Understanding Privileged Time In Performance Monitor

Privileged time is the percentage of time a process spends executing code in privileged mode. When a Windows system service is called, it often runs in privileged mode to access system-private data. This data is protected from threads running in user mode. Privileged time is an important performance metric as it can indicate whether high CPU usage is caused by internal Windows processes or user applications. A high percentage of privileged time, usually above 25%, can point to a driver or hardware issue.

Privileged Time is the percentage of time that the process threads spent executing code in privileged mode

Privileged Time is the percentage of time

Privileged mode is used when a thread needs access to system resources, like hardware or memory

Privileged mode, also known as kernel mode, is used when a thread needs access to system resources like hardware or memory. It is a measure of the amount of System CPU. When the server does not need access to protected system resources, it executes in User mode, and threads can switch between Privileged and User modes as their requirements vary.

In Windows, the Task Manager can be used to observe the percentage of Privileged Time, which is the percentage of elapsed time that the process threads spent executing code in privileged mode. When a Windows system service is called, the service will often run in privileged mode to gain access to system-private data. Such data is protected from access by threads executing in user mode. Calls to the system can be explicit or implicit, such as page faults or interrupts.

In terms of performance, it is generally recommended that % Privileged Time should be less than 30% of total CPU. A consistently high % Privileged Time can indicate a hardware or driver problem. For example, if % Interrupt Time is greater than 20%, this may indicate a hardware or driver issue.

Privileged mode is distinct from User mode, which is a restricted processing mode designed for applications, environment subsystems, and integral subsystems. The operating system switches application threads to privileged mode when they need to access operating system services.

% Privileged Time should ideally be less than 30% of total CPU

% Privileged Time is the percentage of time that process threads spend executing code in privileged mode. When a Windows system service is called, it often runs in privileged mode to gain access to system-private data. This data is protected from access by threads executing in user mode.

In general, % Privileged Time should be less than 30% of the total CPU. However, this value should be adjusted based on a baseline of your workload. If % Privileged Time is consistently high, it could indicate that the CPU is struggling to keep up with the presented workload. For example, if % Privileged Time is greater than 70% for extended periods, this could be problematic.

To investigate high % Privileged Time, you can look at other performance counters such as Interrupts, DPC (deferred procedure calls), and Context Switches/Sec. Interrupts and DPCs are types of threads that can be used to handle hardware requests. If the percentage of time spent on these threads is high (greater than 20%), it could indicate a hardware or driver problem. Context switches occur when the CPU switches execution from one thread to another, and if there are too many high-priority threads, CPU performance will degrade.

By monitoring these additional performance counters, you can gain a more detailed understanding of the system's performance and identify potential issues beyond just looking at % Privileged Time.

High % Privileged Time can indicate a driver or hardware issue

% Privileged Time is the percentage of time that a process spends executing code in privileged mode. When a Windows system service is called, the service will often run in privileged mode to gain access to system-private data. Such data is protected from access by threads executing in user mode. Calls to the system can be explicit or implicit, such as page faults or interrupts.

A high % Privileged Time can indicate a driver or hardware issue. This is because privileged mode is used when a thread needs access to system resources like hardware or memory. A high % Privileged Time means that the processor is spending a lot of time in privileged mode, which could be due to a faulty or busy driver.

To investigate a high % Privileged Time, you can look at other counters such as Interrupts and DPC (Deferred Procedure Calls). Interrupts are higher-priority threads used by the OS to handle hardware requests, while DPCs are a type of hardware interrupt that runs at a lower priority. If the % Interrupt Time or % DPC Time is also high (above 20%), this further indicates a hardware or driver problem.

You can also look at Context Switches/Sec, which measures the number of times the CPU switches between executing one thread to another. If there are too many high-priority threads, this can cause CPU performance to degrade. A high number of context switches could be due to interrupts from failing hardware or poorly written drivers or software.

In summary, a high % Privileged Time can be an indicator of a driver or hardware issue. By investigating other performance counters and metrics, you can gain more insights into the potential causes of the high % Privileged Time and take appropriate actions to resolve any issues.

% Privileged Time is calculated by measuring the percentage of time the processor spends executing the idle thread and subtracting that value from 100%

The formula for calculating '% Privileged Time' is derived from the way '% Processor Time' is calculated. '% Processor Time' is the percentage of elapsed time that the processor spends executing a non-idle thread. It is calculated by measuring the percentage of time the processor spends executing the idle thread and then subtracting that value from 100%. Each processor has an idle thread that accumulates time when no other threads are ready to run.

'Privileged Time' is the percentage of elapsed time that the process threads spent executing code in privileged mode. When a Windows system service is called, the service often runs in privileged mode to gain access to system-private data. Such data is protected from access by threads executing in user mode. Calls to the system can be explicit or implicit, such as page faults or interrupts.

Therefore, '% Privileged Time' is calculated by measuring the percentage of time the processor spends executing the idle thread and subtracting that value from 100%.

Frequently asked questions