References > Component Monitor Types > Performance Counter Monitor

Performance Counter monitor

This component monitor reads Windows Performance Counter data uses Remote Procedure Calls (RPC) methods or Windows Management Instrumentation (WMI) to collect Windows Performance Counter data.

Per component monitor, you can select the preferred or primary fetching method for collecting performance counter data. Collecting this data can be a difficult process. We provide multiple methods to fetch and collect data in case of issues, including an order of polling and preferred method selections.

When you select the preferred fetching method, you set the primary or first method to use when fetching data. If issues occur, the methods fall back to a set order. The fetching methods for performance counters include the following:

Solarwinds recommends using the (default) setting. We created this setting to provide the best fetching method without requiring additional configuration.

  • (default): Recommended. This is the default fetching method and fetching order we recommend for Performance Counter data collection. It includes a configured order and fallback sequence without requiring additional configuration.
  • Managed (RPC): Calls .Net methods to collect performance counter data.
  • External (RPC): Calls CounterFetcher.exe utility to collect data. This utility calls the PDH API similarly as the PDH (RPC) method. This method isolates some memory leaks or strange behavior, usually caused by issues on Microsoft's side. This .exe runs only a short time, while the JobEngine worker process leak can cause issues of global kind.
  • PDH (RPC): Calls the PDH API directly from the polling job code. For details, see this Microsoft article.
  • WMI: Uses WMI to collect performance counter data.

All performance counters are assumed to exist within the root/CIMV2 namespace.

This monitor uses RPC requiring the following ports:

  • TCP/135
  • RPC/named pipes (NP) TCP 139
  • RPC/NP TCP 445
  • RPC/NP UDP 137
  • RPC/NP UDP 138

You can further modify the preferred polling method order through modifying specific files. Changing the order requires advanced experience and is complicated. To modify the order, see this article for details.


The statistic for this component monitor is the performance counter value.

Optionally, the statistic may be set as the difference in query values between polling cycles by checking the option for Count statistic as difference.

The Count Statistic as Difference option is applicable only for monitors whose counter value increases consistently during each polling interval. Examples of when this option is not applicable include cases such as the following:

  • Counter values sometimes increase and sometimes decrease from one polling interval to another (typical behavior for many counters)
  • Counter values consistently decrease from one polling interval to another
  • In these cases where the option is not applicable, negative statistic data values are replaced with zero (0), and the counter monitor shows 0 as the statistic data value in resources and 0 as the value on statistic data charts for this interval.

Field Descriptions


This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which is automatically saved. The variable to access this field is ${UserDescription}.

Component Type

Identifies the component type as a Performance Counter Monitor.

Enable Component

Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status.

Credential for Monitoring

Select a Windows credential that has RPC access to the target node. This is typically a Windows administrator-level credential.

Count statistic as difference

This option changes the statistic to be the difference in counter values between polling cycles.


Enter the name of the performance counter. For example: Processor Time.


Enter the instance name of the performance counter. For example: _Total.

If the performance counter has multiple instances, you can monitor each instance separately by creating a Performance Counter Monitor for each instance. For example, the performance counter % Processor Time has two instances if you have a dual-CPU system: 0 for the first CPU and 1 for the second CPU. You can create a separate Performance Counter Monitor to monitor each instance of the counter.


Enter the category of the performance counter. All performance counters are assumed to exist within the root/CIMV2 namespace. For example: Processor.

Convert Value

Checking the Convert Value check box opens the Formula box. From here, you have the ability to manipulate the returned value with a variety of mathematical possibilities. You can choose common functions from the drop down lists to manipulate the returned value, or you can select the Custom Conversion option. See setting Conversion value for more information.

Fetching Method

Select a fetching method protocol for capturing data: default (recommended), managed (RPC), external (RPC), PDH (RPC), or WMI. If you have a choice between components or templates that return the needed value using different protocols, review Choose your fetching method to decide.

Statistic Threshold

This field allows you to specify when a threshold that indicates a warning or critical level has been breached. Logical operators are in the drop down followed by a blank field for you to enter the value of this threshold. For example: Less than 15 for warning, Less than 5 for critical. See setting Application Monitor Thresholds for more information.

User Notes

This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}.