Watch Windows Hosts Over Time: Performance Counters and Live Tracing

July 5, 2026 · InfraScout Team

InfraScout has always been good at point-in-time questions about a Windows host. The event log tells you what already happened; a health check tells you the state right now. But some problems never show up in a single command. They're intermittent, they only appear under load, or they happen at boot — before you can attach to the host at all. This update lets InfraScout watch a Windows host over time: read performance counters as a snapshot or a short sampled series, start a background trace that keeps recording for hours or days, and reach for ready-made capture profiles built for the investigations you run most.

Each of these works the way the rest of InfraScout does — you ask a question in an assessment against a connected host, and the AI reaches for the right tool. What's new is that the answer can now come from watching, not just from asking once.

Performance counters: a snapshot or a short series

Windows exposes thousands of performance counters — CPU, disk, and memory, plus role-specific sets like the directory-service (NTDS) counters on a domain controller or the SQL Server counters where SQL is installed. InfraScout can now read them two ways. A point-in-time read answers "what is this counter right now." A short sampled series — up to five minutes — answers the more useful question: "what does this counter do over the next minute." The series comes back with the minimum, maximum, average, and last value already computed, so you see the shape of a spike instead of whichever instant you happened to catch.

The set of available counters varies from host to host — the directory-service counters exist only on domain controllers, the SQL counters only where SQL Server is installed — so InfraScout can discover what a given host actually exposes before it reads anything. An assessment asks for counters that are really there, rather than guessing at names and coming back empty.

This turns a vague "the server feels slow" into something measurable in one step: sample the processor, the disk queue, and available memory for a minute, and read back the peaks.

Live tracing for problems a single command misses

Some failures leave nothing behind for a one-shot command to find. An intermittent DNS lookup that fails one time in fifty, a burst of network activity that only happens under load, a process that starts and exits before you can catch it — by the time you run a command, the moment is gone. For these, InfraScout can now start a background trace on the host using Windows' built-in tracing facility, Event Tracing for Windows.

A trace keeps recording on the host itself — for hours, or up to seven days — and it survives the things that would end a live command. Close the conversation, open a new one tomorrow, even restart the agent: the trace is still running, still capturing. While it runs, you can read decoded events from it at any time, narrowed to what you care about — a minimum severity, a specific source, or a particular decoded property value — and stop it when the investigation is done.

That persistence is the whole point. A live command samples the instant you run it; a running trace is already recording when the intermittent thing finally happens.

TIP

You don't have to babysit a trace. Start one for an intermittent problem, leave, and come back hours later in a fresh assessment to read the events around the time the symptom occurred — then stop the trace. The recording lives on the host, not in the conversation.

Traces come back readable

A raw trace is a stream of numeric codes, and reasoning over it means constantly translating. InfraScout decodes as it reads. Events arrive with friendly source, event, and operation names instead of raw identifiers, so a trace reads like a description of what the host did rather than a table of numbers.

Status codes get the same treatment where it matters most: DNS and Kerberos results carry a plain-language meaning alongside the code, so a Kerberos failure tells you what failed — an expired ticket, a name that didn't resolve to a principal — not just a value to look up. And because a multi-hour trace can hold a great deal, you can pull a specific time slice out of it rather than reading the whole thing, lining the read up with the minute a symptom occurred.

Curated capture profiles for common investigations

Raw tracing is powerful, but it assumes you know which low-level sources to turn on for a given problem — and that knowledge is specialized. InfraScout closes that gap with Data Collection Sets: ready-to-run capture profiles, each tuned for a specific investigation, so nobody has to assemble the right sources by hand.

Nine of them are built for problems you can reproduce on demand. Each runs for up to five minutes and is kept for an hour afterward, so there's time to read the results before they age out. For security work, an incident-response profile records the activity an investigation looks at first — process and image starts, DNS lookups, PowerShell, WMI, and antimalware script scanning — while an Active Directory reconnaissance profile watches the LDAP and Kerberos (KDC) traffic that enumeration tools generate. For access failures, an authentication profile follows the logon path end to end across Kerberos, NTLM, Netlogon, and Schannel, so a failure names its stage instead of surfacing as a generic denial; an SMB profile captures signing, dialect negotiation, and access-denied detail for shares that won't mount; and a TLS profile follows the handshake and the certificate chain, revocation checks included, when a secure connection won't establish. For getting devices online and trusted, profiles cover 802.1X association on wired and wireless networks, Intune/MDM enrollment and policy sync, Entra device registration and Workplace Join, and certificate enrollment.

Because a profile enables exactly the sources its investigation needs and nothing more, the trace you get back is already focused on the problem — no wading through unrelated noise to find the events that matter.

Boot profiles for problems that happen before you can look

The hardest Windows problems to catch are the ones that happen before or during logon — the window a trace started after boot can never reach. Consider an Entra-joined machine using Cloud Kerberos Trust for Windows Hello for Business. On-prem single sign-on depends on a ticket exchange at that very first logon, and if there's no network at exactly that moment, the exchange fails and never recovers on its own. You can't reproduce that on demand with a live trace; by the time you're in a position to start one, the failure has already happened. You have to be recording before it does.

That's what boot profiles are for. You arm a profile, reboot the host, and InfraScout picks the capture back up on its own once the host is online again — so the trace is running through the exact window the problem lives in. Alongside the Cloud Kerberos Trust case, the boot set covers other logon-time failures a post-boot trace can't reach, such as slow logon and Group Policy processing, classic domain-joined machine-trust (secure-channel) failures, and pre-logon 802.1X on wired and wireless networks.

Keep your agents current

These capabilities need an up-to-date agent

Performance counters, live tracing, and the capture profiles all run on the host, so they require a current agent — older agents simply don't offer them. Agent auto-update keeps your fleet current automatically; review your update policy to confirm it covers the hosts you want to investigate.

Try it

Open an assessment against a connected Windows host and ask a question that calls for watching rather than a single look. "Sample CPU, disk queue, and available memory on this domain controller for a minute and tell me the peaks" comes back as a computed series. "Something resolves DNS intermittently on this host — start a trace and I'll check back later" starts a background capture you can read whenever the failure recurs. And for the problems that only happen at startup, "arm the Cloud Kerberos Trust boot profile; I'll reboot" gets you recording through the one window that matters.

Questions, or a Windows problem you'd like a capture profile for? Reach us at info@infrascout.cloud.