The Power of Invisible Data Logging
When a Windows 11 computer experiences a severe performance bottleneck—such as randomly freezing for ten seconds every hour, or a massive spike in memory usage at exactly 2:00 AM—opening the Task Manager is often useless. By the time you notice the issue and open the GUI tool, the spike has already passed.
To diagnose intermittent, unpredictable system issues, system administrators rely on the Performance Monitor (PerfMon). However, leaving the graphical PerfMon window open all day consumes resources itself.
The solution is the logman (Log Manager) command. This powerful terminal utility allows you to create invisible, background “Data Collector Sets.” These sets can quietly monitor specific hardware metrics (like CPU usage, disk queue length, or network drops) for days or weeks at a time, writing the exact data to a hidden log file for you to analyze later.
Step 1: Listing Existing Data Collectors
Before you create a new performance counter, you should check if any are already running in the background.
Open the Command Prompt as an Administrator (click Start, type cmd, right-click, and select “Run as Administrator”).
Type the following command:
logman query
This will list all the Data Collector Sets currently configured on the system. You will likely see some default Windows diagnostics, such as “System Performance” or “WDC.ActiveDiscovery.”
Step 2: Creating a New CPU Monitoring Counter
Let’s say you want to find out exactly how much CPU power your computer is using over a 24-hour period, checking the usage every 5 seconds.
You can create a new Data Collector Set named “CPU_Tracker” by using the create counter argument.
Run this command exactly as written:
logman create counter CPU_Tracker -c "\Processor(_Total)\% Processor Time" -si 05 -v mmddhhmm
Breaking down the command:
create counter CPU_Tracker: Instructs logman to build a new set with this specific name.-c "\Processor(_Total)\% Processor Time": The specific Windows performance metric to track. (This syntax must perfectly match the internal names used by PerfMon).-si 05: Sample Interval. Tells the system to log a data point every 5 seconds.-v mmddhhmm: Tells logman to append the month, day, hour, and minute to the final log file name so you don’t accidentally overwrite old data.
Step 3: Starting and Stopping the Counter
Creating the counter does not actually start the logging process. The counter will sit dormant until you trigger it.
To begin quietly recording your CPU data in the background, run:
logman start CPU_Tracker
You can now close the Command Prompt, play a video game, run a heavy rendering task, or leave the computer overnight. Windows is quietly writing your CPU metrics to a file.
When you have gathered enough data, stop the counter by running:
logman stop CPU_Tracker
Step 4: Analyzing the Log Data
By default, logman saves its data in the C:\PerfLogs\Admin\ directory. If you did not specify an output format, it will likely be a .blg (Binary Log) file.
You cannot read a .blg file in Notepad. However, you can instantly convert it into a standard Comma-Separated Values (CSV) file, which can be opened and graphed beautifully in Microsoft Excel.
Use the relog command to convert the file (replace the filename with your specific output):
relog C:\PerfLogs\Admin\CPU_Tracker_05241030.blg -f csv -o C:\PerfLogs\Admin\CPU_Data.csv
You can now open CPU_Data.csv in Excel to see exactly when your processor spiked.
Step 5: Deleting the Data Collector
Once you have diagnosed your system issue, you should delete the Data Collector Set to ensure it doesn’t accidentally get turned on in the future and fill up your hard drive with useless log files.
To permanently delete the configuration (this will not delete your saved log files):
logman delete CPU_Tracker