Performance tool architecture
Various levels of the Windows architecture support the operation of System Monitor and Performance Logs and Alerts. For example, the performance tools obtain data by default by means of the registry. You may optionally collect data by means of the Windows Management Instrumentation (WMI) interface for hardware resources or applications installed on the system. The Performance Data Helper dynamic-link library (DLL) acts as an intermediary between the WMI and the performance tools to format the data and make calculations, where necessary, to convert raw data for display or reporting. For information about configuring performance tools to collect data using WMI, see To collect performance data by using WMI
DLLs supplied by the operating system provide counters for monitoring the behavior of resources such as memory, processors, disks, and network adapters and protocols. In addition, many Windows services and BackOffice applications provide their own DLLs that install counters that you can use to monitor their operation.
System Monitor and Performance Logs and Alerts use the Remote Registry service process that manages user logon and logoff operations for remote monitoring connections. In addition, they use the Messenger service in Windows for sending users alert notification. (This service must be running for alert notifications to be received.)