Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Data collection for troubleshooting performance-related issues on the OfficeScan/Apex One endpoint

    • Updated:
    • 20 Dec 2020
    • Product/Version:
    • Apex One 2019
    • OfficeScan XG
    • Platform:
    • Windows 10
    • Windows 2008 Server R2 Enterprise
    • Windows 2012
    • Windows 2012 R2
    • Windows 2016
    • Windows 2019
    • Windows 7 32-Bit
    • Windows 7 64-Bit
    • Windows 8 32-Bit
    • Windows 8 64-Bit
    • Windows 8.1 32-Bit
    • Windows 8.1 64-Bit

If there is still a performance issue on an endpoint after following the KB article Identifying and resolving performance-related issues caused by the Behavior Monitoring and Device Control and applying known applicable exclusions, further data collection may be necessary to determine the issue.


Please first perform the steps in the KB article General Problem Isolation Testing to help determine what component is causing the performance issue. Provide the notes of the isolation testing, as well as the output of the Case Diagnostic Tool while reproducing the issue.

Once you have isolated the issue, you will want to collect additional relevant information while reproducing the issue.

Microsoft provides a tool called the Windows Performance Recorder, which collects detailed performance-related data from Windows.

To use this tool:

  1. Download and install the Windows Performance Toolkit from the Windows MSDN.
    • Windows 8 and later: Use Win10 WPT
    • Windows 7/2008R2: Use Win8 WPT
  2. Once installed, open an elevated command prompt and type the following:


    This is the Windows Performance Recorder.

    Troubleshoot performance issue

  3. Select the following items and change the logging mode to "[File]":
    • CPU usage
    • Disk I/O activity
    • File I/O activity
    • Registry I/O activity

    If this is a performance-related issue, also select:

    • Heap usage
    • Pool usage
    • Minifilter I/O activity (under Scenario Analysis section)

    Troubleshoot performance issue

    Windows Performance Recorder

  4. Click the Start button to begin data collection.

    Troubleshoot performance issue

  5. Reproduce the performance issue.
  6. After the issue has been reproduced for at least 5 minutes, click the Save button to stop recording.

    Troubleshoot performance issue

  7. Save the resulting .etl file.

    Troubleshoot performance issue

  8. Open in WPA and see if the WPR recording captured the resource outage issue.

    Below is a bad example i.e. the left side is blank and it cannot be used for trouble shooting:

    Windows Performance Recorder

    An ideal recording shall look like the following i.e. it has enough length and the resource outage issue is captured several times for comparison:

    Windows Performance Recorder

  9. Compress the .etl file as a ZIP and upload it to your support case.

    Troubleshoot performance issue


Process Monitor can also be useful for performance issues, although care needs to be taken as Process Monitor can also have a performance impact on the machine.

To use the tool:

  1. Download the Process Monitor Utility from Microsoft and place it in the machine.
  2. Extract the files.
  3. Run ProcMon.exe and accept the EULA.

    It will automatically begin collecting data.

  4. Reproduce the performance issue on the machine.
  5. After the issue has been reproduced, stop the collection by clicking the magnifying glass icon in Process Monitor so that there is a red line through it.

    Troubleshoot performance issue

  6. Choose File > Save and then All events and Native Process Monitor Format (PML).

    Troubleshoot performance issue

  7. Zip the PML file, then upload it for review.
Configure; Troubleshoot
Solution Id:
Did this article help you?

Thank you for your feedback!

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.