Getting started with Windows performance counter

Registers the system performance libraries with WMI:

WINMGMT.EXE /RESYNCPERF

Updates registry values related to performance counters:

c:\Windows\System32\lodctr.exe /R
c:\Windows\SysWOW64\lodctr.exe /R

Source:
https://docs.microsoft.com/en-us/troubleshoot/windows-server/performance/manually-rebuild-performance-counters

To get all optional metrics from performance counter use:

typeperf -qx > available.performance.counters.log

Seek for CPU:

type available.performance.counters.log | findstr /i "process.*thunderbird.*time"

This may print:

\Process(thunderbird)\% Processor Time
\Process(thunderbird)\% User Time
\Process(thunderbird)\% Privileged Time

Metrics:

PhysicalDisk/%idle time
PhysicalDisk/Avg. Disk sec/Read
PhysicalDisk/Avg. Disk sec/Write
PhysicalDisk/Current disk queue length
Memory\Available Mbytes
\Memory\Pages/sec
Network Interface(*)\Bytes Total/sec
Network Interface(*)\Output Queue Length
Hyper-V Hypervisor Logical Processor(_Total)\% Total Run Time
Paging File\%Usage

To test out metrics open

PerfMon.msc

To test out PhysicalDisk/Avg. Disk sec/Write go:

Substitutions avaiable for defining performance counter address:

if the key is:

\Processor(_Total)\% Idle Time

At first we need to obtain:

grep -B 1 "^Processor$" counter.log

Then:

grep -B 1 "^% Idle Time$" counter.log

From:

reg export "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009" "%userprofile%\Desktop\perflib-counter-substitutions.reg.log"

Test from client side key 'Memory\Available Bytes':

zabbix_get.exe -s 127.0.0.1 -k "perf_counter[\"\4\24\"]"

With the full string:

zabbix_get -s 127.0.0.1 -k "perf_counter[\"\Process(cmd)\% User Time\",300]"

To translate manually what the counter perf_counter[\4\24\] describes:

grep -A 1 "^4$" counter.log
grep -A 1 "^24$" counter.log

Simululate through PowerShell:

Get-Counter -Counter "\LogicalDisk(*)\% Free Space"
Get-Counter -Counter "\236(*)\408"
Get-Counter -Counter "\LogicalDisk(_total)\% Free Space"
Get-Counter -Counter "\236(_total)\408"

Simulate through agent:

zabbix_get -s 127.0.0.1 -k agent.version
zabbix_get -s 127.0.0.1 -k "perf_counter[\236(*)\408]"
zabbix_get -s 127.0.0.1 -k "perf_counter[\236(_total)\408]"

Renew the counters:

c:
cd c:\windows\system32
lodctr /R
cd c:\windows\sysWOW64
lodctr /R

Restart The Performance Logs & Alerts service:

net stop "pla"
net start "pla"

Restart winmgmt (it will start back automatically):

net stop winmgmt

To find the disabled counters, run:

lodctr /q | findstr "Disabled"

For each disabled counter:

lodctr /e:<name ouf counter>

Related:
https://www.zabbix.com/documentation/3.4/manual/config/items/perfcounters
https://github.com/catonrug/zabbix/blob/master/detect-perf-metrics-other-than-0.cmd