The Thread object type is the basic object that executes instructions in a processor. Every running process has at least one thread.
Privileged Time is the percentage of elapsed time that this thread has spent executing code in Privileged Mode. When a Windows NT system service is called, the service will often run in Privileged Mode in order to gain access to system-private data. Such data is protected from access by threads executing in User Mode. Calls to the system may be explicit, or they may be implicit such as when a page fault or an interrupt occurs. Unlike some early operating systems, Windows NT uses process boundaries for subsystem protection in addition to the traditional protection of User and Privileged modes. These subsystem processes provide additional protection. Therefore, some work done by Windows NT on behalf of your application may appear in other subsystem processes in addition to the Privileged Time in your process.
Index: 144 Default Scale: 1
Counter Type: PERF_100NSEC_TIMER Counter Size: 8 bytes
Processor Time is the percentage of elapsed time that this thread used the processor to execute instructions. An instruction is the basic unit of execution in a processor, and a thread is the object that executes instructions. Code executed to handle certain hardware interrupts or trap conditions may be counted for this thread.
Index: 006 Default Scale: 1
Counter Type: PERF_100NSEC_TIMER Counter Size: 8 bytes
User Time is the percentage of elapsed time that this thread has spent executing code in User Mode. Applications execute in User Mode, as do subsystems like the window manager and the graphics engine. Code executing in User Mode cannot damage the integrity of the Windows NT Executive, Kernel, and device drivers. Unlike some early operating systems, Windows NT uses process boundaries for subsystem protection in addition to the traditional protection of User and Privileged modes. These subsystem processes provide additional protection. Therefore, some work done by Windows NT on behalf of your application may appear in other subsystem processes in addition to the Privileged Time in your process.
Index: 142 Default Scale: 1
Counter Type: PERF_100NSEC_TIMER Counter Size: 8 bytes
Context Switches/sec is the rate of switches from one thread to another. Thread switches can occur either inside of a single process or across processes. A thread switch may be caused either by one thread asking another for information, or by a thread being preempted by another, higher priority thread becoming ready to run. Unlike some early operating systems, Windows NT uses process boundaries for subsystem protection in addition to the traditional protection of User and Privileged modes. These subsystem processes provide additional protection. Therefore, some work done by Windows NT on behalf of an application may appear in other subsystem processes in addition to the Privileged Time in the application. Switching to the subsystem process causes one Context Switch in the application thread. Switching back causes another Context Switch in the subsystem thread.
Index: 146 Default Scale: 0.01
Counter Type: PERF_COUNTER_COUNTER Counter Size: 4 bytes
The total elapsed time (in seconds) this thread has been running.
Index: 684 Default Scale: 0.0001
Counter Type: PERF_ELAPSED_TIME Counter Size: 8 bytes
ID Process is the unique identifier of this process. ID Process numbers are reused, so they only identify a process for the lifetime of that process.
Index: 784 Default Scale: 1
Counter Type: PERF_COUNTER_RAWCOUNT Counter Size: 4 bytes
ID Thread is the unique identifier of this thread. ID Thread numbers are reused, so they only identify a thread for the lifetime of that thread.
Index: 804 Default Scale: 1
Counter Type: PERF_COUNTER_RAWCOUNT Counter Size: 4 bytes
The current base priority of this thread. The system may raise the thread's dynamic priority above the base priority if the thread is handling user input, or lower it towards the base priority if the thread becomes compute bound.
Index: 682 Default Scale: 1
Counter Type: PERF_COUNTER_RAWCOUNT Counter Size: 4 bytes
The current dynamic priority of this thread. The system may raise the thread's dynamic priority above the base priority if the thread is handling user input, or lower it towards the base priority if the thread becomes compute bound.
Index: 694 Default Scale: 1
Counter Type: PERF_COUNTER_RAWCOUNT Counter Size: 4 bytes
Starting virtual address for this thread.
Index: 706 Default Scale: 1
Counter Type: PERF_COUNTER_RAWCOUNT Counter Size: 4 bytes
Thread State is the current state of the thread. It is 0 for Initialized, 1 for Ready, 2 for Running, 3 for Standby, 4 for Terminated, 5 for Wait, 6 for Transition, 7 for Unknown. A Running thread is using a processor; a Standby thread is about to use one. A Ready thread wants to use a processor, but is waiting for a processor because none are free. A thread in Transition is waiting for a resource in order to execute, such as waiting for its execution stack to be paged in from disk. A Waiting thread has no use for the processor because it is waiting for a peripheral operation to complete or a resource to become free.
Index: 046 Default Scale: 1
Counter Type: PERF_COUNTER_RAWCOUNT Counter Size: 4 bytes
Index: 336 Default Scale: 1
Counter Type: PERF_COUNTER_RAWCOUNT Counter Size: 4 bytes
Thread Wait Reason is only applicable when the thread is in the Wait state (see Thread State). It is 0 or 7 when the thread is waiting for the Executive, 1 or 8 for a Free Page, 2 or 9 for a Page In, 3 or 10 for a Pool Allocation, 4 or 11 for an Execution Delay, 5 or 12 for a Suspended condition, 6 or 13 for a User Request, 14 for an Event Pair High, 15 for an Event Pair Low, 16 for an LPC Receive, 17 for an LPC Reply, 18 for Virtual Memory, 19 for a Page Out; 20 and higher are not assigned at the time of this writing. Event Pairs are used to communicate with protected subsystems (see Context Switches).