Windows: How to determine the cause of heavy disk use

performanceperformance-monitoringwindowswindows-server-2008-r2

I'm using perfmon's "PhysicalDisk\% Idle Time" to determine when the disk is being used heavily. The question is, what's the best/quickest way to narrow down what was using the disk?

I'm aware of the following perfmon counters but they each have issues:

  • Memory\Pages/sec: useful if disk usage was due to paging, useless
    otherwise.
  • Process\IO Data Bytes/sec: includes non-disk IO as well
    (eg network), doesn't include processes started after perfmon setup,
    and it can be time consuming to match processes with their perfmon
    id.

Resource Monitor's Disk tab gives very useful information, but unfortunately it does not offer historical logging. It can not tell me why, for example, "% Idle Time" was 0 for 20 seconds at 10am.

The information I'm after is:

  1. Which processes were using the disk the most?
  2. What files were they accessing?

Best Answer

Install PAL, run it for a day, and let it analyze the data captured.