What is the difference between 'Objects -> Threads' and 'Process -> Thread Count' in Performance Monitor?

1048
Ben Aaronson

Two counters in performance monitor are "Threads" under "Objects" and "Thread Count" under "Process".

On machines I've looked at, there is a large difference between the values for the two counters, with Objects > Threads much larger. What does the difference between the two values indicate?

1

1 Antwort auf die Frage

2
Ben N

Let's start with ProcessThread Count for the _Total instance. This counter just goes through every process, gets its thread count, and totals that up. Doing that gives the same number as this PowerShell command:

(gwmi -Query "select threadcount from win32_process" | Select-Object -Property ThreadCount | Measure-Object ThreadCount -Sum).Sum 

That total, on my machine, is about 400 less than the ObjectsThreads counter.

One hypothesis for the discrepancy is this: In user-mode, every thread is associated with a process. Kernel-mode drivers, however, can create device-dedicated threads, which don't ever execute user-mode code and therefore, it would appear that they aren't picked up by an inspection of user-mode processes. However, it looks like the System process takes responsibility for drivers' threads, so this explanation is probably not right.

A more likely explanation is that while the above command counts all running threads, there are still thread objects that (though terminated) have not been cleaned up. Since some thread bookkeeping is kept around until all programs let go of their knowledge about it, living processes holding handles to dead threads might cause the difference.

Somewhat relevant: Internals of Windows Thread.