Program Performance

The Number of process running on your computer

At the very bottom of process explorer's window, next to CPU Usages and Commit Charge, you will find the total number of process currently running on your computer. Keep in mind that the maximum number of process that should be running on your computer depends on your unique needs, so use the following table as a reference only.

Setup Process Explorer to Display Performance Information

In process explorer, right-click on a column name and select Select Columns.

1. On the Process Image tab place a check mark next to Description and Company Name.
2. On the Process Performance tab place a check mark next to CPU Usage and Context Switches Delta.
3. On the Process Memory tab place a check mark next to Private Bytes, Virtual Size, Working Set Size and WS Private Bytes.

Then click OK.

Rearrange the columns in the following order by clicking on the column name and dragging it over: Process, PID, CPU, CSwitch Delta, Private Bytes, Working Set, Virtual Size, and WS Private.

Processes to watch out for...

Hardware related Processes

• System Idle Process: This is not a real process it only displays the amount of time the CPU spends doing nothing.
• Interrupts: An Interrupt request (IRQ) is sent to the processor (CPU) whenever a hardware device (Wireless network card, sound card, video card) requires CPU's time. The CPU raises the IRQL and performs a content switch. The cswitch delta column displays the number of interrupts that have occurred sense the last refresh and the CPU column displays the amount of CPU time spend servicing those interrupts.
• DPCs: Delayed Procedural Call (DPC) is a low priority interrupt. The content switch delta column displays the number of DPCs that have occurred sense the last refresh.

System Process

• System: This is the system process.
• smss.exe: This is the session manager subsystem and is responsible for starting the user session.
• csrss.exe: Client Server Runtime process.
• Wininit.exe: Starts several core services.
• winlogon.exe: Logon and authentication process.
• services.exe: Service control manager is responsible for starting, stopping, creating and deleting services.

Hosting Process

• Svchost.exe: Svchost is a service hosting process. To find out what services this process is hosting, double click on svchost.exe and select the Services tab or hover the mouse over svchost.exe and a pop-up box will display the services this process is currently hosting.
• Dllhost.exe: Dllhost is a service hosting process. Follow the same instructions provided for svchost.exe to view the services this process is hosting.
• Rundll32.exe: Rundll32 allows a dynamically link library (dll) to be executed like a program. To find the name of the dll that rundll32 is hosting, hover the mouse over rundll32 and a pop-up box will display the name of the dll. You can also double-click rundll32, select the Image tab and in the text field labeled Command line:, the name and location of the dll will be displayed after the text "rundll32.exe".

User Process

• Explorer.exe: This is the windowing system that you work in: desktop, taskbar, start menu.

Performance information

CPU Usage: The central processing unit (CPU) is the main brain of your computer. This counter displays the percentage of time that the CPU spends working within a process. The CPU counter is not entirely accurate and can be off by a few percent. The CPU counter is calculated by identifying the process that is currently running at a set interval. The identified process is given credit for the entire spawn of the interval, even if the process only used half of it.

Context Switch delta: A context switch occurs when a process's execution is paused so that another process can be executed (multiprocessing). Process explorer shows the number of context switches that have occurred sense the last refreshed. Because a context switch occurs every time a process begins execution, the CSwitch Delta counter shows process activity where the CPU usage counter may not. The content switch counter also shows the number of interrupts and DPCs that have occurred sense the last refresh.

With this information in mind, look at each process running on your computer. Considering the amount of resources each process consumes, identify what the process does and if it should automatically start on your computer. Then use a startup manager like Autoruns to disable unneeded or wasteful startup programs.

Start with the user processes (highlighted blue) and then move to the services (highlighted pink). To get more information about a process, right-click on the process and select properties or search online. When you find a process that you don't want to automatically start on your computer, disable that process with a startup manager like Autoruns. Once you're done, close process explorer, close your startup manager and reboot your computer. Remember, if your computer fails to boot, restore the changes you made with Last Known Good.

Memory Usage (Very Advanced)

The following is provided to give you a basic understanding of how your computer's limited supply of memory is divided between the processes running on your computer.

The Private bytes counter is the most important counter to consider when determining the amount of resources a program consumes. The seconded most important counter is the working set. The working set shows the amount of physical memory that a program has been allocated, but remember that Windows controls the size of the working set.

• Private Bytes: Private bytes displays the amount of data that is private to a program and cannot be shared with other programs. Private data includes any type of data that a program can create (variables, objects, documents) or modify (documents, photos, etc).
• Working Set: This displays the amount of physical memory (RAM) that Windows has allocated to this process. The size of the working set will change as the demand for physical memory changes. Because Windows controls the size of the working set, not the process, this counter is of little use. Tip: In the Windows Task Manager, the working set is labeled as "mem usage" - which can be a little misleading.
• Virtual Size: Displays the amount of virtual memory this program has been allocated. Every program running on your computer has a virtual memory size and a working set. The whole program may be "loaded" within virtual memory but only a small portion of it is contain within the working set (physical memory), the rest is on the hard drive. When a program requires a resource that is not contained within the working set (physical memory), Windows pauses the execution of the program, loads the required resource into the working set and then continues the execution of the program. At the same time, Windows removes the same amount of data from the working set, keeping the amount of physical memory that this program consumes the same. The program is completely unaware of the entire process.
• WS Private: When private data is not contained within the working set (RAM) it is saved to the paging file. The WS Private counter shows the amount of private data that is in the working set. The rest is contained within the paging file.