Kernel Mode Performance Monitoring

Article
08/25/2023

The Microsoft Windows operating system allows system components and third parties to expose performance metrics in a standard way by using performance counters.

For information on adding a new performance counter provider to your code, see Using Kernel Mode Performance Counters.

About Kernel Mode Performance Counters

Performance counters are values published by a component to allow system administrators and developers to understand the status of the component. For example, a networking component might publish the number of packets sent over a network connection.

The Windows Performance Counter system allows various different components to publish performance counters through a consistent and discoverable interface. Windows Performance Counter publishers are consumed through GUI tools (e.g. perfmon), command-line tools (e.g. typeperf), and APIs (e.g. PDH and WMI). For more information, see Performance Counters. A component that publishes performance counters is called a performance counter provider.

Performance counter values can be published in three ways.

A user-mode component (e.g. a service) can publish counters via the PerfLib APIs.
A kernel-mode component (e.g. a driver) can publish counters via the PCW APIs.
An in-process performance extension DLL can perform custom collection. Note that in-process performance extension DLLs are deprecated and should not be used by new components due to performance and reliability issues.

Performance Counters for Windows (PCW) keeps track of countersets provided by kernel-mode components. It routes consumer data collection requests to the appropriate kernel-mode component and returns the requested data to the user-mode consumer.