Question : How can I track performance of 1 process during day and save it to file?

One user complain that 1 process (Microsoft Forefront Client Security), occupies a lot of processor.

I checked it on my machine. On my machine it doesn't occupy so many processor.

Now I want to check when this behavior occurs (all day or specific times) and how many resources this process occupies. Then I want to view graphic for all day. Also I want to be able to change scale of graphic (for example from 1 hour to whole day, and vice versa)

Can I do this with built-in programs of Windows XP?
If no - with which program can do it?
Freeware programs are preferable.

Thanks a lot for help!

Answer : How can I track performance of 1 process during day and save it to file?

Follow these steps to set up a system monitor control, then follow the next steps to setup the logs

To create a custom monitoring console
Open Microsoft Management Console (MMC).
On the File menu, click Add/Remove Snap-in.
On the Standalone tab, click Add.
In the snap-in list, click ActiveX Control, and then click Add.
In the Insert ActiveX Control wizard, click Next.
There is a short delay before the next dialog box appears; this is normal.

In Control category, click All Categories.
In Control type, click System Monitor Control.
Click Next.
The System Monitor control provides the functionality of System Monitor.

In Select a name for the ActiveX control, type a name for the control, and then click Finish.
 Note

To open MMC, click Start, click Run, and then type mmc.
Creating a custom console is useful if you want to have System Monitor hosted in the same console with Event Viewer or another tool.

*************************************************************

To create a new log:
Right-click Counter Logs, click New Log Settings, type a name for the log, and then click OK.
On the General tab in Windows 2000,click Add to add the counters you want. On the General tab in Windows XP or Windows Server 2003, click Add Counters.
On the Log Files tab, click the logging options you want.
On the Schedule tab, click the scheduling options you want.
You can set similar options in Alerts. For example, you can configure the alert to send a message, start a performance data log, or run a program, if a counter exceeds a certain value.
Back to the top
Using Performance Monitor Wizard
To obtain and download the Performance Monitor Wizard (PerfWiz), visit the following Web site:
http://www.microsoft.com/downloads/details.aspx?FamilyID=31fccd98-c3a1-4644-9622-faa046d69214&displaylang=en
The Performance Monitor Wizard simplifies the gathering of performance monitor logs. It configures the correct counters to collect sample intervals and log file sizes. This wizard can create logs for troubleshooting operating system or Exchange server performance issues.

NOTES:
If you are troubleshooting a performance issue or an issue that looks like a memory leak, the objects that Performance Monitor should log include but are not limited to the following items. Memory resource issues:
Cache
Memory
Objects
Paging file
Process
Processor
System
Terminal Services (if a Terminal Server)
For all other resource issues, add additional counters:
Logical disk
NBT Connections
Network interface
Physical disk
Redirector
Server
Server work queues
Thread (do NOT capture if a terminal server)
All Terminal Server counters (if a Terminal Server)
All Protocol counters bound to network adapters
Physical Disk counters are present by default on Windows 2000.
For additional information about how to view log files for memory leaks and performance bottlenecks, click the following article number to view the article in the Microsoft Knowledge