Are perfmon performance counters based on the same thing “under the hood” as the ETW events used by xperf?

Question

I have recently been becoming acquainted with perfmon and with xperf. Perfmon uses performance counters and xperf uses ETW (event tracing for windows). Perfmon has objects that provide data, whereas xperf uses groups of "providers". As a newbie into this area I am asking whether anyone could tell me whether the performance counters used by perfmon are really based on the same thing under the hood as the ETW events used by xperf and if so, could you make the connection clear. If they aren't based on the same thing, could you explain how they are different?

Answer 1

Perf counters and ETW are two different things, they share no underlying infrastructure.

Counters are used to provide information as to how well the operating system or an application, service, or driver is performing. The counter data can help determine system bottlenecks and fine-tune system and application performance. The operating system, network, and devices provide counter data that an application can consume to provide users with a graphical view of how well the system is performing.

Event Tracing for Windows (ETW) is an efficient kernel-level tracing facility that lets you log kernel or application-defined events to a log file.

They can both be used for performance analysis, but ETW provides an audit trail of behaviour inside the app over time (like a traditional user-mode logfile), whereas PerfMon provides a view of either current statistics in the application ('current queue length'), or aggregated data over its lifetime (such as 'average throughput', 'total number of bytes sent').

Answer 2

It would seem that based on this document starting in Vista+ performance counters have an ETW Façade so they can be consumed exactly in the same way as ETW.

The new Performance Counter Library (PERFLIB version 2.0) included with Windows Vista® offers a number of advantages to the developer, including:

A standard inter-process communication (IPC) mechanism between a provider and consumer that is based on Event Tracing for Windows (ETW) notification, and which results in simplified development and more uniform and reliable code.