Analyzing your Windows Perfmon logs

Great writeup by Daniel Petri:

Ever have a performance problem, but don't know what performance counters to collect or how to analyze them? The PAL (Performance Analysis of Logs) tool is a new and powerful tool that reads in a performance monitor counter log (any known format) and analyzes it using complex, but known thresholds (that are provided). The tool comes out-of-the-box with some predefined thresholds defined as high according to the Microsoft consulting/development but those can be adjusted to whatever you like.

The tool generates an HTML based report which graphically charts important performance counters and throws alerts when thresholds are exceeded. The thresholds are originally based on thresholds defined by the Microsoft product teams and members of Microsoft support, but continue to be expanded by this ongoing project. This tool is not a replacement of traditional performance analysis, but it automates the analysis of performance counter logs enough to save you time.


  • Thresholds files for most of the major Microsoft products such as IIS, MOSS, SQL Server, BizTalk, Exchange, and Active Directory.
  • An easy to use GUI interface which makes creating batch files for the PAL.vbs script.
  • A GUI editor for creating or editing your own threshold files.
  • Creates an HTML based report for ease of copy/pasting into other applications.
  • Analyzes performance counter logs for thresholds using thresholds that change their criteria based on the computer's role or hardware specs.

Read the rest of the article (with screenshots) here:

Downloads are available here:

PAL Requirements:

Operating Systems
PAL runs successfully on all of the following operating systems: Windows XP SP2, Windows Vista, and Windows 2003 Server. 32-bit only due to OWC11 requirements.
Note: The optional GUI (windows form) portion of PAL requires the Microsoft .NET Framework v2.0.
Log Parser 2.2
Log parser is a powerful, versatile tool that provides universal query access to text-based data such as log files, XML files and CSV files, as well as key data sources on the Windows® operating system such as the Event Log, the Registry, the file system, and Active Directory®. PAL uses the Log Parser tool to query perform logs and to create charts and graphs for the PAL report.
Microsoft Office Web Components 2003
Log Parser requires the Office Web Components 2003 in order to create charts.
Watch online at:
Download it ( from:

Comments (4)

  1. ThomMck says:

    This has been significantly updated so make sure you get the latest Win7 compatible version at

  2. Scott Myers says:

    There is a new tool available for analyzing perfmon data: SmartMon. SmartMon applies statistical methods to the perfmon counters to help identify the counter behaviors that might require further analysis.

    It gives you the ability to drill-down into the time periods where a perfmon counter is exhibiting unusual behavior and overlay related counters into a consolidated graph. It is very handy for identifying anomalies and determining what was going wrong.

  3. Phil Mapfumo says:

    This is a great tool however after running perfmon over 3 days. I have used PAL to process the data sets and get results for all the values on my Windows Server 2008R2 except for the following values,which will not show after l have run PAL:

    -Server Bytes Received/sec
    -Server Bytes Total /sec
    -ServerServer Sessions
    -Server Work Queues(*)*

    I would appreciate any assistance with this issue

Skip to main content