Member Avatar for Reverend Jim

I'm having issues with my TrendMicro anti-virus software where my disk activity hits 100% for 10-15 minute periods randomly throughout the day. TM tech support has made a few suggestions but in order to track their effectiveness I have to monitor my disk activity in such a way that I can keep a log. Task Manager and PerfMon will show the activity but not keep a log. While there are free apps available I am reluctant to run any of them without a recommendation from a trusted source. Any takers? Or perhaps some vb.net code out there that might do the trick?

To further explain, I don't need to track what files are being accessed. I just need to track the percentage of disk activity like I see on the Performance tab of Task Manager (Windows 10) when I select a physical disk.

Edited by Reverend Jim
  • 2 Contributors
  • 8 Replies
  • 484 Views
  • 9 Hours Discussion Span
  • Latest Post Latest Post by Reverend Jim

Dani AI

Generated

Good call, — Performance Monitor is exactly the built‑in tool for this. Create a User‑Defined Data Collector Set (Create manually → Performance counter), add the counters you need, choose a log folder and CSV (or binary) output, set the sample interval and start the collector. That produces a timestamped file you can import into Excel or chart later. (learn.microsoft.com)

To match the Task Manager “Active Time” view, collect the PhysicalDisk counter for percent busy and a few I/O/latency counters: \PhysicalDisk(*)\% Disk Time plus \PhysicalDisk(*)\Disk Reads/sec, \PhysicalDisk(*)\Disk Writes/sec, \PhysicalDisk(*)\Avg. Disk sec/Read and \PhysicalDisk(*)\Avg. Disk sec/Write. Task Manager’s Active Time maps to the disk busy counter. For long runs use a 5–15 second sample (shorter catches spikes but creates bigger logs). A compact logman example:

logman create counter DiskLog -c "\PhysicalDisk(*)\% Disk Time" -f csv -si 00:00:10 -o C:\PerfLogs\DiskLog
logman start DiskLog

Logman can also accept multiple counters and rotate/append files. (windowscentral.com)

For ad‑hoc sampling or scripted collection, PowerShell’s Get‑Counter is handy and flexible; it supports sample interval, max samples and remote machines. Example that preserves the timestamp and exports CSV:

Get-Counter -Counter '\PhysicalDisk(*)\% Disk Time' -SampleInterval 10 -MaxSamples 8640 |
  ForEach-Object { $ts=$_.Timestamp; $_.CounterSamples | Select @{n='Timestamp';e={$ts}},Path,@{n='Value';e={$_.CookedValue}} } |
  Export-Csv C:\PerfLogs\DiskTime.csv -NoTypeInformation

(learn.microsoft.com)

Tips and cautions: log to a drive with free space (logging to the system drive can affect results); CSV logs have size limits and binary (.blg) is more compact/appendable; correlate disk counters with \Process(*)\IO Read Bytes/sec / IO Write Bytes/sec to find the offending process. If you want a GUI dashboard later, ’s NetDash idea is fine — but PerfMon/logman/Get‑Counter give a low‑risk, trusted way to produce the exact time series you described. (learn.microsoft.com)

Recommended Answers

All 8 Replies

Member Avatar for rproffitt

What about auditing in Windows? is one of many priors about this.

No extra software but these logs get quite long so you may have to tweak and filter the results.

That out of the way, I don't see this issue now that my work machines are on SSD. My guess is the seek time on HDDs really piles up and no one at Microsoft ever thought of implementing Novell's elevator drive access ideas. Or that was patented.

Edited by rproffitt because: Spelling
Member Avatar for Reverend Jim

Auditing might do it but it seems to involve making a number of obscure changes to my system and I can't see that ending well. Yeah. SSDs are nice and if my current system had space for two drives (like my old Inspiron) I'd throw one in, but that still wouldn't solve the problem. It would just mask it.

I looked at all of the SysInternals utilities and the closest one was diskmon but that has too much granularity. It logs every read/write to every file. All I need is to produce a log like

DSK DATE/TIME              USAGE
--- --------------------   -----
0   2017-01-18  14:04:05     19%
0   2017-01-18  14:04:15      9%
0   2017-01-18  14:04:25     93%
0   2017-01-18  14:04:35     74%
0   2017-01-18  14:04:45     99%
0   2017-01-18  14:04:55     99%

With that type of log I could easily recreate the graph-type output from TaskMgr.

Ideally I could specify what physical disk(s) to monitor and a sampling interval. I might produce something with the diskmon log but the problem is that diskmon produces so much data that it would affect the results.

Member Avatar for rproffitt

OK then what about https://github.com/yasinkuyu/NetDash and it's disk usage seems to match your example log?
The source is there to tinker.

Remember this issue is rather well done. I've solved it on many systems with the usual ideas so I'll pause here since the question is how to get reports and not about the usual fixes.

Member Avatar for Reverend Jim

Unfortunately I cannot build NetDash as it uses a newer version of Visual Studio. I am running VS 2010 and cannot upgrade because newer versions cannot be used to debug vbScript.

Member Avatar for Reverend Jim

Actually, I think I'll download VS 2017 and install it in a virtual machine.

Member Avatar for Reverend Jim

Looks like the VM idea is out. The newest VM I have is Windows 7 Pro and VS2012 and up require at least Windows 8.

Member Avatar for Reverend Jim

Looks like an old tool will be close to what I want. perfmon.exe has been a part of Windows since XP, perhaps even back to NT. The current version is missing a few of the counters that would have been better but I can still set it to collect disk reads/writes on a user defined interval and save the data to disk so I can view the graph later. Note that this is not the same as the Performance Monitor you get at from Task Manager.

Thanks for the suggestions.

Edited by Reverend Jim
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.