How Windows 95 System Monitor Tracked Performance

System Monitor (sysmon.exe) in Windows 95 was a built-in administrative tool designed to visualize system resource allocation and hardware activity in real time. By querying dynamic virtual device drivers through low-overhead system interfaces, the utility tracked critical subsystems—including CPU utilization, memory allocation, network traffic, and file system operations—and presented this data through customizable visual representations.

The Underlying Data Engine

Unlike modern Windows operating systems that rely on the Windows Management Instrumentation (WMI) or modern Performance Counter architectures, Windows 95 obtained real-time performance statistics through Virtual Device Drivers (VxDs).

These metrics were exposed to user-space utilities via a specialized section of the Windows Registry known as HKEY_DYN_DATA\PerfStats. While typical registry entries were stored statically on disk, HKEY_DYN_DATA was entirely dynamic and memory-resident. Windows 95 drivers continuously updated these hardware and software counters in RAM. When System Monitor ran, it registered an active poll against these registry keys, querying the current values at regular, user-defined intervals without incurring significant processor overhead on contemporary 386 and 486 hardware.

Display Modes and Visual Presentation

System Monitor translated these dynamic counters into three distinct visual formats, which users could mix and match across different metrics:

  • Line Charts: The default and most common view, plotting performance values along a scrolling horizontal time axis. It resembled an electrocardiogram, moving from right to left, showing historical trends alongside current levels.
  • Bar Charts: Displayed horizontal bars that grew or shrank relative to a defined maximum value, offering an at-a-glance comparison of utilization peaks.
  • Numeric Charts: Showed the exact, instantaneous value as a digital readout, which was ideal for tracking discrete numbers such as active threads, allocated memory in bytes, or open files.

Users could customize the visual aesthetics to improve readability. The interface allowed modification of background colors, chart line colors, and the visibility of gridlines. Users could also set scales manually or leave them set to automatic scaling, which adjusted the vertical axis dynamically based on peak values.

Monitored Subsystems

System Monitor categorized metrics based on the internal modules reporting data:

  • Kernel: Tracked overall processor usage as a percentage, the number of active virtual machines, and the total count of running threads.
  • Memory Manager: Displayed physical RAM allocation, swap file (paging) size, available virtual memory, and page fault rates to help diagnose low-memory thrashing.
  • File System: Measured read and write throughput in bytes per second, alongside cache hit/miss ratios to evaluate disk performance.
  • Network (Client and Server): Monitored incoming and outgoing packet rates, open network files, and throughput for protocols such as NetBEUI, IPX/SPX, and TCP/IP.

Polling Frequency and System Impact

Because personal computers running Windows 95 were resource-constrained, System Monitor featured an adjustable update interval. Users could configure the refresh rate via the utility's settings, choosing intervals ranging from every half-second up to several minutes. This allowed users to balance diagnostic precision against the minor CPU overhead required to sample and redraw the graphs.