if possible. Since the requests are queued by the Network Driver Interface Specification (NDIS) in this implementation, this will always be 0. 547 The IP performance object consists of counters that measure the rates at which IP datagrams are sent and received by using IP protocols. It also includes counters that monitor IP protocol errors. 549 Datagrams/sec is the rate, in incidents per second, at which IP datagrams were received from or sent to the interfaces, including those in error. Forwarded datagrams are not included in this rate. 551 Datagrams Received/sec is the rate, in incidents per second, at which IP datagrams are received from the interfaces, including those in error. Datagrams Received/sec is a subset of Datagrams/sec. 553 Datagrams Received Header Errors is the number of input datagrams that were discarded due to errors in the IP headers, including bad checksums, version number mismatch, other format errors, time-to-live exceeded, errors discovered in processing their IP options, etc. 555 Datagrams Received Address Errors is the number of input datagrams that were discarded because the IP address in their IP header destination field was not valid for the computer. This count includes invalid addresses (for example, 0.0. 0.0) and addresses of unsupported Classes (for example, Class E). For entities that are not IP gateways and do not forward datagrams, this counter includes datagrams that were discarded because the destination address was not a local address. 557 Datagrams Forwarded/sec is the rate, in incidents per second, at which attemps were made to find routes to forward input datagrams their final destination, because the local server was not the final IP destination. In servers that do not act as IP Gateways, this rate includes only packets that were source-routed via this entity, where the source-route option processing was successful. 559 Datagrams Received Unknown Protocol is the number of locally-addressed datagrams that were successfully received but were discarded because of an unknown or unsupported protocol. 561 Datagrams Received Discarded is the number of input IP datagrams that were discarded even though problems prevented their continued processing (for example, lack of buffer space). This counter does not include any datagrams discarded while awaiting re-assembly. 563 Datagrams Received Delivered/sec is the rate, in incidents per second, at which input datagrams were successfully delivered to IP user-protocols, including Internet Control Message Protocol (ICMP). 565 Datagrams Sent/sec is the rate, in incidents per second, at which IP datagrams were supplied for transmission by local IP user-protocols (including ICMP). This counter does not include any datagrams counted in Datagrams Forwarded/sec. Datagrams Sent/sec is a subset of Datagrams/sec. 567 Datagrams Outbound Discarded is the number of output IP datagrams that were discarded even though no problems were encountered to prevent their transmission to their destination (for example, lack of buffer space). This counter includes datagrams counted in Datagrams Forwarded/sec that meet this criterion. 569 Datagrams Outbound No Route is the number of IP datagrams that were discarded because no route could be found to transmit them to their destination. This counter includes any packets counted in Datagrams Forwarded/sec that meet this `no route' criterion. 571 Fragments Received/sec is the rate, in incidents per second, at which IP fragments that need to be reassembled at this entity are received. 573 Fragments Re-assembled/sec is the rate, in incidents per second, at which IP fragments were successfully reassembled. 575 Fragment Re-assembly Failures is the number of failures detected by the IP reassembly algorithm, such as time outs, errors, etc. This is not necessarily a count of discarded IP fragments since some algorithms (notably RFC 815) lose track of the number of fragments by combining them as they are received. 577 Fragmented Datagrams/sec is the rate, in incidents per second, at which datagrams are successfully fragmented. 579 Fragmentation Failures is the number of IP datagrams that were discarded because they needed to be fragmented at but could not be (for example, because the `Don't Fragment' flag was set). 581 Fragments Created/sec is the rate, in incidents per second, at which IP datagram fragments were generated as a result of fragmentation. 583 The ICMP performance object consists of counters that measure the rates at which messages are sent and received by using ICMP protocols. It also includes counters that monitor ICMP protocol errors. 585 Messages/sec is the total rate, in incidents per second, at which ICMP messages were sent and received by the entity. The rate includes messages received or sent in error. 587 Messages Received/sec is the rate, in incidents per second at which ICMP messages were received. The rate includes messages received in error. 589 Messages Received Errors is the number of ICMP messages that the entity received but had errors, such as bad ICMP checksums, bad length, etc. 591 Received Destination Unreachable is the number of ICMP Destination Unreachable messages received. 593 Received Time Exceeded is the number of ICMP Time Exceeded messages received. 595 Received Parameter Problem is the number of ICMP Parameter Problem messages received. 597 Received Source Quench is the number of ICMP Source Quench messages received. 599 Received Redirect/sec is the rate, in incidents per second, at which ICMP Redirect messages were received. 601 Received Echo/sec is the rate, in incidents per second, at which ICMP Echo messages were received. 603 Received Echo Reply/sec is the rate, in incidents per second, at which ICMP Echo Reply messages were received. 605 Received Timestamp/sec is the rate, in incidents per second at which ICMP Timestamp Request messages were received. 607 Received Timestamp Reply/sec is the rate of ICMP Timestamp Reply messages received. 609 Received Address Mask is the number of ICMP Address Mask Request messages received. 611 Received Address Mask Reply is the number of ICMP Address Mask Reply messages received. 613 Messages Sent/sec is the rate, in incidents per second, at which the server attempted to send. The rate includes those messages sent in error. 615 Messages Outbound Errors is the number of ICMP messages that were not send due to problems within ICMP, such as lack of buffers. This value does not include errors discovered outside the ICMP layer, such as those recording the failure of IP to route the resultant datagram. In some implementations, none of the error types are included in the value of this counter. 617 Sent Destination Unreachable is the number of ICMP Destination Unreachable messages sent. 619 Sent Time Exceeded is the number of ICMP Time Exceeded messages sent. 621 Sent Parameter Problem is the number of ICMP Parameter Problem messages sent. 623 Sent Source Quench is the number of ICMP Source Quench messages sent. 625 Sent Redirect/sec is the rate, in incidents per second, at which ICMP Redirect messages were sent. 627 Sent Echo/sec is the rate of ICMP Echo messages sent. 629 Sent Echo Reply/sec is the rate, in incidents per second, at which ICMP Echo Reply messages were sent. 631 Sent Timestamp/sec is the rate, in incidents per second, at which ICMP Timestamp Request messages were sent. 633 Sent Timestamp Reply/sec is the rate, in incidents per second, at which ICMP Timestamp Reply messages were sent. 635 Sent Address Mask is the number of ICMP Address Mask Request messages sent. 637 Sent Address Mask Reply is the number of ICMP Address Mask Reply messages sent. 639 The TCP performance object consists of counters that measure the rates at which TCP Segments are sent and received by using the TCP protocol. It includes counters that monitor the number of TCP connections in each TCP connection state. 641 Segments/sec is the rate at which TCP segments are sent or received using the TCP protocol. 643 Connections Established is the number of TCP connections for which the current state is either ESTABLISHED or CLOSE-WAIT. 645 Connections Active is the number of times TCP connections have made a direct transition to the SYN-SENT state from the CLOSED state. 647 Connections Passive is the number of times TCP connections have made a direct transition to the SYN-RCVD state from the LISTEN state. 649 Connection Failures is the number of times TCP connections have made a direct transition to the CLOSED state from the SYN-SENT state or the SYN-RCVD state, plus the number of times TCP connections have made a direct transition to the LISTEN state from the SYN-RCVD state. 651 Connections Reset is the number of times TCP connections have made a direct transition to the CLOSED state from either the ESTABLISHED state or the CLOSE-WAIT state. 653 Segments Received/sec is the rate at which segments are received, including those received in error. This count includes segments received on currently established connections. 655 Segments Sent/sec is the rate at which segments are sent, including those on current connections, but excluding those containing only retransmitted bytes. 657 Segments Retransmitted/sec is the rate at which segments are retransmitted, that is, segments transmitted containing one or more previously transmitted bytes. 659 The UDP performance object consists of counters that measure the rates at which UDP datagrams are sent and received by using the UDP protocol. It includes counters that monitor UDP protocol errors. 661 Datagrams/sec is the rate at which UDP datagrams are sent or received by the entity. 663 Datagrams Received/sec is the rate at which UDP datagrams are delivered to UDP users. 665 Datagrams No Port/sec is the rate of received UDP datagrams for which there was no application at the destination port. 667 Datagrams Received Errors is the number of received UDP datagrams that could not be delivered for reasons other than the lack of an application at the destination port. 669 Datagrams Sent/sec is the rate at which UDP datagrams are sent from the entity. 671 Disk Storage device statistics from the foreign computer 673 The number of allocation failures reported by the disk storage device 675 System Up Time is the elapsed time (in seconds) that the computer has been running since it was last started. This counter displays the difference between the start time and the current time. 677 The current number of system handles in use. 679 Free System Page Table Entries is the number of page table entries not currently in used by the system. This counter displays the last observed value only; it is not an average. 681 The number of threads currently active in this process. An instruction is the basic unit of execution in a processor, and a thread is the object that executes instructions. Every running process has at least one thread. 683 The current base priority of this process. Threads within a process can raise and lower their own base priority relative to the process' base priority. 685 The total elapsed time, in seconds, that this process has been running. 687 Alignment Fixups/sec is the rate, in incidents per seconds, at alignment faults were fixed by the system. 689 Exception Dispatches/sec is the rate, in incidents per second, at which exceptions were dispatched by the system. 691 Floating Emulations/sec is the rate of floating emulations performed by the system. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval. 693 Logon/sec is the rate of all server logons. 695 The current dynamic priority of this thread. The system can raise the thread's dynamic priority above the base priority if the thread is handling user input, or lower it towards the base priority if the thread becomes compute bound. 697 The current base priority of this thread. The system can raise the thread's dynamic priority above the base priority if the thread is handling user input, or lower it towards the base priority if the thread becomes compute bound. 699 The total elapsed time (in seconds) this thread has been running. 701 The Paging File performance object consists of counters that monitor the paging file(s) on the computer. The paging file is a reserved space on disk that backs up committed physical memory on the computer. 703 The amount of the Page File instance in use in percent. See also Process\\Page File Bytes. 705 The peak usage of the Page File instance in percent. See also Process\\Page File Bytes Peak. 707 Starting virtual address for this thread. 709 Current User Program Counter for this thread. 711 Mapped Space is virtual memory that has been mapped to a specific virtual address (or range of virtual addresses) in the process' virtual address space. No Access protection prevents a process from writing to or reading from these pages and will generate an access violation if either is attempted. 713 Mapped Space is virtual memory that has been mapped to a specific virtual address (or range of virtual addresses) in the process' virtual address space. Read Only protection prevents the contents of these pages from being modified. Any attempts to write or modify these pages will generate an access violation. 715 Mapped Space is virtual memory that has been mapped to a specific virtual address (or range of virtual addresses) in the process' virtual address space. Read/Write protection allows a process to read, modify and write to these pages. 717 Mapped Space is virtual memory that has been mapped to a specific virtual address (or range of virtual addresses) in the process' virtual address space. Write Copy protection is used when memory is shared for reading but not for writing. When processes are reading this memory, they can share the same memory, however, when a sharing process wants to have write access to this shared memory, a copy of that memory is made. 719 Mapped Space is virtual memory that has been mapped to a specific virtual address (or range of virtual addresses) in the process' virtual address space. Executable memory is memory that can be executed by programs, but cannot be read or written. This type of protection is not supported by all processor types. 721 Mapped Space is virtual memory that has been mapped to a specific virtual address (or range of virtual addresses) in the process' virtual address space. Execute/Read Only memory is memory that can be executed as well as read. 723 Mapped Space is virtual memory that has been mapped to a specific virtual address (or range of virtual addresses) in the process' virtual address space. Execute/Read/Write memory is memory that can be executed by programs as well as read and modified. 725 Mapped Space is virtual memory that has been mapped to a specific virtual address (or range of virtual addresses) in the process' virtual address space. Execute Write Copy is memory that can be executed by programs as well as read and written. This type of protection is used when memory needs to be shared between processes. If the sharing processes only read the memory, then they will all use the same memory. If a sharing process desires write access, then a copy of this memory will be made for that process. 727 Reserved Space is virtual memory that has been reserved for future use by a process, but has not been mapped or committed. No Access protection prevents a process from writing to or reading from these pages and will generate an access violation if either is attempted. 729 Reserved Space is virtual memory that has been reserved for future use by a process, but has not been mapped or committed. Read Only protection prevents the contents of these pages from being modified. Any attempts to write or modify these pages will generate an access violation. 731 Reserved Space is virtual memory that has been reserved for future use by a process, but has not been mapped or committed. Read/Write protection allows a process to read, modify and write to these pages. 733 Reserved Space is virtual memory that has been reserved for future use by a process, but has not been mapped or committed. Write Copy protection is used when memory is shared for reading but not for writing. When processes are reading this memory, they can share the same memory, however, when a sharing process wants to have read/write access to this shared memory, a copy of that memory is made. 735 Reserved Space is virtual memory that has been reserved for future use by a process, but has not been mapped or committed. Executable memory is memory that can be executed by programs, but cannot be read or written. This type of protection is not supported by all processor types. 737 Reserved Space is virtual memory that has been reserved for future use by a process, but has not been mapped or committed. Execute/Read Only memory is memory that can be executed as well as read. 739 Reserved Space is virtual memory that has been reserved for future use by a process, but has not been mapped or committed. Execute/Read/Write memory is memory that can be executed by programs as well as read and modified. 741 The Image performance object consists of counters that monitor the virtual address usage of images executed by processes on the computer. 743 Reserved Space is virtual memory that has been reserved for future use by a process, but has not been mapped or committed. Execute Write Copy is memory that can be executed by programs as well as read and written. This type of protection is used when memory needs to be shared between processes. If the sharing processes only read the memory, then they will all use the same memory. If a sharing process desires write access, then a copy of this memory will be made for that process. 745 Unassigned Space is mapped and committed virtual memory in use by the process that is not attributable to any particular image being executed by that process. No Access protection prevents a process from writing to or reading from these pages and will generate an access violation if either is attempted. 747 Unassigned Space is mapped and committed virtual memory in use by the process that is not attributable to any particular image being executed by that process. Read Only protection prevents the contents of these pages from being modified. Any attempts to write or modify these pages will generate an access violation. 749 Unassigned Space is mapped and committed virtual memory in use by the process that is not attributable to any particular image being executed by that process. Read/Write protection allows a process to read, modify and write to these pages. 751 Unassigned Space is mapped and committed virtual memory in use by the process that is not attributable to any particular image being executed by that process. Write Copy protection is used when memory is shared for reading but not for writing. When processes are reading this memory, they can share the same memory, however, when a sharing process wants to have read/write access to this shared memory, a copy of that memory is made for writing to. 753 Unassigned Space is mapped and committed virtual memory in use by the process that is not attributable to any particular image being executed by that process. Executable memory is memory that can be executed by programs, but cannot be read or written. This type of protection is not supported by all processor types. 755 Unassigned Space is mapped and committed virtual memory in use by the process that is not attributable to any particular image being executed by that process. Execute/Read Only memory is memory that can be executed as well as read. 757 Unassigned Space is mapped and committed virtual memory in use by the process that is not attributable to any particular image being executed by that process. Execute/Read/Write memory is memory that can be executed by programs as well as read and written. 759 Unassigned Space is mapped and committed virtual memory in use by the process that is not attributable to any particular image being executed by that process. Execute Write Copy is memory that can be executed by programs as well as read and written. This type of protection is used when memory needs to be shared between processes. If the sharing processes only read the memory, then they will all use the same memory. If a sharing process desires write access, then a copy of this memory will be made for that process. 761 Image Space is the virtual address space in use by the images being executed by the process. This is the sum of all the address space with this protection allocated by images run by the selected process No Access protection prevents a process from writing to or reading from these pages and will generate an access violation if either is attempted. 763 Image Space is the virtual address space in use by the images being executed by the process. This is the sum of all the address space with this protection allocated by images run by the selected process Read Only protection prevents the contents of these pages from being modified. Any attempts to write or modify these pages will generate an access violation. 765 Image Space is the virtual address space in use by the images being executed by the process. This is the sum of all the address space with this protection allocated by images run by the selected process Read/Write protection allows a process to read, modify and write to these pages. 767 Image Space is the virtual address space in use by the images being executed by the process. This is the sum of all the address space with this protection allocated by images run by the selected process Write Copy protection is used when memory is shared for reading but not for writing. When processes are reading this memory, they can share the same memory, however, when a sharing process wants to have read/write access to this shared memory, a copy of that memory is made for writing to. 769 Image Space is the virtual address space in use by the images being executed by the process. This is the sum of all the address space with this protection allocated by images run by the selected process Executable memory is memory that can be executed by programs, but cannot be read or written. This type of protection is not supported by all processor types. 771 Image Space is the virtual address space in use by the images being executed by the process. This is the sum of all the address space with this protection allocated by images run by the selected process Execute/Read-Only memory is memory that can be executed as well as read. 773 Image Space is the virtual address space in use by the images being executed by the process. This is the sum of all the address space with this protection allocated by images run by the selected process Execute/Read/Write memory is memory that can be executed by programs as well as read and written and modified. 775 Image Space is the virtual address space in use by the images being executed by the process. This is the sum of all the address space with this protection allocated by images run by the selected process Execute Write Copy is memory that can be executed by programs as well as read and written. This type of protection is used when memory needs to be shared between processes. If the sharing processes only read the memory, then they will all use the same memory. If a sharing process desires write access, then a copy of this memory will be made for that process. 777 Bytes Image Reserved is the sum of all virtual memory reserved by images within this process. 779 Bytes Image Free is the amount of virtual address space that is not in use or reserved by images within this process. 781 Bytes Reserved is the total amount of virtual memory reserved for future use by this process. 783 Bytes Free is the total unused virtual address space of this process. 785 ID Process is the unique identifier of this process. ID Process numbers are reused, so they only identify a process for the lifetime of that process. 787 The Process Address Space performance object consists of counters that monitor memory allocation and use for a selected process. 789 Image Space is the virtual address space in use by the selected image with this protection. No Access protection prevents a process from writing or reading these pages and will generate an access violation if either is attempted. 791 Image Space is the virtual address space in use by the selected image with this protection. Read Only protection prevents the contents of these pages from being modified. Any attempts to write or modify these pages will generate an access violation. 793 Image Space is the virtual address space in use by the selected image with this protection. Read/Write protection allows a process to read, modify and write to these pages. 795 Image Space is the virtual address space in use by the selected image with this protection. Write Copy protection is used when memory is shared for reading but not for writing. When processes are reading this memory, they can share the same memory, however, when a sharing process wants to have read/write access to this shared memory, a copy of that memory is made for writing to. 797 Image Space is the virtual address space in use by the selected image with this protection. Executable memory is memory that can be executed by programs, but cannot be read or written. This type of protection is not supported by all processor types. 799 Image Space is the virtual address space in use by the selected image with this protection. Execute/Read Only memory is memory that can be executed as well as read. 801 Image Space is the virtual address space in use by the selected image with this protection. Execute/Read/Write memory is memory that can be executed by programs as well as read and written. 803 Image Space is the virtual address space in use by the selected image with this protection. Execute Write Copy is memory that can be executed by programs as well as read and written. This type of protection is used when memory needs to be shared between processes. If the sharing processes only read the memory, then they will all use the same memory. If a sharing process desires write access, then a copy of this memory will be made for that process. 805 ID Thread is the unique identifier of this thread. ID Thread numbers are reused, so they only identify a thread for the lifetime of that thread. 807 Mailslot Opens Failed/sec indicates the rate at which mailslot messages to be delivered to mailslots that are not present are received by this workstation. 809 Duplicate Master Announcements indicates the number of times that the master browser has detected another master browser on the same domain. 811 Illegal Datagrams/sec is the rate at which incorrectly formatted datagrams have been received by the workstation. 813 Announcements Total/sec is the sum of Announcements Server/sec and Announcements Domain/sec. 815 Enumerations Total/sec is the rate at which browse requests have been processed by this workstation. This is the sum of Enumerations Server/sec, Enumerations Domain/sec, and Enumerations Other/sec. 817 The Thread Details performance object consists of counters that measure aspects of thread behavior that are difficult or time-consuming or collect. These counters are distinguished from those in the Thread object by their high overhead. 819 Cache Bytes is the sum of the Memory\\System Cache Resident Bytes, Memory\\System Driver Resident Bytes, Memory\\System Code Resident Bytes, and Memory\\Pool Paged Resident Bytes counters. This counter displays the last observed value only; it is not an average. 821 Cache Bytes Peak is the maximum number of bytes used by the file system cache since the system was last restarted. This might be larger than the current size of the cache. This counter displays the last observed value only; it is not an average. 823 Pages Input/sec is the rate at which pages are read from disk to resolve hard page faults. Hard page faults occur when a process refers to a page in virtual memory that is not in its working set or elsewhere in physical memory, and must be retrieved from disk. When a page is faulted, the system tries to read multiple contiguous pages into memory to maximize the benefit of the read operation. Compare the value of Memory\\Pages Input/sec to the value of Memory\\Page Reads/sec to determine the average number of pages read into memory during each read operation. 871 The RAS performance object consists of counters that monitor individual Remote Access Service ports of the RAS device on the computer. 873 The number of bytes transmitted total for this connection. 875 The number of bytes received total for this connection. 877 The number of data frames transmitted total for this connection. 879 The number of data frames received total for this connection. 881 The compression ratio for bytes being transmitted. 883 The compression ratio for bytes being received. 885 The total number of CRC Errors for this connection. CRC Errors occur when the frame received contains erroneous data. 887 The total number of Timeout Errors for this connection. Timeout Errors occur when an expected is not received in time. 889 The total number of Serial Overrun Errors for this connection. Serial Overrun Errors occur when the hardware cannot handle the rate at which data is received. 891 The total number of Alignment Errors for this connection. Alignment Errors occur when a byte received is different from the byte expected. 893 The total number of Buffer Overrun Errors for this connection. Buffer Overrun Errors when the software cannot handle the rate at which data is received. 895 The total number of CRC, Timeout, Serial Overrun, Alignment, and Buffer Overrun Errors for this connection. 897 The number of bytes transmitted per second. 899 The number of bytes received per second. 901 The number of frames transmitted per second. 903 The number of frames received per second. 905 The total number of CRC, Timeout, Serial Overrun, Alignment, and Buffer Overrun Errors per second. 907 The RAS performance object consists of counters that combine values for all ports of the Remote Access service (RAS) device on the computer. 909 The total number of Remote Access connections. 921 The WINS Server performance object consists of counters that monitor communications using the WINS Server service. 923 Unique Registrations/sec is the rate at which unique registration are received by the WINS server. 925 Group Registrations/sec is the rate at which group registration are received by the WINS server. 927 Total Number of Registrations/sec is the sum of the Unique and Group registrations per sec. This is the total rate at which registration are received by the WINS server. 929 Unique Renewals/sec is the rate at which unique renewals are received by the WINS server. 931 Group Renewals/sec is the rate at which group renewals are received by the WINS server. 933 Total Number of Renewals/sec is the sum of the Unique and Group renewals per sec. This is the total rate at which renewals are received by the WINS server. 935 Total Number of Releases/sec is the rate at which releases are received by the WINS server. 937 Total Number of Queries/sec is the rate at which queries are received by the WINS server. 939 Unique Conflicts/sec is the rate at which unique registrations/renewals received by the WINS server resulted in conflicts with records in the database. 941 Group Conflicts/sec is the rate at which group registration received by the WINS server resulted in conflicts with records in the database. 943 Total Number of Conflicts/sec is the sum of the Unique and Group conflicts per sec. This is the total rate at which conflicts were seen by the WINS server. 945 Total Number of Successful Releases/sec 947 Total Number of Failed Releases/sec 949 Total Number of Successful Queries/sec 951 Total Number of Failed Queries/sec 953 The total number of handles currently open by this process. This number is equal to the sum of the handles currently open by each thread in this process. 1001 Services for Macintosh AFP File Server. 1003 The maximum amount of paged memory resources used by the MacFile Server. 1005 The current amount of paged memory resources used by the MacFile Server. 1007 The maximum amount of nonpaged memory resources use by the MacFile Server. 1009 The current amount of nonpaged memory resources used by the MacFile Server. 1011 The number of sessions currently connected to the MacFile server. Indicates current server activity. 1013 The maximum number of sessions connected at one time to the MacFile server. Indicates usage level of server. 1015 The number of internal files currently open in the MacFile server. This count does not include files opened on behalf of Macintosh clients. 1017 The maximum number of internal files open at one time in the MacFile server. This count does not include files opened on behalf of Macintosh clients. 1019 The number of failed logon attempts to the MacFile server. Can indicate whether password guessing programs are being used to crack the security on the server. 1021 The number of bytes read from disk per second. 1023 The number of bytes written to disk per second. 1025 The number of bytes received from the network per second. Indicates how busy the server is. 1027 The number of bytes sent on the network per second. Indicates how busy the server is. 1029 The number of outstanding work items waiting to be processed. 1031 The maximum number of outstanding work items waiting at one time. 1033 The current number of threads used by MacFile server. Indicates how busy the server is. 1035 The maximum number of threads used by MacFile server. Indicates peak usage level of server. 1051 AppleTalk Protocol 1053 Number of packets received per second by Appletalk on this port. 1055 Number of packets sent per second by Appletalk on this port. 1057 Number of bytes received per second by Appletalk on this port. 1059 Number of bytes sent per second by Appletalk on this port. 1061 Average time in milliseconds to process a DDP packet on this port. 1063 Number of DDP packets per second received by Appletalk on this port. 1065 Average time in milliseconds to process an AARP packet on this port. 1067 Number of AARP packets per second received by Appletalk on this port. 1069 Average time in milliseconds to process an ATP packet on this port. 1071 Number of ATP packets per second received by Appletalk on this port. 1073 Average time in milliseconds to process an NBP packet on this port. 1075 Number of NBP packets per second received by Appletalk on this port. 1077 Average time in milliseconds to process a ZIP packet on this port. 1079 Number of ZIP packets per second received by Appletalk on this port. 1081 Average time in milliseconds to process an RTMP packet on this port. 1083 Number of RTMP packets per second received by Appletalk on this port. 1085 Number of ATP requests retransmitted on this port. 1087 Number of ATP release timers that have expired on this port. 1089 Number of ATP Exactly-once transaction responses per second on this port. 1091 Number of ATP At-least-once transaction responses per second on this port. 1093 Number of ATP transaction release packets per second received on this port. 1095 The current amount of nonpaged memory resources used by AppleTalk. 1097 Number of packets routed in on this port. 1099 Number of packets dropped due to resource limitations on this port. 1101 Number of ATP requests retransmitted to this port. 1103 Number of packets routed out on this port. 1111 Provides Network Statistics for the local network segment via the Network Monitor Service. 1113 The total number of frames received per second on this network segment. 1115 The number of bytes received per second on this network segment. 1117 The number of Broadcast frames received per second on this network segment. 1119 The number of Multicast frames received per second on this network segment. 1121 Percentage of network bandwidth in use on this network segment. 1125 Percentage of network bandwidth which is made up of broadcast traffic on this network segment. 1127 Percentage of network bandwidth which is made up of multicast traffic on this network segment. 1151 The Telephony System 1153 The number of telephone lines serviced by this computer. 1155 The number of telephone devices serviced by this computer. 1157 The number of telephone lines serviced by this computer that are currently active. 1159 The number of telephone devices that are currently being monitored. 1161 The rate of outgoing calls made by this computer. 1163 The rate of incoming calls answered by this computer. 1165 The number of applications that are currently using telephony services. 1167 Current outgoing calls being serviced by this computer. 1169 Current incoming calls being serviced by this computer. 1229 The Gateway Service For NetWare performance object consists of counters that measure the Gateway Server service. 1231 The Client Service For NetWare object consists of counters that measure packet transmission rates, logons, and connections. 1233 Packet Burst Read NCP Count/sec is the rate of NetWare Core Protocol requests for Packet Burst Read. Packet Burst is a windowing protocol that improves performance. 1235 Packet Burst Read Timeouts/sec is the rate the NetWare Service needs to retransmit a Burst Read Request because the NetWare server took too long to respond. 1237 Packet Burst Write NCP Count/sec is the rate of NetWare Core Protocol requests for Packet Burst Write. Packet Burst is a windowing protocol that improves performance. 1239 Packet Burst Write Timeouts/sec is the rate the NetWare Service needs to retransmit a Burst Write Request because the NetWare server took too long to respond. 1241 Packet Burst IO/sec is the sum of Packet Burst Read NCPs/sec and Packet Burst Write NCPs/sec. 1243 Connect NetWare 2.x counts connections to NetWare 2.x servers. 1245 Connect NetWare 3.x counts connections to NetWare 3.x servers. 1247 Connect NetWare 4.x counts connections to NetWare 4.x servers. 1261 Logon Total includes all interactive logons, network logons, service logons, successful logon, and failed logons since the machine is last rebooted. 1301 The Server Work Queues performance object consists of counters that monitor the length of the queues and objects in the queues. 1303 Queue Length is the current length of the server work queue for this CPU. A sustained queue length greater than four might indicate processor congestion. This is an instantaneous count, not an average over time. 1305 Active Threads is the number of threads currently working on a request from the server client for this CPU. The system keeps this number as low as possible to minimize unnecessary context switching. This is an instantaneous count for the CPU, not an average over time. 1307 Available Threads is the number of server threads on this CPU not currently working on requests from a client. The server dynamically adjusts the number of threads to maximize server performance. 1309 Every request from a client is represented in the server as a 'work item,' and the server maintains a pool of available work items per CPU to speed processing. This is the instantaneous number of available work items for this CPU. A sustained near-zero value indicates the need to increase the MinFreeWorkItems registry value for the Server service. This value will always be 0 in the Blocking Queue instance. 1311 Every request from a client is represented in the server as a 'work item,' and the server maintains a pool of available work items per CPU to speed processing. When a CPU runs out of work items, it borrows a free work item from another CPU. An increasing value of this running counter might indicate the need to increase the 'MaxWorkItems' or 'MinFreeWorkItems' registry values for the Server service. This value will always be 0 in the Blocking Queue instance. 1313 Every request from a client is represented in the server as a 'work item,' and the server maintains a pool of available work items per CPU to speed processing. A sustained value greater than zero indicates the need to increase the 'MaxWorkItems' registry value for the Server service. This value will always be 0 in the Blocking Queue instance. 1315 Current Clients is the instantaneous count of the clients being serviced by this CPU. The server actively balances the client load across all of the CPU's in the system. This value will always be 0 in the Blocking Queue instance. 1317 The rate at which the Server is receiving bytes from the network clients on this CPU. This value is a measure of how busy the Server is. 1319 The rate at which the Server is sending bytes to the network clients on this CPU. This value is a measure of how busy the Server is. 1321 The rate at which the Server is sending and receiving bytes with the network clients on this CPU. This value is a measure of how busy the Server is. 1323 Read Operations/sec is the rate the server is performing file read operations for the clients on this CPU. This value is a measure of how busy the Server is. This value will always be 0 in the Blocking Queue instance. 1325 Read Bytes/sec is the rate the server is reading data from files for the clients on this CPU. This value is a measure of how busy the Server is. 1327 Write Operations/sec is the rate the server is performing file write operations for the clients on this CPU. This value is a measure of how busy the Server is. This value will always be 0 in the Blocking Queue instance. 1329 Write Bytes/sec is the rate the server is writing data to files for the clients on this CPU. This value is a measure of how busy the Server is. 1331 Total Bytes/sec is the rate the Server is reading and writing data to and from the files for the clients on this CPU. This value is a measure of how busy the Server is. 1333 Total Operations/sec is the rate the Server is performing file read and file write operations for the clients on this CPU. This value is a measure of how busy the Server is. This value will always be 0 in the Blocking Queue instance. 1335 DPCs Queued/sec is the average rate, in incidents per second, at which deferred procedure calls (DPCs) were added to the processor's DPC queue. DPCs are interrupts that run at a lower priority than standard interrupts. Each processor has its own DPC queue. This counter measures the rate that DPCs are added to the queue, not the number of DPCs in the queue. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval. 1337 DPC Rate is the rate at which deferred procedure calls (DPCs) were added to the processors DPC queues between the timer ticks of the processor clock. DPCs are interrupts that run at alower priority than standard interrupts. Each processor has its own DPC queue. This counter measures the rate that DPCs were added to the queue, not the number of DPCs in the queue. This counter displays the last observed value only; it is not an average. 1343 Total DPCs Queued/sec is the combined rate at which deferred procedure calls (DPCs) are added to the DPC queue of all processors on the computer. (DPCs are interrupts that run at a lower priority than standard interrupts). Each processor has its own DPC queue. This counter measures the rate at which DPCs are added to the queue, not the number of DPCs in the queue. It is the sum of Processor: DPCs Queued/sec for all processors on the computer, divided by the number of processors. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval. 1345 Total DPC Rate is the combined rate at which deferred procedure calls (DPCs) are added to the DPC queues of all processors between timer ticks of each processor's system clock. (DPCs are interrupts that run at a lower priority than standard interrupts). Each processor has its own DPC queue. clock on the processor. This counter measures the rate at which DPCs are added to the queue, not the number of DPCs in the queue. It is the sum of Processor: DPC Rate for all processors on the computer, divided by the number of processors. This counter displays the last observed value only; it is not an average. 1351 % Registry Quota In Use is the percentage of the Total Registry Quota Allowed that is currently being used by the system. This counter displays the current percentage value only; it is not an average. 1361 Counters that indicate the status of local and system Very Large memory allocations. 1363 VLM % Virtual Size In Use 1365 Current size of the process VLM Virtual memory space in bytes. 1367 The peak size of the process VLM virtual memory space in bytes. This value indicates the maximum size of the process VLM virtual memory since the process started. 1369 The current size of the process VLM virtual memory space in bytes that may be allocated. Note that the maximum allocation allowed may be smaller than this value due to fragmentation of the memory space. 1371 The current size of committed VLM memory space for the current process in bytes. 1373 The peak size of the committed VLM memory space in bytes for the current process since the process started. 1375 The current size of all committed VLM memory space in bytes for the system. 1377 The peak size of all committed VLM memory space in bytes since the system was started. 1379 The current size of all committed shared VLM memory space in bytes for the system. 1381 Available KBytes is the amount of physical memory available to processes running on the computer, in Kilobytes, rather than bytes as reported in Memory\\Available Bytes. It is calculated by adding the amount of space on the Zeroed, Free, and Stand by memory lists. Free memory is ready for use; Zeroed memory are pages of memory filled with zeros to prevent later processes from seeing data used by a previous process; Standby memory is memory removed from a process' working set (its physical memory) on route to disk, but is still available to be recalled. This counter displays the last observed value only; it is not an average. 1383 Available MBytes is the amount of physical memory available to processes running on the computer, in Megabytes, rather than bytes as reported in Memory\\Available Bytes. It is calculated by adding the amount of space on the Zeroed, Free, and Stand by memory lists. Free memory is ready for use; Zeroed memory are pages of memory filled with zeros to prevent later processes from seeing data used by a previous process; Standby memory is memory removed from a process' working set (its physical memory) on route to disk, but is still available to be recalled. This counter displays the last observed value only; it is not an average. 1401 Avg. Disk Queue Length is the average number of both read and write requests that were queued for the selected disk during the sample interval. 1403 Avg. Disk Read Queue Length is the average number of read requests that were queued for the selected disk during the sample interval. 1405 Avg. Disk Write Queue Length is the average number of write requests that were queued for the selected disk during the sample interval. 1407 % Committed Bytes In Use is the ratio of Memory\\Committed Bytes to the Memory\\Commit Limit. Committed memory is the physical memory in use for which space has been reserved in the paging file should it need to be written to disk. The commit limit is determined by the size of the paging file. If the paging file is enlarged, the commit limit increases, and the ratio is reduced). This counter displays the current percentage value only; it is not an average. 1409 The Full Image performance object consists of counters that monitor the virtual address usage of images executed by processes on the computer. Full Image counters are the same counters as contained in Image object with the only difference being the instance name. In the Full Image object, the instance name includes the full file path name of the loaded modules, while in the Image object only the filename is displayed. 1411 The Creating Process ID value is the Process ID of the process that created the process. The creating process may have terminated, so this value may no longer identify a running process. 1413 The rate at which the process is issuing read I/O operations. This counter counts all I/O activity generated by the process to include file, network and device I/Os. 1415 The rate at which the process is issuing write I/O operations. This counter counts all I/O activity generated by the process to include file, network and device I/Os. 1417 The rate at which the process is issuing read and write I/O operations. This counter counts all I/O activity generated by the process to include file, network and device I/Os. 1419 The rate at which the process is issuing I/O operations that are neither read nor write operations (for example, a control function). This counter counts all I/O activity generated by the process to include file, network and device I/Os. 1421 The rate at which the process is reading bytes from I/O operations. This counter counts all I/O activity generated by the process to include file, network and device I/Os. 1423 The rate at which the process is writing bytes to I/O operations. This counter counts all I/O activity generated by the process to include file, network and device I/Os. 1425 The rate at which the process is reading and writing bytes in I/O operations. This counter counts all I/O activity generated by the process to include file, network and device I/Os. 1427 The rate at which the process is issuing bytes to I/O operations that do not involve data such as control operations. This counter counts all I/O activity generated by the process to include file, network and device I/Os. 1451 Displays performance statistics about a Print Queue. 1453 Total number of jobs printed on a print queue since the last restart. 1455 Number of bytes per second printed on a print queue. 1457 Total number of pages printed through GDI on a print queue since the last restart. 1459 Current number of jobs in a print queue. 1461 Current number of references (open handles) to this printer. 1463 Peak number of references (open handles) to this printer. 1465 Current number of spooling jobs in a print queue. 1467 Maximum number of spooling jobs in a print queue since last restart. 1469 Total number of out of paper errors in a print queue since the last restart. 1471 Total number of printer not ready errors in a print queue since the last restart. 1473 Total number of job errors in a print queue since last restart. 1475 Total number of calls from browse clients to this print server to request network browse lists since last restart. 1477 Total number of calls from other print servers to add shared network printers to this server since last restart. 1479 Working Set - Private displays the size of the working set, in bytes, that is use for this process only and not shared nor sharable by other processes. 1481 Working Set - Shared displays the size of the working set, in bytes, that is sharable and may be used by other processes. Because a portion of a process' working set is shareable, does not necessarily mean that other processes are using it. 1483 % Idle Time reports the percentage of time during the sample interval that the disk was idle. 1485 Split IO/Sec reports the rate at which I/Os to the disk were split into multiple I/Os. A split I/O may result from requesting data of a size that is too large to fit into a single I/O or that the disk is fragmented. 1501 Reports the accounting and processor usage data collected by each active named Job object. 1503 Current % Processor Time shows the percentage of the sample interval that the processes in the Job object spent executing code. 1505 Current % User mode Time shows the percentage of the sample interval that the processes in the Job object spent executing code in user mode. 1507 Current % Kernel mode Time shows the percentage of the sample interval that the processes in the Job object spent executing code in kernel or privileged mode. 1509 This Period mSec - Processor shows the time, in milliseconds, of processor time used by all the processes in the Job object, including those that have terminated or that are no longer associated with the Job object, since a time limit on the Job was established. 1511 This Period mSec - User mode shows the time, in milliseconds, of user mode processor time used by all the processes in the Job object, including those that have terminated or that are no longer associated with the Job object, since a time limit on the Job was established. 1513 This Period mSec - Kernel mode shows the time, in milliseconds, of kernel mode processor time used by all the processes in the Job object, including those that have terminated or that are no longer associated with the Job object, since a time limit on the Job was established. 1515 Pages/Sec shows the page fault rate of all the processes in the Job object. 1517 Process Count - Total shows the number of processes, both active and terminated, that are or have been associated with the Job object. 1519 Process Count - Active shows the number of processes that are currently associated with the Job object. 1521 Process Count - Terminated shows the number of processes that have been terminated because of a limit violation. 1523 Total mSec - Processor shows the time, in milliseconds, of processor time used by all the processes in the Job object, including those that have terminated or that are no longer associated with the Job object, since the Job object was created. 1525 Total mSec - User mode shows the time, in milliseconds, of user mode processor time used by all the processes in the Job object, including those that have terminated or that are no longer associated with the Job object, since the Job object was created. 1527 Total mSec - Kernel mode shows the time, in milliseconds, of kernel mode processor time used by all the processes in the Job object, including those that have terminated or that are no longer associated with the Job object, since the Job object was created. 1549 % Job object Details shows detailed performance information about the active processes that make up a Job object. 1747 % Idle Time is the percentage of time the processor is idle during the sample interval 1749 % C1 Time is the percentage of time the processor spends in the C1 low-power idle state. % C1 Time is a subset of the total processor idle time. C1 low-power idle state enables the processor to maintain its entire context and quickly return to the running state. Not all systems support the % C1 state. 1751 % C2 Time is the percentage of time the processor spends in the C2 low-power idle state. % C2 Time is a subset of the total processor idle time. C2 low-power idle state enables the processor to maintain the context of the system caches. The C2 power state is a lower power and higher exit latency state than C1. Not all systems support the C2 state. 1753 % C3 Time is the percentage of time the processor spends in the C3 low-power idle state. % C3 Time is a subset of the total processor idle time. When the processor is in the C3 low-power idle state it is unable to maintain the coherency of its caches. The C3 power state is a lower power and higher exit latency state than C2. Not all systems support the C3 state. 1755 C1 Transitions/sec is the rate that the CPU enters the C1 low-power idle state. The CPU enters the C1 state when it is sufficiently idle and exits this state on any interrupt. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval. 1757 C2 Transitions/sec is the rate that the CPU enters the C2 low-power idle state. The CPU enters the C2 state when it is sufficiently idle and exits this state on any interrupt. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval. 1759 C3 Transitions/sec is the rate that the CPU enters the C3 low-power idle state. The CPU enters the C3 state when it is sufficiently idle and exits this state on any interrupt. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval. 1761 Heap performance counters for must used heaps 1763 Memory actively used by this heap (FreeBytes + AllocatedBytes) 1765 Total virtual address space reserved for this heap (includes uncommitted ranges) 1767 ReservedBytes minus last uncommitted range in each segment 1769 Memory on freelists in this heap (does not include uncommitted ranges or blocks in heap cache) 1771 Number of blocks on the list of free blocks >1k in size 1773 1/Average time per allocation (excluding allocs from heap cache) 1775 1/Average time per free (excluding frees to heap cache) 1777 Number of uncommitted ranges in the reserved virtual address 1779 Difference between number of allocations and frees (for leak detection) 1781 Allocations/sec from heap cache 1783 Frees/sec from heap cache 1785 Allocations/sec of size <1k bytes (including heap cache) 1787 Frees/sec of size <1k bytes (including heap cache) 1789 Allocations/sec of size 1-8k bytes 1791 Frees/sec of size 1-8k bytes 1793 Allocations/sec of size over 8k bytes 1795 Frees/sec of size over 8k bytes 1797 Allocations/sec (including from heap cache) 1799 Frees/sec (including to heap cache) 1801 Total number of blocks in the heap cache 1803 Largest number of blocks of any one size in the heap cache 1805 (FreeBytes / CommittedBytes) *100 1807 (VirtualBytes / ReservedBytes) * 100 1809 Collisions/sec on the heap lock 1847 End Marker 1849 RSVP service performance counters. 1851 The number of local network interfaces visible to, and used by the RSVP service. 1853 The total number of raw sockets opened for the purpose of RSVP signaling. 1855 The number of timer events scheduled to take place. Shows the activity level of the RSVP service. 1857 The current number of active RSVP sessions on the RSVP service. 1859 The number of QoS enabled applications currently active. 1861 Indicates the number of PATH messages sent for QoS-enabled senders. This number increments each time a PATH is refreshed. 1863 Indicates the number of RESV messages sent for QoS-enabled receivers. This number increments each time a RESV is refreshed. 1865 The number of QoS requests generated by QoS-enabled applications that have been rejected by the RSVP service. Failed QoS requests can be caused by invalid QoS requests. 1867 The number of QoS notifications the RSVP service that could not be sent to the QoS applications. Failed QoS sends can be caused by terminated applications. 1869 The number of QoS notifications delivered to QoS-enabled applications by the QoS RSVP service. 1871 A running total of the number of bytes delivered in QoS Notifications to QoS-enabled applications. 1873 RSVP Interfaces performance counters. 1875 Total RSVP signaling traffic in bytes received by the RSVP service on this interface. 1877 Total RSVP signaling traffic in bytes sent by the RSVP service on this interface. 1879 The total number of PATH messages received on this interface. 1881 The total number of RESV messages received on this interface. 1883 The total number of PATH error messages received on this interface. This number indicates the number of times a PATH has been rejected by a remote host. 1885 The total number of RESV ERR messages received on this interface by the RSVP service rejecting incoming RESV messages. 1887 The total number of PATH TEAR messages received on the interface. 1889 The total number of RESV TEAR messages received on the interface. 1891 The total number of RESV CONFIRM messages received by the interface. 1893 The total number of PATH messages sent by the RSVP service sent on this the interface. 1895 The total number of RESV messages sent by the RSVP service sent on this the interface 1897 The total number of PATH ERR messages sent by the RSVP service rejecting incoming PATH messages. 1899 The total number of RESV error sent on this interface. This number indicates how many reservations have been rejected by the network. 1901 The total number of PATH TEAR messages sent on the interface to tear down an RSVP PATH state in the network. 1903 The total number of RESV TEAR messages sent on the interface to tear down a RESV state in the network. 1905 The total number of RESV CONFIRM messages sent on this interface in response to RESV messages sent from remote hosts. 1907 This counter shows the number of reservations that failed due to the lack of resources. 1909 This is the total number of RSVP requests that are not admitted on this interface due to a conflict with policy settings. 1911 This is the total number of non-admission control errors that have occurred on this interface. For more information about the other traffic control failures, see RFC 2205. 1913 The number of blockaded reservations that failed due to failed reservations that have not been removed from this node. For more information about blockade states, see RFC 2205. 1915 The total number of times the RSVP RESV state block (RSB) timed out. This happens when no RESV messages are received within the designated timeout period. This error message can be caused by a route change. 1917 The total number of times the RSVP PATH state block (PSB) timed out. This happens when no PATH messages are received within the designated timeout period. This error message can be caused by a route change. 1919 The total number of outgoing RSVP messages dropped because they were bigger than the max configured RSVP message size. 1921 The total number of incoming RSVP messages dropped because they were bigger than the max configured RSVP message size. 1923 The total number of outgoing RSVP messages dropped due to insufficient memory. 1925 The total number of incoming RSVP messages dropped due to insufficient memory. 1927 Number of incoming messages dropped due to badly constructed RSVP objects etc. 1929 Number of outgoing messages dropped 1931 The number of reserved flows currently installed and maintained by RSVP on this interface. 1933 Shows the reserved bandwidth for this interface, in bits per second. 1935 The highest amount of allocated bandwidth admitted on the interface during the period in which the service has been running. 1937 Flow statistics from the packet scheduler 1939 Pipe statistics from the packet scheduler 1941 The number of packets dropped by the packet scheduler 1943 The number of packets which got scheduled in some way (rather than just being directly sent to the underlying miniport) 1945 The number of packets from this flow which have been sent 1947 The average number of packets in the shaper over the last sampling period 1949 The maximum number of packets that have ever simultaneously been in the shaper 1951 The average number of packets in the sequencer over the last sampling period 1953 The maximum number of packets that have ever simultaneously been in the sequencer 1955 The number of bytes which got scheduled in some way (rather than just being directly sent to the underlying miniport) 1957 The number of bytes from this flow which have been sent 1959 The number of bytes per second from this flow which have been sent 1961 The number of bytes per second from this flow which have been scheduled 1963 The number of packets per second from this flow which have been sent 1965 The number of packets per second from this flow which have been scheduled 1967 The number of packets dropped by the packet scheduler from this flow per second 1969 The number of packets that have entered the packet scheduler at a rate which exceeded the flow parameters 1971 The rate at which nonconforming packets have entered the packet scheduler 1973 The number of packets that have been sent by the packet scheduler at a rate which exceeded the flow parameters 1975 The rate at which nonconforming packets have been sent by the packet scheduler 1977 The maximum number of packets that have been queued in the netcard by this flow. 1979 The average number of packets that have been queued in the netcard by this flow. 1981 The number of times PSched has been unable to allocate a packet 1983 The number of flows opened on this pipe (some of which may now be closed) 1985 The number of flows that have been closed 1987 The number of flow creations that were rejected 1989 The of times a flow has been modified 1991 The number of times a flow modification has been rejected 1993 The maximum number of flows that have been simultaneously open on this pipe 1995 The number of packets that have entered the packet scheduler at a rate which exceeded that packet's flow parameters 1997 The rate at which nonconforming packets have entered the packet scheduler 1999 The number of packets that have been sent by the packet scheduler at a rate which exceeded that packet's flow parameters 2001 The rate at which nonconforming packets have been sent by the packet scheduler 2003 The average number of packets in the shaper over the last sampling period 2005 The maximum number of packets that have ever simultaneously been in the shaper 2007 The average number of packets in the sequencer over the last sampling period 2009 The maximum number of packets that have ever simultaneously been in the sequencer 2011 The maximum number of packets ever simultaneously in the network card 2013 The average number of packets in the network card over the last sampling period 2015 The RAS Object Type handles individual ports of the RAS device on your system. 2017 The number of bytes transmitted total for this connection. 2019 The number of bytes received total for this connection. 2021 The number of data frames transmitted total for this connection. 2023 The number of data frames received total for this connection. 2025 The compression ratio for bytes being transmitted. 2027 The compression ratio for bytes being received. 2029 The total number of CRC Errors for this connection. CRC Errors occur when the frame received contains erroneous data. 2031 The total number of Timeout Errors for this connection. Timeout Errors occur when an expected is not received in time. 2033 The total number of Serial Overrun Errors for this connection. Serial Overrun Errors occur when the hardware cannot handle the rate at which data is received. 2035 The total number of Alignment Errors for this connection. Alignment Errors occur when a byte received is different from the byte expected. 2037 The total number of Buffer Overrun Errors for this connection. Buffer Overrun Errors when the software cannot handle the rate at which data is received. 2039 The total number of CRC, Timeout, Serial Overrun, Alignment, and Buffer Overrun Errors for this connection. 2041 The number of bytes transmitted per second. 2043 The number of bytes received per second. 2045 The number of frames transmitted per second. 2047 The number of frames received per second. 2049 The total number of CRC, Timeout, Serial Overrun, Alignment, and Buffer Overrun Errors per second. 2051 The RAS Object Type handles all combined ports of the RAS device on your system. 2053 The total number of Remote Access connections. 2055 Terminal Services per-session resource monitoring. 2057 Number of bytes input on this session after all protocol overhead has been removed. 2059 The number of frames input after any additional protocol added frames have been removed. 2061 The number of times that a wait for an available send buffer was done by the protocols on the client side of the connection. 2063 Number of frames (packets) input on this Session. 2065 Number of bytes input on this session that includes all protocol overhead. 2067 Number of bytes input after compression. This number compared with the Total Bytes input is the compression ratio. 2069 Number of input compression dictionary flushes. When the data can not be compressed, the compression dictionary is flushed so that newer data has a better chance of being compressed. Some causes of data not compressing includes transferring compressed files over Client Drive Mapping. 2071 Number of input errors of all types. Some example input errors are lost ACK's, badly formed packets, etc. 2073 The total number of timeouts on the communication line as seen from the client side of the connection. These are typically the result of a noisy line. On some high latency networks, this could be the result of the protocol timeout being too short. Increasing the protocol timeout on these types of lines will improve performance by reducing needless re-transmissions. 2075 Number of input async framing errors. These can be caused by a noisy transmission line. Using a smaller packet size may help in some cases. 2077 Number of input async overrun errors. These can be caused by the baud rate being faster than the computer can handle, or a non-16550 serial line is used. Overruns can also occur if too many high speed serial lines are active at one time for the processor's power. 2079 Number of input async overflow errors. These can be caused by a lack of buffer space available on the host. 2081 Number of input async parity errors. These can be caused by a noisy transmission line 2083 Number of Terminal Services transport-level errors on input. 2085 Number of bytes output on this session after all protocol overhead has been removed. 2087 The number of frames output before any additional protocol frames have been added. 2089 This is the number of times that a wait for an available send buffer was done by the protocol on the server side of the connection. 2091 Number of frames (packets) output on this session. 2093 Number of bytes output on this Session that includes all protocol overhead. 2095 Number of bytes output after compression. This number compared with the Total Bytes output is the compression ratio. 2097 Number of output compression dictionary flushes. When the data can not be compressed, the compression dictionary is flushed so that newer data has a better chance of being compressed. Some causes of data not compressing includes transfering compressed files over Client Drive Mapping. 2099 Number of output errors of all types. Some example output errors are lost ACK's, badly formed packets, etc. 2101 The total number of timeouts on the communication line from the host side of the connection. These are typically the result of a noisy line. On some high latency networks, this could be the result of the protocol timeout being too short. Increasing the protocol timeout on these types of lines will improve performance by reducing needless re-transmissions. 2103 Number of output async framing errors. This could be caused by a hardware or line problem. 2105 Number of output async overrun errors. 2107 Number of output async overflow errors. 2109 Number of output async parity errors. These can be caused by a hardware or line problem. 2111 Number of Terminal Services transport-level errors on output. 2113 Total number of bytes on this Session after all protocol overhead has been removed. 2115 The total number of frames input and output before any additional protocol frames have been added. 2117 The number of times that a wait for an available send buffer was done by the protocols on both the server and client sides of the connection. 2119 Total number of frames (packets) on this Session. 2121 Total number of bytes on this Session that includes all protocol overhead. 2123 Total number of bytes after compression. This number compared with the total bytes is the compression ratio. 2125 Total number of compression dictionary flushes. When the data can not be compressed, the compression dictionary is flushed so that newer data has a better chance of being compressed. Some causes of data not compressing includes transfering compressed files over Client Drive Mapping. 2127 Total number of errors of all types. Some example errors are lost ACK's, badly formed packets, etc. 2129 The total number of timeouts on the communication line from both the host and client sides of the connection. These are typically the result of a noisy line. On some high latency networks, this could be the result of the protocol timeout being too short. Increasing the protocol timeout on these types of lines will improve performance by reducing needless re-transmissions. 2131 Total number of async framing errors. These can be caused by a noisy transmission line. Using a smaller packet size may help in some cases. 2133 Total number of async overrun errors. These can be caused by the baud rate being faster than the computer can handle, or a non-16550 serial line is used. Overruns can also occur if too many high speed serial lines are active at one time for the processor's power. 2135 Total number of async overflow errors. These can be caused by a lack of buffer space available on the host. 2137 Total number of async parity errors. These can be caused by a noisy transmission line. 2139 Total number of Terminal Services transport-level errors. 2141 Total references to all protocol caches. 2143 Total hits in all protocol caches. The protocol caches Windows objects that are likely to be re-used to avoid having to re-send them on the transmission line. Example objects are Windows icons and brushes. Hits in the cache represent objects that did not need to be re-sent. 2145 Overall hit ratio for all protocol caches. 2147 Number of references to the protocol bitmap cache. 2149 Number of hits in the protocol bitmap cache. 2151 Hit ratio in the protocol bitmap cache. A higher hit ratio means better performance since data transmissions are reduced. Low hit ratios are due to the screen updating with new information that is either not re-used, or is flushed out of the client cache. 2153 Number of references to the protocol glyph cache. 2155 Number of hits in the protocol glyph cache. 2157 Hit ratio in the protocol glyph cache. A higher hit ratio means better performance since data transmissions are reduced. Low hit ratios are due to the screen updating with new information that is either not re-used, or is flushed out of the client cache. 2159 Number of references to the protocol brush cache. 2161 Number of hits in the protocol brush cache. 2163 Hit ratio in the protocol brush cache. A higher hit ratio means better performance since data transmissions are reduced. Low hit ratios are due to the screen updating with new information that is either not re-used, or is flushed out of the client cache. 2165 Number of references to the protocol save screen bitmap cache. 2167 Number of hits in the protocol save screen bitmap cache. 2169 Hit ratio in the protocol save screen bitmap cache. A higher hit ratio means better performance since data transmissions are reduced. Low hit ratios are due to the screen updating with new information that is either not re-used, or is flushed out of the client cache. 2171 Compression ratio of the server input data stream. 2173 Compression ratio of the server output data stream. 2175 Total compression ratio of the server data stream. 2177 Terminal Services summary information. 2179 Total number of Terminal Services sessions. 2181 Number of active Terminal Services sessions. 2183 Number of inactive Terminal Services sessions. 2185 Microsoft Distributed Transaction Coordinator performance counters 2187 Number of currently active transactions 2189 Number of committed transactions 2191 Number of aborted transactions 2193 Number of in doubt transactions 2195 Maximum number of transactions ever concurrently active 2197 Number of transactions committed by the system administrator 2199 Number of transactions aborted by the system administrator 2201 Minimum time delta between transaction begin and commit 2203 Average time delta between transaction begin and commit 2205 Maximum time delta between transaction begin and commit 2207 Transactions performed per second 2209 Transactions committed per second 2211 Transactions aborted per second 2293 Indexing Service 2295 Number of word lists. 2297 Number of saved indexes. 2299 Size of the content index (*.ci files only) in megabytes. 2301 Number of files to be filtered and added to the index. 2303 Number of unique keys (words, etc.) in the index. 2305 Number of active query client connections. 2307 Percent merge complete for the current merge. 2309 Number of documents indexed since the index was mounted. 2311 Total number of documents in the index. 2313 Total number of queries since the index was mounted. 2315 Number of files not available and deferred for indexing. 2317 Indexing Service Filter 2319 Speed of indexing file contents and properties in megabytes per hour. 2321 Average time spent binding to indexing filters. 2323 Speed of indexing contents of files in megabytes per hour. 2325 Http Indexing Service 2327 Number of completed queries in cache. 2329 Percent of queries found in the query cache. 2331 Total cache accesses 1 2333 Percent of queries not found in the query cache. 2335 Total cache accesses 2 2337 Current number of running queries. 2339 Total number of queries run since service start. 2341 Number of queries per minute. 2343 Current number of query requests queued. 2345 Total number of query requests rejected. 2347 Number of WMI High Performance provider returned by WMI Adapter 2349 Shows High Performance Classes 2351 Shows if High Performance Classes are valid 2353 BatteryStatus 2355 ChargeRate 2357 DischargeRate 2359 RemainingCapacity 2361 Tag 2363 Voltage 2365 ProcessorPerformance 2367 frequency 2369 percentage 2371 power