Skip to main content

vast limits GmbH and uberAgent are now part of Citrix, a business unit of Cloud Software Group. Learn more at


Monitoring any Application’s Startup Duration

  • by Helge Klein
  • May 14, 2015

Application startup duration is an essential component of user experience. If you want to make sure that UX on your Windows machines is acceptable you need to monitor the time it takes for applications to start up. That, however, is not exactly easy – without uberAgent for Splunk.

What is Application Startup Duration?

Whenever you click an application’s icon, you wait. Sometimes a little, other times a lot. This is because applications need to perform all kinds of initializations before they are ready to show their UI and interact with the user. Additionally, all applications use additional logic outsourced into DLLs, most of which are loaded during application startup, too. Each of these DLLs is initialized in turn which adds a lot to the application’s overall startup duration.

Under the hood, applications consist of one or more processes. When you start an application, Windows creates a new process for you. But process creation is not limited to manual intervention; Windows runs dozens of services in the background, many of which regularly create child processes. These child processes need time to start up, too, of course. The longer that takes, the more sluggish the system feels.

Part of a process’ startup duration is spent waiting for the disk to read all these DLLs. In other words: process startup duration is heavily dependent on the machine’s IO performance. Therefore, when monitoring process startup duration, the generated IOPS should be kept in mind, too. If we have the IOPS in addition to the startup duration we can gauge the strain a process launch puts on the disk subsystem. We can also estimate how dependent a process’s startup performance is on disk speed.

How not to Monitor Application Startup Duration

Several vendors claim their products monitor application startup performance. In practice, it turns out many do not observe what is but create their own alternate reality instead.

  • One construct relies on regularly launching a specifically instrumented monitoring executable. This tells you something about the machine’s performance in general, but it does not tell you anything about the applications your users are running.
  • Another approach is to simulate user behavior in real applications with scripts. This, too, tells you how the machines are performing you are running the script on. It is a good method for evaluating the effects of configuration changes on the performance of the entire system, but not more.


Monitoring Application Startup the uberAgent Way

What you really need to know is how those application instances are performing that your users are actually running. You want to know things like the average startup duration – this is what most users are experiencing. You also want to know users and/or machines where startup duration is longer than the average. You might want to know how often individual applications are started. Finally, you want to see the trend: is the user experience getting better or worse?

uberAgent gives you all of that. Without requiring application-specific configuration it shows you the duration of every single process start on any monitored computer. And the IOPS during the startup phase.

About uberAgent

The uberAgent product family offers innovative digital employee experience monitoring and endpoint security analytics for Windows and macOS.

uberAgent UXM highlights include detailed information about boot and logon duration, application unresponsiveness detection, network reliability drill-downs, process startup duration, application usage metering, browser performance, web app metrics, and Citrix insights. All these varied aspects of system performance and reliability are smartly brought together in the Experience Score dashboard.

uberAgent ESA excels with a sophisticated Threat Detection Engine, endpoint security & compliance rating, the uAQL query language, detection of risky activity, DNS query monitoring, hash calculation, registry monitoring, and Authenticode signature verification. uberAgent ESA comes with Sysmon and Sigma rule converters, a graphical rule editor, and uses a simple yet powerful query language instead of XML.

About vast limits

vast limits GmbH is the company behind uberAgent, the innovative digital employee experience monitoring and endpoint security analytics product. vast limits’ customer list includes organizations from industries like finance, healthcare, professional services, and education, ranging from medium-sized businesses to global enterprises. vast limits’ network of qualified solution partners ensures best-in-class service and support anywhere in the world.


Your email address will not be published. Required fields are marked *


what is the period of time over which it can show Applications startup duration for ex a month, a day , an year ?

That depends on how you have configured Splunk. If your Splunk server holds indexed data for one year then you can go back one year. If it holds indexed data for ten years then you can go back ten years. The default is approximately 6 years. See also

Hope that helps!