Resource Monitor in Windows Vista and later is best suited for advanced users who need to see more details about running processes and services. As this site is primarily meant for beginners and intermediates, I will not get too technical here.
Windows 7, 8, 8.1 and 10 users can see some helpful overview of a counter's meaning by stopping mouse pointer over a column title.
Windows XP users can see most of these technical details about running processes with free Process Explorer. It does work on XP, despite stating that only Windows Vista and later are supported.
To start Resource Monitor in Windows, use keyboard shortcut Windows Key+R to open the Run dialog, type resmon (Windows 7 and newer) or perfmon /res (Windows Vista) and click OK.
Alternatively, start Task Manager with keyboard shortcut Ctrl+Shift+Esc or by right-clicking an empty Taskbar area and choosing Task Manager. Open the Performance tab and click or tap the Resource Monitor (Windows Vista and 7) or Open Resource Monitor button/link.
Resource Monitor opens in the Overview tab, with the CPU section expanded. You can open and close any section by clicking on it. You can sort any list by any column by clicking the column name. If a value is longer than column width, stop mouse pointer on it and you will see the full value in a ToolTip.
To close or show a column, right-click on any visible column and choose Hide Column or Select Columns.
Real-time history graphs for all main sections are on top in Windows Vista and on the right in Windows 7, 8/8.1 and 10. Windows 7 and later also have different tabs for a more detailed overview of resource usage and a Views combo box to switch between sizes of the graphs on the right.
CPU section displays both running processes and services and how much processor resources they are using. Section head shows current total CPU usage and at which frequency CPU is running: if there is nothing much to do, modern processors slow down automatically to save power and produce less heat.
This is pretty similar to Task Manager's Processes or Details tab, but you can see the number of active threads and average CPU usage during the last 60 seconds here. Image field in Resource Monitor is the same as Name in Task Manager.
In Windows 7, 8/8.1 and 10, right-clicking or touching and holding a running process allows ending the process or process tree, suspending and resuming the process, searching online for more info on the file name (for Internet Explorer, you might need to enable the Search in the Address Bar option in the Manage Add-ons window first), and analyzing wait chain for a hung process.
The Analyze Wait Chain tree sometimes reveals the reason why a process has stopped responding - for example, a required file is locked by another process.
Here you can see which processes or services are writing to or reading from which files. The section might be empty for a while, but it will fill eventually after some disk activity occurs. As in the CPU section, the statistics are displayed for the last minute. Section head shows current Disk I/O (Input/Output) in kilobytes and current disk usage in percentage.
By default, all processes are sorted by I/O Priority column, but I suggest sorting by Response Time (how quickly hard disk completes reading or writing) or Total (B/sec) (how much data the service or process reads or writes) columns instead.
In the picture below, the first row shows that System service has written 17 477 bytes (17 kilobytes) to Page File (Virtual Memory) in 14 milliseconds.
If the Response Time column consistently shows values over 1000 milliseconds, it is probably time to defragment your hard disk drive, free up some disk space or turn on ReadyBoost. In case money is no problem, you can replace your traditional HDD with an SSD to increase I/O speed up to 10 times.
If the above solutions do not help, and the Disk section shows frequent read and write activity for Windows Paging File (pagefile.sys), you might need to upgrade your device's Random Access Memory (RAM). More RAM means less paging and better performance even with many desktop programs and apps open.
Also, check the number of hard faults and the percentage of used physical memory in the Memory section to determine how much your device currently pages.
This section is empty until your computer does some networking: accesses the Internet or local network. Processes and services using network adapter(s) are sorted by Total (B/sec) column - how many bytes of information the program sent and/or received during the last 60 seconds. You can see the remote hostname the process or service is connected to in Address column. Section head shows current network traffic in kilobits (one byte equals 8 bits) and current usage of maximum network speed available.
Those who have installed Spybot-Search & Destroy or some other security software that modifies the hosts file might be alarmed by some processes connecting to known malware hosts. This happens because Spybot creates a list of malicious sites in Windows hosts file and assigns the IP-address of the local computer (127.0.0.1) to them to block traffic to those harmful sites (aka Immunization). When Windows tries to resolve the IP 127.0.0.1 to a hostname, it receives the first name in the hosts file.
So fear not, this is nothing to worry about until your device has this kind of security tool installed!
Here you can see how much physical memory (RAM) processes and services are using. By default, the list is sorted by Private (KB) column - the amount of dedicated memory (in kilobytes) a process or service is using.
Section head displays total Hard Faults and current total physical memory usage.
To check the total amount of RAM and paging file the process or service is using, see the Commit (KB) column.
If there are many hard faults consistently, your device is out of physical memory (RAM). Either there is a program using way too much of it (check this in the Commit (KB) column) or you need to add more RAM modules to your device.
If the Used Physical Memory is constantly over 85%, it is time to close some unneeded programs or add/replace memory modules.
Use at least 2 GB of RAM with Windows XP and at least 4-8 GB with Windows Vista and later. Do note that 32-bit (x86) versions of Windows cannot use more than 4 gigabytes of memory.
In Windows 7 and later, you can filter running processes to see only the data you need. Select one or more check boxes in the CPU section and other sections in all tabs will display only data related to the selected process(es).
The selection will be assigned a color for the graphs on the right to visually define which resources it uses the most.
Selected item(s) will move to the top of the list for easy deselecting.
Sections in the Overview tab are covered above. All other tabs in the top part of Resource Monitor show even more detailed information about how many resources are being used by processes and services. As this gets really technical, I will give a short summary of these. You can find more information about Resource Monitor in several Windows books and e-books, plus free online resources.
- The CPU tab has Processes section that functions exactly the same as the CPU section in the Overview tab. The right pane shows Total CPU and Service CPU usage graphs, plus individual usage graphs for all cores. Intel i-series CPU-s that support core parking (i3, i5, i7) reveal their status here. Parking helps save power by shutting down some cores while a CPU is not busy.
The Services section displays either all services (you can start, stop and restart these) or allows checking whether and which services the selected process/image uses.
The Associated Handles section allows searching for a specific handle name or displays open handles for the selected process/image. A handle is a pointer that refers to a system element, such as Directory, Event, File, Key, Mutant, Section, Semaphore, etc.
The Associated Modules section displays helper files (usually, DLL-s) or programs loaded by the selected process/image.
- The Memory tab also begins with the same Processes section. On the right, there are graphs for Used Physical Memory, Commit Charge (used physical memory + used pagefile) and Hard Faults/sec.
The Physical Memory is the only additional section here. It displays how RAM is currently allocated: hardware reserved, in use, modified (RAM still in use, but not used recently), standby (pagefile in use, but not used recently) and free. You can also see the amounts of available, cached, total and installed memory here. Total memory means installed - hardware reserved.
- The Disk tab lists only Processes with Disk Activity in the first section. You can filter processes here. The right pane displays graphs for total throughput on all disks and individual queue lengths for all logical disks. If queue length for a disk is consistently high even during normal usage, you should replace it with a faster disk or an SSD.
The Disk Activity section is exactly the same as the Disk section in the Overview tab.
The Storage section lists Logical Disks and their drive letters, Physical Disks and their numbers in Disk Management, Active Time (percentage of time when the drive is in use - this should not be high), Available Space, Total Space in MB and Disk Queue Length.
- The Network tab displays only Processes with Network Activity in the topmost section. You can select which processes to display in other sections. On the right, there are graphs for total network throughput, the number of TCP connections and individual usage of physical and virtual network adapters.
The Network Activity section is the same as the Network section in the Overview tab.
The TCP Connections section displays either all open connections for programs, apps and services or open connections for the selected process. You can also see local and remote address and port, packet loss and latency data for each connection. If you experience high packet loss rate for all connections, it could mean bad network cables (only if you do use these for connecting your device and router/switch), failing router/modem (try restarting it first) or just weak Wi-Fi signal.
The Listening Ports section reveals the local address on which the process in listening (waiting for new incoming connections; "unspecified" means that it uses all available network adapters), local port used by the process, protocol (TCP or UDP normally) and firewall status (how this process and port is treated by Windows Firewall: allowed or not, restricted or not).
Do not forget that you can troubleshoot performance issues in Windows Vista and newer using Event Log entries.