How to Enable Heap Counters for Sysmon (290639)

IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry

SUMMARY

The heap performance-monitoring counter is a new feature in Microsoft Windows XP. Performance Logs and Alerts (Perfmon.exe) can display about 20 heap-related counters. These counters are not enabled by default; you must enable them.

MORE INFORMATION

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

Additional heap counters:

Total Frees/sec
Committed Bytes
Reserved Bytes
Virtual Bytes
Free Bytes
Free List Length
Avg. alloc rate
Avg. free rate
Uncommitted Ranges Length
Allocs - Frees
Cached Allocs/sec
Cached Frees/sec
Allocs <1K/sec
Frees <1K/sec
Allocs 1-8K/sec
Frees 1-8K/sec
Allocs over 8K/sec
Frees over 8K/sec
Total Allocs/sec
Blocks in Heap Cache
Largest Cache Depth
% Fragmentation
% VAFragmentation

Heap Lock contention

Perfmon.exe displays these counters when the following registry key is set:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfProc\Performance
"DisplayHeapPerfObject"=dword:00000001

For the changes to take effect, you need to restart the computer after you modify the registry. Note that only the process heap and the heaps with higher usage are monitored.