Using the System Information Window in Process Explorer

Learn how to open and interpret Process Explorer's System Information window, including CPU, memory, I/O, network, disk, and GPU graphs.

What the System Information window does

The System Information window is Process Explorer's system-wide monitoring dialog. It shows current resource levels, recent history graphs, and aggregate counters for the entire computer—not only the process selected in the main process list.

Use it alongside the main Process Explorer window and Windows Task Manager. Task Manager is useful for a quick overview, while System Information provides a more detailed time-based view. The history graphs help you spot when activity occurred and, for supported CPU and I/O graphs, identify the process that was the leading consumer at that time.

Tab	Primary graphs or data	What the reader can determine
Summary	Paired current-value and history displays for CPU, memory, and I/O	Whether system-wide activity is currently high and when recent peaks occurred
CPU	Detailed total and per-logical-CPU utilization history	Whether processor contention, a single-core bottleneck, or kernel-heavy work is present
Memory	System Commit, Physical Memory, and lower memory counters	Whether committed memory, installed RAM usage, or both are increasing
I/O	I/O Bytes, Network Bytes, Disk Bytes, and operation counters	Whether activity is primarily general device I/O, network transfer, or local-disk work
GPU	GPU utilization history, when supported	Whether graphics, video, rendering, or hardware acceleration is contributing to a slowdown

Opening System Information

Start Process Explorer.
On the menu bar, select View > System Information.
Alternatively, press Ctrl+I.

The System Information window can remain open while you inspect processes in the main Process Explorer window. This makes it possible to watch a system-wide graph and then select a process, open its properties, or examine its threads and command line without losing the monitoring view.

Understanding the Summary tab

The Summary tab is arranged as paired displays. One display shows a current value, while the adjacent history graph shows recent activity over time. A history graph is a time-series chart: its horizontal direction represents time, and its vertical position represents the level of the selected resource.

The main summary categories are:

CPU: processor utilization for the whole computer.
Memory: committed memory and physical RAM usage.
I/O: input/output activity, including transfer-related activity.

A current value answers “what is happening now?” A history graph answers “when did it happen, and how long did it last?” Use both views together. A high current value with a flat history may be a normal short-lived condition, while a rising or sustained history may indicate an ongoing problem.

Using history graph tooltips

Move the pointer over a point in a history graph to display a tooltip. A tooltip identifies the time represented by that point. On supported CPU and I/O history graphs, it also provides information about the process that was the leading consumer at that time.

Find a visible spike in the graph.
Hover over the spike or nearby points.
Record the displayed time and, when available, the leading process.
Return to the main Process Explorer process list.
Locate that process and inspect its current CPU or I/O activity, properties, threads, and command line.

Historical process information is a starting point, not proof that the process is still active. A process may have finished, changed workload, or been overtaken by another process since the graph point was recorded.

CPU tab and CPU utilization

The CPU tab provides a detailed history of processor utilization. CPU utilization is the percentage of available processor execution capacity currently in use. The total value represents the combined activity across the computer's logical CPUs.

In the CPU history display, the kernel-mode component is shown in red. Kernel mode is the privileged execution mode used by the Windows kernel, drivers, interrupts, and other low-level operating-system components. The total-utilization boundary is represented by the green line. The portion beneath that total-utilization line represents overall CPU use, including both kernel-mode and user-mode execution.

Sustained high total utilization: the available processor capacity is being heavily consumed. This can create contention, causing work to wait for processor time.
A large red kernel-mode portion: a substantial share of the work is occurring in privileged operating-system code. Investigate drivers, interrupts, device activity, storage, and system services as well as ordinary applications.
Mostly non-kernel activity: the workload is more consistent with application or user-mode processing, although further process-level investigation is still required.

Finding the process behind a CPU spike

Open System Information and select the CPU tab.
Locate a high point in the CPU history.
Hover over the point to obtain its time and, where available, the leading CPU-consuming process.
Return to the main Process Explorer list and inspect that process's CPU use, threads, properties, and command line.

Compare the total CPU level with the red kernel-mode area. If the red area is unusually prominent, do not limit the investigation to the apparent application process: driver, device, interrupt, or operating-system work may be contributing to the event.

Viewing one graph per logical CPU

A logical CPU is a processor execution unit reported to Windows. It may represent a physical processor core or a hardware thread provided by simultaneous multithreading. A computer with several cores and hardware threads therefore has several logical CPUs even when it has only one physical processor package.

On the CPU tab, enable Show one graph per CPU to split the aggregate history into an individual graph for each logical CPU. Compare the graphs rather than relying only on the combined percentage. A single-threaded application, interrupt pattern, or processor-affinity setting can keep one logical CPU near saturation while aggregate CPU usage appears moderate.

Memory tab

The Memory tab contains separate System Commit and Physical Memory graph sections, followed by memory-related counters. The exact labels and arrangement of lower counters can vary between Process Explorer versions, so read and identify every metric displayed in the installed version before drawing a conclusion.

System Commit

Commit charge is committed virtual-memory allocation. In this view it includes committed private memory across processes together with paged-pool memory. Private bytes are committed memory allocated privately to a process rather than shared with other processes. Paged pool is kernel memory that can be moved from RAM to paging storage when necessary.

Physical Memory

Physical memory means installed RAM and, in this context, the amount currently in use by Windows and applications. It is a measure of real memory consumption, not the total virtual-memory commitment.

Commit growth and physical-RAM growth are related but not identical:

Committed memory can rise because processes reserve and commit private memory, even if some of that memory is not currently resident in RAM.
Physical memory usage can change because Windows caches data, trims pages, shares pages, or moves pages between RAM and paging storage.
Steady growth in both graphs is stronger evidence of increasing memory pressure than growth in only one graph.

Use the lower memory counters in the target Process Explorer version to add context. Read the displayed labels individually, including any private-memory, paged-pool, physical-memory, or related counters, and compare their trends with the graphs. Then inspect processes whose private memory is growing.

Example: separating memory growth from RAM pressure

Review the System Commit history for sustained growth.
Review Physical Memory history over the same period.
Read the lower memory counters shown by your version of Process Explorer.
Inspect processes with growing private bytes after deciding whether the evidence indicates committed-memory growth, RAM pressure, or both.

I/O tab

The I/O tab separates several kinds of activity that are often confused during troubleshooting:

I/O Bytes: file and device transfer throughput.
Network Bytes: received and transmitted network activity.
Disk Bytes: throughput directed to local disks.

The graphs show recent activity over time. The lower counters show I/O, disk, and network operations since the most recent refresh. These counters are divided into Read, Write, and Other categories where displayed by the installed version.

Counter group	Read	Write	Other	Measurement scope
I/O operations	Read operations	Write operations	Operations not classified as reads or writes	General file and device I/O since the latest refresh
Disk operations	Disk reads	Disk writes	Other disk operations	Operations involving local disk storage since the latest refresh
Network operations	Network receives	Network sends	Other network operations	Network operations since the latest refresh

Operation counts and byte throughput answer different questions. A high operation count with relatively few bytes may indicate many small requests. A high byte rate may indicate large transfers even when the operation count is modest. Use both the graph rates and the lower counters.

Hover over CPU and I/O history points when supported. The tooltip can connect a spike's time with the leading process, allowing you to investigate that process in the main list.

Example: a slow backup or file transfer

Compare I/O Bytes and Disk Bytes at the time of the pause.
Review Network Bytes to determine whether data is moving across the network.
Use the applicable history tooltip to identify the leading process.
Inspect that process's I/O activity and properties in Process Explorer.

GPU tab availability and interpretation

The GPU tab is available on supported Windows versions, beginning with Windows Vista-era systems and later where the operating system and graphics support provide the required information. It will not appear on every computer.

When present, the tab displays GPU utilization over time—the degree of graphics-processing activity. Check it when diagnosing sluggish video playback, 3D software, rendering, games, or hardware-accelerated applications. Compare GPU history with CPU, memory, and I/O history during the same slowdown. If GPU utilization is not elevated, continue investigating the other resource categories instead of assuming a graphics bottleneck.

Resource interpretation reference

Metric	What it measures	Useful diagnostic signal	Related process-level follow-up
Total CPU utilization	Overall processor capacity in use	Sustained high values suggest CPU contention	Inspect CPU use, threads, properties, and command line
Kernel-mode CPU	CPU time in privileged Windows, driver, interrupt, and device-related work	A large red portion suggests low-level or device-related investigation	Correlate processes, services, devices, drivers, and I/O
Commit charge	Committed private process memory plus paged-pool memory	Steady growth can indicate increasing committed allocation	Inspect private bytes and processes with growing memory
Physical memory use	Installed RAM currently used by Windows and applications	High or rising use can indicate RAM pressure when paired with other evidence	Compare process memory and the lower memory counters
I/O Bytes	File and device transfer throughput	Shows broad input/output workload	Use the tooltip and inspect process I/O
Disk Bytes	Read and write throughput involving local disks	Shows storage-related activity	Inspect copying, backup, indexing, and application I/O
Network Bytes	Received and transmitted network throughput	Shows network transfer activity	Inspect the process generating network traffic
GPU utilization	Graphics-processing activity over time	High values can accompany rendering or hardware-accelerated workloads	Inspect the graphics-intensive application and compare other tabs

Cross-tab troubleshooting workflow

Use a repeatable correlation process rather than reading one graph in isolation:

Observe: wait for or reproduce the slowdown and note which graph spikes.
Time: hover over the history point to record its time.
Identify: read the leading process from the tooltip when the graph supports process identification.
Locate: find that process in the main Process Explorer list.
Investigate: inspect process properties, command line, threads, CPU activity, memory, or I/O.
Correlate: compare CPU, memory, disk, network, and GPU histories for related changes.

Classify the symptom before choosing the next view:

CPU-bound: total CPU is sustained at a high level, or one logical CPU is saturated.
Memory pressure: physical memory use is high or rising together with commit growth and other memory indicators.
Disk I/O: Disk Bytes and disk operation activity rise during the pause.
Network I/O: Network Bytes and network operations rise during the transfer or delay.
GPU-heavy: the supported GPU tab shows elevated utilization during graphics-related work.

Common troubleshooting patterns

The computer feels slow but total CPU is moderate

Enable Show one graph per CPU. If one logical CPU is near saturation, investigate a single-threaded process, an affinity restriction, or another workload concentrated on that processor.

CPU remains high and kernel activity is prominent

Confirm that the red kernel component is large relative to total CPU use. Correlate the period with storage, devices, drivers, interrupts, and system services. Process Explorer can help identify associated processes, but kernel-heavy work may require separate driver or device investigation.

Memory use increases steadily

Compare commit charge and physical memory history, then review every lower memory metric displayed by your Process Explorer version. Inspect processes with increasing private bytes after determining whether the growth represents committed memory, RAM consumption, or both.

The system pauses during backup or synchronization

Examine I/O Bytes, Disk Bytes, and Network Bytes at the time of each pause. Decide whether the pattern is primarily local disk activity, network transfer, or broader device I/O. Use applicable tooltips to locate the leading process.

Video playback or 3D software is sluggish

Check whether the GPU tab is available and review its history. Compare it with CPU, memory, and I/O activity. If GPU utilization is normal, continue with the resource category that shows a corresponding spike.

Next steps

After identifying a time and candidate process, move from the aggregate graphs to process-specific investigation: inspect the process properties and command line, examine its threads for CPU behavior, and review its memory or I/O activity. For an overview of the window, return to the System Information window guide.