You are a network administrator for your company. The network contains a Windows Server 2003 computer named Server4, which functions as a file server. Server4 contains several applications. One application is named App1. Another application is named App2. Users report that App2 is performing poorly. You examine Server4 and discover that App1 was started by using the start app1 /realtime command. You need to ensure that no other application was started by using the /realtime switch. What should you do? （）

A. Use Performance Monitor to create a trace log. Trace Process creations/deletions.
B. Use Performance Monitor to create a trace log. Trace Thread creations/deletions.
C. Use Task Manager to view processes. View the Base Priority column.
D. Use Task Manager to view performance. On the View menu, select Show Kernel Times.