SolarWinds PerfStack helps you find the cause of a slow web application by placing related metrics on a shared timeline. Instead of deciding that one high CPU, memory, response-time, or network reading is the root cause, you can compare the application server, database server, network path, interfaces, and other monitored systems during the same incident window.
The practical method is to add every relevant entity, correlate CPU and memory with response time, bring in network loss and interface utilization when the path may be involved, and then test whether the abnormal readings line up in time. For an incident that already happened, use a custom historical range. For an incident happening now, start real-time polling. Save the finished analysis, share its project URL, and export the raw graph data as CSV when another team needs to investigate further.
As an Amazon Associate I earn from qualifying purchases.
What PerfStack is and why correlation matters
PerfStack is a data-correlation feature in the SolarWinds Orion platform. It displays metrics from multiple Orion modules side by side on a common timeline. The feature is useful because web performance is usually a chain rather than a single machine: a browser request may pass through a web or application server, a database server, switches and interfaces, storage, virtual infrastructure, and other monitored components before a response reaches the user.
Free tools Windows power users keep installed
One-click scans. No signup required.
A single alarming value is a lead, not proof. A server can show high CPU while the actual delay is caused by packet loss. A slow response can coincide with memory pressure, but the memory reading may be a consequence rather than the trigger. PerfStack lets you test those relationships by aligning measurements from the same period.
#1 Best Overall
- WIFI ENABLED TO CONTROL FROM ANYWHERE – Transform your home into a smart home with the Feit Electric Smart Wi-Fi Plug. Remotely turn on or off lights, fans, coffee makers, or other home appliances from your smartphone or tablet. Works seamlessly with Alexa and Google Home, giving you effortless voice control without needing a separate hub. Manage your devices anytime, whether you’re at home, at work, or traveling.
- SIMPLE SETUP, NO HUB REQUIRED – Enjoy the convenience of smart home automation without extra equipment. The plug connects directly to your 2.4 GHz Wi-Fi network, making installation fast and easy. Plug it in, download the Feit Electric app, follow the simple steps, and your devices are instantly connected. Perfect for beginners or anyone looking to expand their smart home ecosystem with minimal hassle.
- SET YOUR ROUTINE & SAVE ENERGY – Save energy, stay organized, and automate daily routines with customizable schedules and timers. Set your lamps, heaters, or appliances to turn on and off automatically at specific times, ensuring your home is always comfortable and efficient. Ideal for morning routines, evening wind-downs, or holiday lighting, giving you peace of mind and energy savings without constant manual operation.
- ENHANCED SAFETY & CONVENIENCE – Protect your home and appliances with the Feit Electric Smart Plug’s durable design and safety features. Its compact size fits easily into standard indoor outlets without blocking other sockets. With real-time app control and notifications, you can monitor appliance activity and prevent energy waste. Ideal for families, pet owners, or anyone seeking a smarter, safer, and more convenient home setup.
- RELIABLE 2.4GHz WI-FI PERFORMANCE – Designed to work exclusively on 2.4 GHz networks, this smart plug provides stable connectivity for smooth operation of all your devices. Avoid interruptions caused by incompatible networks, ensuring your appliances respond instantly when controlled via the app or voice commands. Perfect for indoor home use, it supports up to 15 amps, handling heavy-duty appliances safely and reliably.
The documented workflow was described by Kamil Anwar, a certified Systems Analyst, in an Appuals article updated May 22, 2024. He characterizes PerfStack as a data-correlation feature used with most SolarWinds Orion modules. The exact screen labels can vary with your Orion installation and permissions, but the sequence below follows the documented interface.
Which systems and metrics to put on the timeline
Start with the complete request path, not only the server where a user first reported a problem. Add the application server, database server, network devices and interfaces between them, plus any other hardware or sensors that could affect the transaction. Adding only one host leaves gaps that can make a neighboring failure look like an application defect.
Core entities
- Application or web server: the system that receives the request or runs the affected service.
- Database server: the database host or cluster used by the application.
- Network devices: routers, switches, firewalls, or other monitored devices on the path.
- Interfaces: the specific links carrying traffic between the application, database, users, and upstream services.
- Other hardware or sensors: storage, virtualization hosts, or environmental and hardware sensors when they are part of the monitored path.
Metrics to add first
Use the following readings as a starting set. Add them to one graph when a direct visual comparison is useful, or place them on separate graphs that share the same time range when different scales would obscure the pattern.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →| Metric | What it tells you | How to use it in correlation |
|---|---|---|
| Average CPU load | Whether processor demand on a selected device rises during the incident | Compare its rise and duration with response time and memory utilization |
| Average percent memory used | Whether memory consumption remains elevated on the selected system | Check whether the elevation is sustained and whether it aligns with the slow period |
| Response time | When the application or monitored transaction becomes slower | Use it as the user-impact timeline against which infrastructure readings are aligned |
| Packet loss | Whether traffic fails to reach its destination reliably | Compare loss with interface utilization and response-time changes on the same path |
| Interface transmit utilization | How heavily an interface is being used to send traffic | Look for saturation or a change that begins with the incident |
| Interface receive utilization | How heavily an interface is being used to receive traffic | Check whether inbound demand and packet loss rise together |
CPU, memory, and response time are a useful first correlation set. Add related devices and interfaces next. If the network path may be involved, add packet loss and both transmit and receive utilization rather than relying on one direction.
Step-by-step: build a PerfStack analysis
1. Open Performance Analysis
- Sign in to the SolarWinds web console.
- Open My Dashboards → Home → Performance Analysis.
Performance Analysis is the workspace where entities and their metrics are assembled into a shared investigation. If the menu is unavailable, your account may not have the required Orion access or the relevant monitored objects may not be assigned to you.
2. Add every entity involved in the path
- Click Add Entities.
- Search for the devices involved in the slow transaction.
- Select the application server, database server, relevant network devices, interfaces, and any other monitored systems that belong to the path.
- Submit the selection so the objects appear in the Metric Palette.
Use names that identify the production role or location when several devices have similar names. Selecting an interface as well as its parent device matters: a device-level view can hide a congested link that is visible only on the individual interface.
3. Select metrics from the Metric Palette
- Select a device in the Metric Palette.
- Expand its metric groups.
- Drag a metric such as average CPU load into the analysis space.
- Add average percent memory used to the same graph or to an additional graph.
- Add the response-time metric for the affected application or monitored transaction.
Keep the first view readable. If CPU, memory, and response time have very different scales, separate graphs can make the timing relationship clearer while preserving the shared horizontal time axis.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →4. Add adjacent systems and network measurements
Once the initial CPU, memory, and response-time view is in place, add the database and network entities. For a possible network problem, add packet loss, interface transmit utilization, and interface receive utilization for the links that carry the affected traffic. Continue outward only when the evidence points there; adding every available object at once can make the graph difficult to interpret.
5. Choose the incident time range
PerfStack can show a predefined range or a custom range. For an incident that has already ended, choose a custom historical period that starts before the first user report and extends beyond recovery. Include enough baseline time to see whether a reading was already elevated.
For an active incident, click Start Real-Time Polling to watch new measurements as they arrive. Keep the polling view focused on the entities most likely to affect the request, then add more devices if the pattern points toward another layer.
Rank #2
- equipped with atom n2600 d2700 processor, compatible with many freebsd based router systems, linux distros, or win.os supported, easy configuration and management
- Please note, this is a barebone only. A system memory, a storage drive and an operating system are needed to complete this system
- 13-19 inches 1u, 50w power, with power cord, make sure to use a big brand memory and ssd/hdd with quality assurance
- Designed with console, 2 x usb, 4 x lan, vga, power switch, size at 290 x 180 x 44mm
- There are 2 inside reserved fans on chassis, which could be removed freely or be turned on in a high temperature environment to ensure the best function of the product
6. Align the graphs and inspect the sequence
Read the graphs from left to right and ask which signal changes first. Note whether the change is brief, sustained, or repeated. Compare the start and end of the response-time increase with the timing of CPU, memory, packet-loss, and interface-utilization changes. A metric that peaks after the response has already degraded may be a symptom or a downstream effect rather than the initiating fault.
How to interpret common PerfStack patterns
PerfStack does not assign a root cause automatically. The following patterns are investigation guides: confirm them against the entities and time window in your own project before making a remediation decision.
Response time and CPU rise together
If response time increases at the same time as sustained high CPU on the application server, processor contention is a credible lead. Check whether the database server or another application node shows the same timing. If only one node is elevated, compare traffic distribution and the requests handled by that node before changing capacity or restarting services.
Memory remains high while the application slows
A consistently high memory reading can indicate pressure that coincides with the slow period. The example documented for PerfStack uses memory utilization consistently above 70 percent as a signal worth following. That threshold is an example from the article, not a universal failure limit; interpret it with the host’s normal baseline and the response-time graph.
After spotting sustained memory use, add interface metrics and neighboring systems. The memory condition may be real while a separate network condition is producing the user-visible delay.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Packet loss and receive utilization rise together
The documented example adds interface metrics after observing elevated memory and finds substantial packet loss together with high received utilization. That combination points the investigation toward the network path rather than proving that the application server caused the incident. Identify the affected interface and involve the network team to inspect the link, device, or traffic pattern.
When bandwidth use is the suspected problem, NetFlow Traffic Analyzer can help identify the source of high utilization. Use that result to connect a busy interface to the hosts or flows responsible, then keep the PerfStack time window aligned with the original response-time event.
Response time rises without matching host or interface changes
If CPU, memory, packet loss, and interface utilization remain near their normal patterns while response time increases, broaden the entity set. Add the database, virtualization layer, storage, web-performance monitor, or other monitored component that participates in the transaction. The absence of a matching change in the first group is a reason to expand the path, not evidence that the application is healthy.
Several systems change at the same time
When multiple devices show a simultaneous shift, use the shared time axis to separate a common event from independent symptoms. A network change can affect several servers at once; a busy application deployment can create correlated host and database demand. Save the view before altering systems so the original evidence remains available to other teams.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchHistorical investigation versus a live incident
| Situation | PerfStack approach | What to capture |
|---|---|---|
| Incident already ended | Choose a custom historical range covering baseline, degradation, and recovery | Metric alignment, first-changing signal, peak period, and recovery timing |
| Incident still active | Click Start Real-Time Polling and observe the current path | New changes as they occur, affected entities, and the moment the user symptom changes |
Historical analysis is especially useful when the report arrives after recovery. Select a range broad enough to show normal behavior before the event; a range containing only the peak can make an ordinary baseline look abnormal. In real time, avoid constantly changing the time window or removing the response-time series, because those actions make it harder to compare the latest behavior with the start of the incident.
Rank #3
- Shelly Plus 1 PM is a Wi-Fi smart relay switch with 1 channel, up to 16A with power metering that can be used also as a WiFi repeater and Bluetooth gateway. Shelly Plus 1PM can be used to monitor the consumption and take control of home appliances, electric circuits, and office equipment individually.
- Automate electrical appliance and control - With Shelly Plus 1PM you can automate any electrical appliance in your home and control it remotely. Shelly Plus 1PM can control appliances with a large load which makes it perfect for kitchen appliances and domestic systems monitoring and control. You can get precise measurements of the power consumption of each appliance and switch in on/off remotely, no matter where you are.
- Set and be prepared for everything - Reveal the full potential of Shelly Plus 1PM by combining it with other devices from your home network! Set Shelly Plus 1PM to activate custom scenes based on hour, light, or various occurrences. For example, you can set Shelly Door/Window sensor to report a porch door opening and activate Shelly Plus 1PM to turn on the hot tub heaters only in the hours after 8 pm.
- Shelly Customer Service - Shelly is one of the fastest-growing Smart Home brands in the world with devices, providing solutions for the automation of private homes, buildings and businesses. We provide our customers with professional support and a 3 years device warranty.
- Shelly Smart Control App will help you control your Shelly devices remotely and will send notifications for all automated events in your home. You can easily configure devices and manage their settings individually, or you can create personalized scenes by combining Shelly devices to trigger certain actions in your home automation.
Save, share, and export the investigation
Save a named analysis project
When the graphs show the incident window and the relevant entities, save the analysis project with a meaningful name. Include an identifying incident date, service, or environment in the name so another team can find the correct view among multiple investigations. Saving preserves the selected entities, metrics, and time range for later review.
Share the project URL
Bookmark the project or share its URL with the application, database, and network teams. A shared project gives each team the same aligned view instead of separate screenshots with different time ranges. Verify that recipients have permission to view the Orion objects; a URL cannot grant access to data their accounts cannot see.
Export raw graph data as CSV
Use Export to obtain the raw graph data in CSV format. CSV is useful when a team needs to perform deeper offline review, preserve a record outside the console, or compare the values with an incident timeline. Keep the exported file with the project name and time range so the numbers retain their context.
Modules that can contribute PerfStack data
The source identifies PerfStack support across these SolarWinds Orion modules:
| Module | How it can contribute to a web-performance investigation |
|---|---|
| Network Performance Monitor | Network-device and interface health, including packet loss and utilization metrics |
| NetFlow Traffic Analyzer | Traffic-flow detail that can help identify the source of high bandwidth use |
| Server & Application Monitor | Server and application measurements such as CPU, memory, and response-time context |
| Storage Resource Monitor | Storage-related measurements when storage is part of the application path |
| Virtualization Manager | Virtualization-layer context for workloads running on virtual infrastructure |
| Web Performance Monitor | Web-transaction performance measurements that establish the user-impact timeline |
Availability of a metric still depends on what your Orion installation monitors and what your account can access. A module being listed as supported does not mean every possible metric is present for every entity.
A disciplined root-cause workflow
- Define the symptom: record the affected URL, service, users, and approximate start and end times.
- Establish a baseline: include a period before the incident so normal CPU, memory, response time, loss, and utilization are visible.
- Start with the application path: add the application server, database server, and response-time series.
- Test host pressure: correlate average CPU load and average percent memory used with the response-time change.
- Test the network path: add the relevant devices and interfaces, then compare packet loss and transmit/receive utilization.
- Follow the first meaningful change: expand toward storage, virtualization, or another monitored layer only when the timing indicates it.
- Form a hypothesis: describe the relationship without treating one high value as proof.
- Validate with the responsible team: give the team the saved project URL and, when needed, the CSV export.
- Preserve the evidence: keep the named project and exported data before remediation changes the readings.
Common mistakes and how to correct them
Looking at one metric in isolation
Problem: an engineer sees high CPU and immediately labels the application server as the cause.
Correction: place CPU beside memory and response time, then add the database and network interfaces. Require the timing to support the hypothesis.
Adding only the application server
Problem: a dependency such as the database or a congested switch is invisible.
Correction: map the request path first and add every relevant entity to the Metric Palette before drawing conclusions.
Using a time range that starts at the peak
Problem: there is no normal reference, so ordinary utilization can appear abnormal.
Rank #4
- Portable 100M/1G Network TAP Appliance for remote capture of data traffic
- Integrated with a Raspberry Pi 4 module (8GB RAM and 64GB Micro SD Card)
- Can be used as a standalone 100M/1G network TAP with the external monitor port
- Dual DC power inputs for enhancing overall system availability
Correction: use a custom historical range that includes baseline, degradation, and recovery.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsIgnoring interface direction
Problem: only transmit or only receive utilization is shown, hiding the direction associated with loss or demand.
Correction: add both interface transmit and receive utilization, along with packet loss, when the network path is under suspicion.
Changing the view without saving it
Problem: another team receives a screenshot or a different time range and cannot reproduce the analysis.
Correction: save a named project, share its URL, and export CSV raw data when offline analysis is required.
What PerfStack can and cannot establish
PerfStack establishes temporal relationships between the metrics available in Orion. It can show that a response-time increase overlaps a memory, CPU, packet-loss, or interface-utilization change, and it can help you decide which adjacent system to investigate next.
It does not, by itself, prove causation, provide a universal threshold for failure, or replace service-specific logs and team validation. The documented example’s memory level above 70 percent is a practical lead, not a general rule for every operating system or workload. Likewise, packet loss with high receive utilization directs attention to the network path but does not identify the precise device or configuration without further investigation.
No independently published benchmark, success rate, response-time guarantee, price, or licensing figure is established for this workflow. Treat PerfStack as an observability and correlation workspace whose value comes from the quality of the entities, metrics, and time range you place in it.
When to hand the investigation to another team
Escalate with evidence rather than a conclusion. The application team should receive the saved project when response time changes with application-server or database metrics. The network team should receive the project when packet loss and interface utilization align with the symptom. Include the exact incident range, entity names, and CSV export so each team can inspect the same data.
Recommended Free Tools
If high bandwidth is the leading hypothesis, include the affected interface and use NetFlow Traffic Analyzer to help identify the source of the traffic. If the first graph does not explain the slowdown, tell the next team which entities were checked and which signals did not change; that prevents the investigation from repeating the same narrow check.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
