Is it a Virus?
✔ NO - Safe
Must be in C:\Windows\System32\perfmon.exe
Warning
Multiple perfmon-related processes may appear when multiple counters or data collector sets are active
Each data collector set can spawn separate processes for counters and data logging
Can I Disable?
✔ YES
Disable UI data collection or stop Data Collector Sets in Performance Monitor; PerfMon itself will not log data
What is perfmon.exe?
perfmon.exe is the executable for Windows Performance Monitor. It provides real‑time and logged views of system performance counters across CPU, memory, disk, network, and other subsystems, using a UI to assemble and visualize counter data.
PerfMon uses Windows Performance Counters, spawning collectors that sample metrics at defined intervals. It can log to file, group counters, and present data in charts and reports for troubleshooting.
Quick Fact: Performance Monitor supports Data Collector Sets that automate counter collection and can export data for later analysis.
Types of PerfMon Processes
- Management Console Process: UI for selecting counters and viewing live charts
- Counter Collector Process: Background process that samples performance counters
- Data Logger: Writes collected data to .blg, .csv, or other log formats
- Data Collector Set Runner: Executes predefined counter sets on schedule
Is perfmon.exe Safe?
Yes, perfmon.exe is safe when it's the legitimate file from Microsoft and located in the System32 folder.
Is perfmon.exe a Virus or Malware?
The real perfmon.exe is NOT a virus. Malware may masquerade with similar names; verify via digital signature and path.
How to Tell if perfmon.exe is Legitimate or Malware
- File Location: Must be in
C:\Windows\System32\perfmon.exe or C:\Windows\SysWOW64\perfmon.exe for 64‑bit and 32‑bit systems respectively.
- Digital Signature: Right‑click perfmon.exe -> Properties -> Digital Signatures. Should show "Microsoft Windows" as signer.
- Resource Usage: PerfMon should use minimal resources when idle; unusual spikes indicate counter logging or a different program.
- Behavior: PerfMon launches when you start the Performance Monitor UI or a data collector set; persistent background activity without user action is suspicious.
Red Flags: If perfmon.exe appears outside the Windows directory (e.g., AppData, Temp), runs without opening Performance Monitor, lacks a valid signature, or continually logs, run antivirus scan.
Why Is perfmon.exe Running on My PC?
perfmon.exe runs when you start the Performance Monitor UI or when Data Collector Sets are configured to collect and log system performance data in the background.
Reasons it's running:
- Active Performance Monitoring: The Performance Monitor UI is open and counters are actively sampled in real time.
- Background Data Collection: Scheduled Data Collector Sets collect and log metrics even when the UI is not visible.
- System Diagnostics and Telemetry: PerfMon components run to gather performance counters for troubleshooting and capacity planning.
- Startup and Login: Data collector sets may be configured to launch at user login or Windows startup.
- Automated Alerts and Logs: PerfMon can trigger alerts and generate logs for long‑term monitoring.
Can I Disable or Remove perfmon.exe?
Yes, you can disable perfmon.exe. You can stop monitoring by closing Performance Monitor or disabling Data Collector Sets; PerfMon is a built‑in Windows utility and cannot be uninstalled in most editions.
How to Stop perfmon.exe
- Close Performance Monitor: Close the UI by clicking the X or pressing Alt+F4
- Stop Counter Logging: In Performance Monitor, deselect counters or stop the Data Collector Set
- Disable Startup: Open Task Manager > Startup tab > disable any PerfMon integration
- Services Check: Open services.msc and stop the 'Performance Logs & Alerts' service if it is running
- Group Policy: If applicable, configure policies to prevent automatic Performance Monitor startup
How to Uninstall PerfMon
- ✔ PerfMon is a built-in Windows feature and cannot be uninstalled on most editions; you can disable monitoring features in Settings and use alternative tooling
- ✔ If you want lighter monitoring, consider third-party tools that do not depend on perfmon.exe
Common Problems: PerfMon Not Collecting Data or Slowing Down
If perfmon.exe is not collecting data, or the UI is slow, try these common fixes.
Common Causes & Solutions
- Too many counters selected: Limit counters and logs; use Data Collector Sets to group a smaller, focused set of metrics
- Large log files or long capture duration: Shorten collection intervals and configure log rollover or file size limits
- Insufficient permissions: Run Performance Monitor as Administrator to access all counters
- Antivirus or EDR interference: Whitelist perfmon.exe in antivirus/EDR or temporarily pause protection during setup
- Disabled performance counters: Enable necessary performance counters via lodctr /R or ensure the counters are registered
- Outdated Windows components: Install the latest Windows updates to refresh performance counter libraries
Quick Fixes:
1. Open Performance Monitor (perfmon) and review added counters with minimal load
2. Remove unnecessary counters, keep only essential metrics
3. Configure a modest sampling interval (e.g., 1–5 seconds)
4. Use Data Collector Sets to isolate data collection from the UI
5. Save and schedule the collector set for automated runs
Frequently Asked Questions
Is perfmon.exe safe?
Yes. perfmon.exe is a legitimate Microsoft Windows utility located in C:\Windows\System32, used for monitoring performance counters and logging data.
Why is perfmon.exe using CPU?
PerfMon itself uses minimal CPU when idle; high CPU usually comes from the counters being sampled too aggressively or from heavy logging by Data Collector Sets.
How do I run Performance Monitor?
Open the Run dialog (Win+R), type perfmon, and press Enter. The UI lets you add counters, create Data Collector Sets, and view live and logged data.
Can PerfMon log data to a file?
Yes. In Performance Monitor, add a Data Collector Set and configure data logging to .blg, .csv, or other supported formats.
Can I disable PerfMon at startup?
Yes. Disable any startup tasks or Data Collector Sets in Task Manager or Services; PerfMon itself is not required to run on every boot.
Where are PerfMon logs stored and how can I share them?
Logs are saved to the configured path in the Data Collector Set (e.g., C:\PerfMonLogs). You can export or share the generated .blg/.csv files with others.