# logman.exe

Windows Process: Microsoft Corporation

Also called logman, performance log manager, counter log command

Windows, System Component

Performance log command. It creates, starts, and stops counter and trace collections from a console. Performance Monitor is the GUI, not this exe.

## What you need to know

logman manages counter logs, not perfmon GUI only.

logman.exe is the documented command for data collector sets. perfmon.exe is the Performance Monitor window. Ending logman does not close a Performance Monitor graph you already opened.

- **Safe?**: Yes, in System32

  **Is it Performance Monitor?**: No. That GUI is perfmon

  **Should I end it?**: A collection command can fail

Feex says

If a support script ran logman create and I see this name, I let the command finish. I do not end Performance Monitor thinking it is the same binary.

## What is logman.exe?

logman.exe manages performance counter logs. It is not the perfmon GUI only. Both talk to the same collector infrastructure with different fronts.

## What does it do?

It can create, query, start, and stop data collector sets. It does not draw the graph. Relog and tracerpt are other tools in that family.

## Why is it running?

You or a support script ran logman, or a scheduled collector uses the command. A copy that never exits may be waiting on a long collection.

## Is it safe?

Usually safe

System32 logman.exe is Microsoft. A logman.exe in a "booster" zip is not Performance Logs.

A legitimate copy normally runs from:

`C:\Windows\System32\logman.exe`

- CLI for collector sets
- GUI is perfmon.exe
- Output is a .blg or trace, not this process

## Can I end it?

Stops this command

Ending logman.exe aborts the command you started. A collector that already started can keep running under the Performance Logs and Alerts service until you stop that set.

## Can I remove it?

No

Do not delete logman.exe. Stop a noisy collector with logman stop or Performance Monitor. That is not a System32 delete.

## Should it start with Windows?

A scheduled collector may call it. It is not a Startup Apps checkbox.

## Normal resource behavior

These are contextual labels, not universal averages.

- **CPU**: Low for the command. Counters are elsewhere

  **Memory**: Small

  **Disk**: The log file the collector writes

  **Network**: Remote collection if you asked for it

## File information

| Executable name        | logman.exe                     |
| ---------------------- | ------------------------------ |
| Common legitimate path | C:\Windows\System32\logman.exe |
| Publisher              | Microsoft Corporation          |
| Signature expectation  | Signed by Microsoft Windows    |

## Common problems

### Huge .blg files

A collector interval that is too fast fills the disk. Stop the set. Ending only perfmon leaves logman-created sets running.

### People close Performance Monitor and think logging stopped

logman start sets can outlive the GUI. Query with logman query.

## Troubleshooting

Diagnose before you change anything destructive.

### logman query

See collector sets. That is the command. perfmon.exe is only the graph window.

### Do not replace logman from a forum zip

Servicing owns the binary.

## Technical details

Technical details

| Image name | logman.exe              |
| ---------- | ----------------------- |
| Role       | Performance log command |

## Related

These entities connect to this article. Type is shown on every link.

[cmd.exe: Application Process](https://feex.it/wiki/process/cmd.exe)[When high CPU is normal: Guide](https://feex.it/wiki/software/system/when-high-cpu-is-normal)[What is a Windows process: Guide](https://feex.it/wiki/software/system/what-is-a-windows-process)

## Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. [How we research](https://feex.it/wiki/research).

- [Microsoft Learn: logman ](https://learn.microsoft.com/windows-server/administration/windows-commands/logman)· Create and control collector sets
- [Microsoft Learn: perfmon ](https://learn.microsoft.com/windows-server/administration/windows-commands/perfmon)· Performance Monitor GUI
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on Windows PCs. Not a lab benchmark.

## Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Quick facts

The short identity of this page. Specs, sources, and the full story stay in the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: logman.exe

  **Typical path**: C:\Windows\System32\logman.exe

  **Mapped by Feex**: Seen on Windows PCs in Foxhole

Feex Reviewed: Last verified August 2026

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/process/logman.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)