I often accidentally close Process Explorer when I only want to close one of its dialogs, because I press the ESC key once too often. Quite annoying.
Is there any way to configure Process Explorer to not close when the ESC key is pressed?
Comparing the values for the Windows performance counters Page Reads/sec and Disk Reads/sec I noticed that page reads are consistently higher, which is strange, as it seems that page reads should be a subset of disk reads. Obviously, that is not the case.
Question: why are the values for Page Reads/sec higher than Disk Reads/sec?
More information:
The following graph shows both metrics on my Win10 machine when relatively idle, green representing Page Reads/sec, red Disk Reads/sec.
As I understand it, Disk Reads/sec are IOPS for a specific physical disk, whereas Page Reads/sec are IOPS caused by reads from the page file(s). If there is a single page file, IOPS caused by page file access should be lower than IOPS for the disk as a whole.
The descriptions of both counters as displayed in Performance Monitor:
Physical Disk\Disk Reads/sec: Disk Reads/sec is the rate of read operations on the disk.Memory\Page Reads/sec: Page Reads/sec is the rate at which the disk was read to resolve hard page faults. It shows the number of reads operations, without regard to the number of pages retrieved in each operation. Hard page faults occur when a process references a page in virtual memory that is not in working set or elsewhere in physical memory, and must be retrieved from disk. This counter is a primary indicator of the kinds of faults that cause system-wide delays. It includes read operations to satisfy faults in the file system cache (usually requested by applications) and in non-cached mapped memory files. Compare the value of Memory\Pages Reads/sec to the value of Memory\Pages Input/sec to determine the average number of pages read during each operation.
I occasionally notice in Resource Monitor hard disk activity related to ETL files in the folder C:\Windows\System32\LogFiles\WMI\RtBackup.
Which process/service creates these ETL files and what is their purpose?
Resource Monitor shows "System" as the process which is correct since ETW traces (that is what ETL files are) are created by the kernel. But I am interested in the process that causes the traces to be created.
This happens on Windows 7, by the way.