A. If you are running performance monitor in log mode, after the log is closed and you wish to view certain processes in the drop down list you only see processes that were running at the time you started the log. This is not true :-)

  1. Start Performance Monitor (Start - Programs - Administrative Tools - Performance Monitor)
  2. Select Log View (View - Log or Ctrl-L)
  3. Add to the log the objects you wish to monitor (Edit - Add to Log), including "Process", when finished click Done
  4. From the Options menu select Log and enter a file name, a period of time and click "Start Log"
  5. When you have logged enough, switch to Performance Monitor and from Options menu select Log, select "Stop Log"
  6. Move to Chart view (View - Chart, or Ctrl+C)
  7. Load in the log you created by selecting Options - Data From , and selecting the file and click OK
  8. From the Edit menu, select Add and add the counters you wish to see, you will notice that under processes, the instances are only those running when you started, don't worry.
  9. There will probably be an area you wish to investigate, such as a spike in CPU use, disk I/O. Alter the time window to start from the peak
    - From the Edit menu, select Time Window
    - Move the left hand bar till the left line is in the correct place on the chart, i.e. the spike
    - Click OK
  10. Now from the Edit menu, and select Add, under processes there will now be processes that were running at THIS point allowing you to diagnose the problem process, you can also now put the time window back to normal and this process will still show

What this means is the instances shown are only those running at the start of the time window, so to add other processes running at other times, you may need to continue moving the start of the time window.