VMware ESXi and vSphere Cluster Management

Understanding the Performance Tab in Process Explorer

Learn how to interpret CPU, memory, priority, I/O, and handle statistics for an individual Windows process in Process Explorer.

The Performance tab in Process Explorer presents performance measurements for one selected Windows process. It helps you investigate CPU consumption, committed memory, scheduling priorities, input/output activity, and growth in operating-system handles.

These are process-specific values. They do not represent system-wide totals, although the process's behavior can affect the responsiveness of the rest of Windows.

Opening the Performance tab

Open Process Explorer and select the process you want to investigate.
Open the process's properties dialog.
Select the Performance tab.

The tab contains CPU priority, accumulated user and kernel times, private-memory measurements, memory and I/O priorities, and the current handle count. Process Explorer refreshes the displayed values periodically according to its configured refresh interval. A value can therefore change while the properties dialog remains open, and a delayed change may simply mean that the next refresh has not occurred yet.

CPU priority

CPU Priority is the process scheduling priority used to influence its relative opportunity to receive processor time. The priority scale runs from 0 through 31, from lowest to highest.

When multiple runnable processes compete for a processor, a higher-priority process has a greater opportunity to receive CPU time. This does not guarantee a particular CPU percentage, and it does not make the process execute faster in every situation.

Kernel time and user time

User mode is the restricted execution mode in which ordinary application code runs. User Time is the cumulative processor time the process has spent executing application code in user mode.

Kernel mode is the privileged execution mode used by Windows and kernel-level components. Kernel Time is the cumulative processor time spent performing operating-system work on behalf of the process. This can include work involving drivers, files, networking, synchronization, and other system services.

Comparing the two values can provide a useful direction for investigation:

A relatively large user-time component suggests substantial application-code computation.
A relatively large kernel-time component suggests more time spent in operating-system work for the process.

Both values normally accumulate over the process lifetime, so they generally increase as the process runs. They are not instantaneous CPU percentages. A process can have a large accumulated time because it has been running for a long time, even if its current CPU activity is low.

Private Bytes

Private Bytes is the amount of committed memory allocated for the process's own use and not shareable with other processes. Committed memory is virtual-memory-backed allocation for which Windows has committed backing capacity, such as physical memory or page-file capacity when needed.

Private Bytes is different from the process's total working set. The working set describes pages currently resident in physical RAM, while Private Bytes describes private committed allocation whether or not all of it is currently resident. Private Bytes also excludes memory that is shared with other processes, whereas a working set can include shared pages.

A continuously rising Private Bytes value can be evidence of a possible memory leak, especially when the same operation is repeated and memory does not stabilize after the operation completes. Growth can also be legitimate—for example, an application may be caching data, loading a larger document, or expanding an internal data structure. Confirm the behavior over repeated tests rather than treating one increase as proof of a leak.

Peak Private Bytes

Peak Private Bytes is the greatest Private Bytes value observed since the current process instance started. Comparing it with the current Private Bytes value shows whether the process previously needed more private committed memory.

If Peak Private Bytes is much higher than the current value, the process reached a larger memory demand earlier and later released or reduced some private commitment. The peak is a historical high-water mark for this process instance; restarting the process begins a new measurement history.

Memory priority

Memory Priority is the default priority assigned to the process's physical memory pages. It influences the relative preference for retaining those pages in physical memory when Windows must reclaim RAM.

Memory priority does not state how much memory the process has allocated. A process can have a low or high memory priority independently of its Private Bytes amount.

I/O priority

I/O Priority is the priority assigned to the process's input/output operations. It matters most when disk or related I/O operations compete for service.

I/O priority is separate from CPU priority. CPU priority affects competition for processor time; I/O priority affects the relative treatment of input/output work under contention. Neither priority tells you how many bytes the process has read or written.

Handles

A handle is a process-owned reference to a Windows kernel object or operating-system resource. Handles can refer to files, registry keys, processes, threads, synchronization objects, and many other kernel objects.

The Handles value is the number of handles currently open in the process. A sustained, unexplained increase can indicate that the process is not releasing resource references—a possible handle leak.

To investigate, record the count before exercising a feature, repeat that feature, and observe the count across several refreshes. If the count continually rises without returning toward an expected steady level, identify which repeated operation causes the increase and investigate the resources it opens.

Performance Tab metrics reference

Metric | What it measures | How to interpret it | Common investigation use
CPU Priority | Relative scheduling priority from 0 through 31 | Higher values can receive greater opportunity for CPU time during contention | Investigate CPU competition and responsiveness concerns
Kernel Time | Cumulative execution time in kernel mode | Indicates accumulated operating-system work for the process | Investigate driver, file, network, or other system-service activity
User Time | Cumulative execution time in user mode | Indicates accumulated application-code execution | Investigate application computation
Private Bytes | Private committed memory | Shows private virtual-memory commitment, not necessarily RAM residency | Investigate memory growth and possible leaks
Peak Private Bytes | Highest Private Bytes value since process start | Shows the process's historical private-memory high-water mark | Compare earlier demand with current demand
Memory Priority | Default page-retention priority | Influences which pages are preferred for retention when RAM is reclaimed | Understand paging and memory-pressure behavior
I/O Priority | Priority of input/output operations | Influences I/O scheduling under contention | Investigate storage or related I/O interference
Handles | Current count of open kernel-object references | Sustained unexplained growth can indicate a resource leak | Investigate files, registry keys, threads, synchronization objects, and other resources

Commonly confused measurements

Measurement | What it is | What it is not
Private Bytes | Private committed virtual memory | Not the amount of process memory currently resident in physical RAM
Peak Private Bytes | Greatest Private Bytes value since this process instance started | Not the current allocation
Kernel Time and User Time | Accumulated processor execution times | Not instantaneous CPU usage
CPU Priority | Priority for competition over processor time | Not I/O priority or an amount of CPU being used
Memory Priority | Default preference for retaining the process's pages in RAM | Not the size of the process's memory allocation

Reading changes over time

The configured refresh interval determines when Process Explorer updates the displayed measurements. A single sample is less informative than a sequence of observations. Watch several refreshes while reproducing the suspected workload, and compare current values with peak values where available.

For suspected memory growth, watch Private Bytes during repeated activity and compare the current value with Peak Private Bytes.
For CPU-related behavior, compare User Time and Kernel Time while considering how long the process has been running; use a current CPU view elsewhere when you need instantaneous utilization.
For a possible handle leak, record Handles before and after a repeatable operation and check whether the count stabilizes.
For responsiveness concerns, review CPU Priority when processor contention is involved and I/O Priority when storage activity is involved.

Troubleshooting examples

Private Bytes rises during repeated activity

The process is committing more private memory. This may be a normal temporary allocation or may warrant leak investigation if the value continues growing and fails to stabilize after the work finishes.

Peak Private Bytes is much higher than the current value

The process had a larger private-memory demand earlier in its current run and later reduced some of that commitment. The peak remains recorded for the current process instance.

Handle count increases continuously

The process may not be releasing resource references. Look for a repeatable feature or operation that causes the count to rise and examine the resources used by that operation.

Kernel Time grows disproportionately

The process is spending a comparatively larger share of its accumulated execution in kernel work. Investigate the workload and its file, network, driver, synchronization, or other system interactions.

Responsiveness declines while a process has elevated priority

The process may be receiving preferential treatment during CPU or I/O contention. Review whether its assigned priority is appropriate before changing it; a priority value alone does not prove a fault.

Values do not change immediately

Allow for the configured refresh interval and observe several updates before drawing conclusions. Measurements may remain unchanged between refreshes even while the process is active.

Practical investigation workflow

Select the affected process and open its Performance tab.
Record the initial Private Bytes, Peak Private Bytes, Handles, priorities, User Time, and Kernel Time.
Reproduce the workload consistently.
Observe several refresh cycles rather than relying on one sample.
Note whether values rise, stabilize, or fall after the workload completes.
Use the pattern to choose a follow-up investigation: memory profiling for sustained private-memory growth, handle analysis for handle growth, or workload and system-interaction analysis for disproportionate kernel time.

For related process inspection, return to the Performance Tab guide.