# logman.exe

Windows Process: Microsoft Corporation

Catalog search terms logman, performance log manager, counter log command

Windows, System Component

Performance log command. E dey create, start, and stop counter and trace collections from console. Performance Monitor na di GUI, no be dis exe.

## Wetin you need know

logman dey manage counter logs, no be perfmon GUI only.

logman.exe na di documented command for data collector sets. perfmon.exe na di Performance Monitor window. To end logman no dey close Performance Monitor graph wey you don open already.

- **E safe?**: Check the running file path, signature, and publisher. Name alone no fit confirm say e safe.

  **Na Performance Monitor?**: No. Dat GUI na perfmon

  **I suppose end am?**: Collection command fit fail

Feex tok say

If support script run logman create and I see dis name, I dey let di command finish. I no dey end Performance Monitor thinking say na di same binary.

## Wetin be logman.exe?

logman.exe dey manage performance counter logs. E no be di perfmon GUI only. Di two of dem dey talk to di same collector infrastructure wit different face.

## Wetin e dey do?

E fit create, query, start, and stop data collector sets. E no dey draw di graph. Relog and tracerpt na other tools inside dat family.

## Wetin make am dey run?

You or support script run logman, or scheduled collector dey use di command. One copy wey never exit fit dey wait for long collection.

## Inspect the running instance

Inside Windows PowerShell, this read-only query show matching process IDs, creation times and executable paths on this PC. (pcm)

`Get-CimInstance -ClassName Win32_Process | Where-Object { $_.Name -eq 'logman.exe' } | Select-Object ProcessId, ParentProcessId, CreationDate, Name, ExecutablePath | Format-List`

No result or a path we no fit access is inconclusive. Protected processes fit restrict access, and process IDs fit be reused. Keep personal paths local. (pcm)

Use the [file-identity guide](https://feex.it/wiki/l/pcm/software/system/verify-executable-path-signature/) to compare signatures and product metadata. A filename alone no fit establish safety. (pcm)

## E dey safe?

Check dis running file

System32 logman.exe na Microsoft. One logman.exe inside "booster" zip no be Performance Logs.

Compare the recorded location with the actual file. A familiar folder alone no fit establish identity. (pcm)

`C:\Windows\System32\logman.exe`

- CLI for collector sets
- GUI na perfmon.exe
- Output na .blg or trace, no be dis process

## I fit end am?

Dey stop dis command

To end logman.exe dey abort di command wey you start. Collector wey don start already fit continue to dey run under Performance Logs and Alerts service until you stop dat set.

## I fit comot am?

No

No delete logman.exe. Stop noisy collector wit logman stop or Performance Monitor. Dat one no be System32 delete.

## E suppose start with Windows?

Scheduled collector fit call am. E no be Startup Apps checkbox.

## Measure resource use

| CPU and memory   | Compare several observations for the same PID and workload. This entry get no independently measured universal baseline. (pcm)               |
| ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| Disk and network | Attribute activity to the actual process and current task; a filename alone no fit establish expected destinations or transfer volume. (pcm) |

## File information

| Executable name            | logman.exe                                                                         |
| -------------------------- | ---------------------------------------------------------------------------------- |
| Recorded installation path | C:\Windows\System32\logman.exe                                                     |
| Publisher                  | Microsoft Corporation                                                              |
| Signature check            | Inspect the actual file; this entry no dey certify its certificate identity. (pcm) |

## Common wahala dem

### Huge .blg files

Collector interval wey fast pass normal dey fill disk. Stop di set. To end only perfmon go leave sets wey logman create dey run.

### People dey close Performance Monitor and think say logging don stop

logman start sets fit outlive di GUI. Query am wit logman query.

## How to troubleshoot

Diagnose before you change anything wey fit scatter things.

### logman query

See collector sets. Na di command be dat. perfmon.exe na only di graph window.

### No replace logman from forum zip

Na Servicing get di binary.

## Technical details

Technical details

| Image name | logman.exe              |
| ---------- | ----------------------- |
| Role       | Performance log command |

## Check the identity of running file

A filename alone no fit establish safety. Verify the actual path, signature and product identity. (pcm)

## Related

Dis entities connect to dis article. Type dey show for every link.

[cmd.exe: Application Process](https://feex.it/wiki/l/pcm/process/cmd.exe/)[Wen high CPU dey normal: Guide](https://feex.it/wiki/l/pcm/software/system/when-high-cpu-is-normal/)[Wetin bi Windows process: Guide](https://feex.it/wiki/l/pcm/software/system/what-is-a-windows-process/)[Check an executable path and digital signature: Guide](https://feex.it/wiki/l/pcm/software/system/verify-executable-path-signature/)[Read Task Manager and compare process activity: Guide](https://feex.it/wiki/l/pcm/software/system/how-to-read-task-manager/)[Windows processes: Category](https://feex.it/wiki/process/windows/)

## Sources and verification

Recorded source label: August 2026. Dis label no establish independent verification. [How we dey do research](https://feex.it/wiki/research/).

- [Microsoft Learn: logman ](https://learn.microsoft.com/windows-server/administration/windows-commands/logman)· Create and control collector sets
- [Microsoft Learn: perfmon ](https://learn.microsoft.com/windows-server/administration/windows-commands/perfmon)· Performance Monitor GUI
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on top Windows PCs. No be lab benchmark.
- [Microsoft Sysinternals: Sigcheck ](https://learn.microsoft.com/en-us/sysinternals/downloads/sigcheck)· Dey explain how to check file signatures. Dis reference no establish the identity or safety of any particular running file.
- [Microsoft: Get-CimInstance ](https://learn.microsoft.com/en-us/powershell/module/cimcmdlets/get-ciminstance)· Read-only local process-query method. (pcm)
- [Microsoft: Win32_Process properties ](https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-process)· Documents process IDs, executable paths, creation dates and parent-ID reuse. (pcm)

## Dis article make sense to you?

Yes or no dey enough. Choose reason if you want, or add short note.

Quick facts

The short identity of dis page. Specs, sources, and the full story still dey inside the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: logman.exe

  **Typical path**: C:\Windows\System32\logman.exe

  **Record context**: Feex Wiki reference entry

Recorded source status: Feex Reviewed: Recorded source label: August 2026. Dis label no establish independent verification.

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/l/pcm/process/logman.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)