Windows

Use Task Manager with kernel times displayed

Task Manager is the de facto tool for viewing a server's utilization. Rick Vanover explains why he views kernel times in Task Manager.

I use Task Manager all the time when logged onto servers to view what is going on. I look at network percentage utilization, processor utilization, and memory resource utilization, and I see what processes (executables) are active.

One thing that I've always done is to show the kernel times in the Task Manager view. You can do this by going to the Performance tab, selecting the View menu, and then showing kernel times. Once kernel times are displayed, a red line appears representing the kernel mode applications. Figure A shows a Windows Server running Task Manager with kernel times. Figure A

In Figure A, the spikes in activity were caused by user activity on the console. There are backend processes that interact with the console applications, but the key is that there is separation between the kernel time (red) and user time (green).

When kernel or privileged mode processes are consuming processor resources on the server, the separation between the two is reduced. Figure B shows a kernel mode process consuming resources. Figure B

With kernel time displayed, you can determine if there is too much activity on the server attributed to your (or another administrator's) session. If I am running administrative tools locally, I may determine that I'm taking too much of the user processor resources. The most egregious example is when the CPU is pegged at 100%. If the kernel time is at the high mark, the server is busy doing server functions; if there is kernel and user separation, it is clear that the administrative session is taking too much server processor resources.

The kernel time display is a valid configuration on all versions of Windows. Go to TechNet for more information about Task Manager.

If you use kernel times, let us know how it has helped your troubleshooting practices.

Stay on top of the latest Windows Server 2003 and Windows Server 2008 tips and tricks with our free Windows Server newsletter, delivered each Wednesday.

Automatically sign up today!

About

Rick Vanover is a software strategy specialist for Veeam Software, based in Columbus, Ohio. Rick has years of IT experience and focuses on virtualization, Windows-based server administration, and system hardware.

5 comments
davidt
davidt

There's this pesky Dell process (dkaberr.exe) that goes nuts every couple of months; my morning server report points me in the right direction and I check task manager to pinpoint it. It always seems to be an app, not a server process.

laman
laman

Why can't you simply put in a line telling people to click Show Kernel Times on the View menu to see the kernel times display.

dwlee28
dwlee28

I use Process Explorer to replace Task Manager. It shows much more detail, including the tasks that are running under a particular svchost process. It is much easier to troubleshoot problems with it than with Task Manager.

dwiebesick
dwiebesick

I also always display the kernel times. Then you can troubleshoot excessive deferred procedure calls (DPC) time with utilities like Kernrate Viewer (KrView)

Hal_9001
Hal_9001

On my XP Pro, that menu option is only available when you are in the Performance tab.

Editor's Picks