Monitoring performance

System Monitor and Performance Logs and Alerts support detailed monitoring of the utilization of operating system resources.

  • Before monitoring your system, see Checklist: Monitoring performance.
  • To find features that have been changed in Windows 2000, see New ways to do familiar tasks.
  • For tips about performance monitoring, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.


Checklist: Monitoring performance

Step | Reference
Read key concepts about monitoring performance. | Introduction to Performance; Best practices
Ensure that you have appropriate permissions on the computer you want to monitor. | Setting up a monitoring configuration
Install Network Monitor driver to monitor network performance counters. | To enable Network Segment counters
Set up a monitoring configuration. | Setting up a monitoring configuration
Evaluate monitoring results and establish a baseline. | Analyzing performance
Investigate variations in performance data and tune or upgrade components as needed. | Solving performance problems
Archive monitoring data and use archives to monitor trends. | Evaluating trends and planning for additional resources


New ways to do familiar tasks

The following table lists common tasks for System Monitor and Performance Logs and Alerts (hosted in the Performance console, named Perfmon.msc) and maps where you can perform the tasks in Windows 2000. For existing Performance Monitor (Perfmon.exe) users, the table also shows where these tasks are performed in Windows NT 4.0. Many of the toolbar buttons remain the same in the two versions and can be used instead of the steps listed in this table.

If you want to | In Windows NT 4.0 use | In Windows 2000 use
Create a chart of performance data. | Performance Monitor on the Administrative Tools menu. | System Monitor in the Performance console, started from Administrative Tools.
Create a report. | Performance Monitor on the Administrative Tools menu. | System Monitor in the Performance console, started from Administrative Tools.
Create a log. | Performance Monitor on the Administrative Tools menu. | Performance Logs and Alerts in the Performance console or under System Tools in Computer Management, started from Administrative Tools.
View log data. | Performance Monitor on the Administrative Tools menu. | System Monitor in the Performance console, started from Administrative Tools.
Create an alert. | Performance Monitor on the Administrative Tools menu. | Performance Logs and Alerts in the Performance console or under System Tools in Computer Management, started from Administrative Tools.
Create a workspace with multiple views. | Performance Monitor on the Administrative Tools menu. | Microsoft Management Console, Add/Remove Snap-in command on the Console menu.

To locate the Windows NT 4.0 version of Performance Monitor, see the Windows 2000 Resource Kit.

You can use Windows 2000 System Monitor to open settings files created with the Windows NT 4.0 version of Performance Monitor.

Related Topics


Best practices

  • Setting up a monitoring configuration. Configure Performance Logs and Alerts to report data for the recommended counters at regular intervals, such as every 10 to 15 minutes. Retain logs over extended periods of time, store data in a database, and query the data to report on and analyze the data as needed for overall performance assessment, trend analysis, and capacity planning.

    For best results, do the following before starting System Monitor or Performance Logs and Alerts on the computer you want to monitor for diagnostic purposes:

    • Stop screen-saver programs.
    • Turn off services that are not essential or relevant to monitoring.
    • Increase the paging file to physical memory size plus 100 MB.
    • Using Registry Editor, view the settings for the following and make note of all keys that have nonzero values:
      • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager\Memory Management
      • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters

      Caution

      • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.

      Some of these registry values can be adjusted for better performance. For information about modifying the registry, see Registry Editor Help.

    • If the server in question has halted or is not responding, run System Monitor from another computer.
  • Keeping monitoring overhead low. In general, the performance tools are designed for minimal overhead. However, you may find the overhead increases under each of the following conditions:
    • You are running System Monitor in graph view.
    • You have selected an option other than the default (current value) for a report view.
    • You are sampling at very frequent intervals (less than three seconds apart).
    • Many different objects and counters are selected.

    Other aspects of performance tool operation that affect performance include file size and disk space taken up by log files. To reduce file size and related disk space usage, extend the update interval. Also, log to a disk other than the one you are monitoring. Frequent logging also adds demand on disk input and output (I/O).

    If monitoring overhead is a concern, run only the Performance Logs and Alerts service and do not monitor using a System Monitor graph.

    During remote logging, frequent updating can slow performance due to network transport. In this case, it is recommended that you log continuously on remote computers but upload logs infrequently — for example, once a day.

  • Analyzing performance results and establishing a performance baseline. Review logged data by graphing it using the System Monitor display or exporting it for printing. Compare the values against the counter thresholds shown in Analyzing performance to verify that resource usage or other activity is within acceptable limits. Set your baseline according to the level of performance that you consider satisfactory for your typical workload.
  • Setting alerts. Set alerts according to the counter values you consider to be unacceptable, as defined by baseline evaluation.
  • Performance tuning. Tune system settings and workload to improve performance and repeat monitoring to examine tuning results. See Solving performance problems for instructions covering how to change configurations or other steps to improve performance.
  • Planning. Monitor trends for capacity planning and add or upgrade components as needed. Maintain logged data in a database and observe changes to identify changes in resource requirements. After you observe changes in activity or resource demand, you can identify where you may require additional resources.


How to...

  • Work with counters
  • Work with monitoring views
  • Work with data
  • Work with settings
  • Create and configure counter logs
  • Create and configure trace logs
  • Create and configure alerts
  • Work with logs and alerts


Work with counters

  • Add counters
  • Delete counters
  • Get details about counters
  • Enable Network Segment counters


Add counters to System Monitor

To add counters to System Monitor

  1. Open Performance.
  2. Right-click the System Monitor details pane and click Add Counters.
  3. To monitor any computer on which the monitoring console is run, click Use local computer counters.

    Or, to monitor a specific computer, regardless of where the monitoring console is run, click Select counters from computer and specify a computer name (the name of the local computer is selected by default).

  4. In Performance object, click an object to monitor. The Processor object is selected by default.
  5. To monitor all counters, click All counters.

    Or, to monitor only selected counters, click Select counters from list and select the counters you want to monitor. The % Processor Time counter is selected by default.

  6. To monitor all instances of the selected counters, click All instances.

    Or, to monitor only selected instances, click Select instances from list and select the instances you want to monitor. The _Total instance is selected by default.

  7. Click Add.

Notes

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.
  • If you select an object on a remote computer, you may notice a short delay as System Monitor refreshes the list to reflect objects present on that computer.
  • When creating a monitoring console for export, make sure to select Use local computer counters. Otherwise, System Monitor will obtain data from the computer named in the text box, regardless of where the console file is installed.
  • For a description of a particular counter, click the name of the counter in Performance counters and then click Explain.
  • To monitor the sum of the values all of a particular counter's instances, select the _Total instance.
  • Unless you are configuring data from a log, you can select only active instances in the list box.
  • By default, counters are shown with both the instance name and an instance index. To turn off this feature, right-click the details pane, click Properties, and clear the Allow duplicate counter instances check box.
  • Some object types have several instances. For example, if a system has multiple processors, the Processor object type will have multiple instances. The Physical Disk object type has two instances if a system has two disks. Some object types such as Memory and Server have only a single instance. If an object type has multiple instances, you can add counters to track statistics for each instance, or in many cases, for all instances at once.
  • When you select two instances of the same counter, for example, if you are monitoring multiple threads of a process, note that the instance index number assigned to that instance may change over time as the instance, such as a thread, starts and stops. You cannot assume that the index number corresponds to the same thread over the life of the process.
  • You can change the default display characteristics assigned to a counter such as the color, line style and width, and graph scale by using the Data tab in the System Monitor Properties dialog box. To access the Data tab, right-click the details pane, and click Properties.
Related Topics


Delete counters from System Monitor

To delete counters from System Monitor

  1. Open Performance.
  2. In the System Monitor details pane, click the name of the counter in the legend.
  3. Press DELETE.

Notes

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.
  • You can also delete counters by using the Data tab in the System Monitor Properties dialog box.
  • To delete all counters, click the New Counter Set button in the toolbar.
  • To clear all data samples from the display, click the Clear Display button. (This button is available only when working with current data, not with log data.)

Related Topics


Get details about counters

To get details about counters

  1. Open Performance.
  2. Right click the System Monitor details pane and click Add Counters.
  3. In Performance object, click an object.
  4. In Performance counters, click the counter for which you want information.
  5. Click Explain.

Notes

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.
  • When working with System Monitor, you can match a line in a graph with the counter for which it is charting values. To do so, double-click a position in the line. The counter will be selected in the legend. If chart lines are close together, try to find a point in the graph where they diverge. Otherwise, System Monitor may have difficulty pinpointing the value you are interested in.
  • For more complete information about performance counters, see the Windows 2000 Performance Counter Reference (Counters.chm) on the Windows 2000 Resource Kit companion disc.


Enabling Network Segment counters

You must install the Network Monitor Driver in order to collect performance data using the Network Segment object counters. See To install the Network Monitor Driver for more information.


Working with monitoring views

Work with monitoring views

  • Use logged data
  • Change counters and counter properties
  • Change sampling options
  • Monitor a different computer
  • Highlight counter data
  • Change from graph view
  • Add titles, grids, and other attributes
  • Change background, chart, text, and other colors
  • Change font properties


Use logged data

To use logged data

  1. Open Performance.
  2. Right-click the System Monitor details pane and click Properties.
  3. Click the Source tab.
  4. Under Data Source, click Log File, and type the path to the file or click Browse to browse for the log file you want.
  5. Click Time Range. To specify the time range in the log file that you want to view, drag the bar or its handles for the appropriate starting and ending times.
  6. Click the Data tab and click Add to open the Add Counters dialog box. The counters you selected during log configuration are shown. You can include all or some of these in your graph.

Notes

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.
  • Unless you specifically want to monitor start-up events, you should exclude times that include such events from your time window because these temporary high values tend to skew overall performance results.
  • The Clear Display button on the toolbar is disabled when you are viewing log data.
  • You can also view counter-log data by opening files that have been saved in comma-separated or tab-separated format using Microsoft Excel.


Change counters and counter properties

To change counters and counter properties

  1. Open Performance.
  2. Right-click the System Monitor details pane and click Properties.
  3. On the Data tab, specify the options you want to use:
    • Add. Opens the Add Counters dialog box, where you can select other counters to add.
    • Remove. Removes the counter selected in the counter list.
    • Color. Changes the color of the selected counter.
    • Scale. Changes the displayed scale of a selected counter in the graph or histogram view. Counter values can be scaled exponentially from .0000001 to 1000000.0. You may want to adjust the counter scale settings to enhance the visibility of counter data in the graph. Changing the scale does not affect the statistics displayed in the value bar.
    • Width. Changes the line width of a selected counter. Note that defining a line width can determine the line styles that are available.
    • Style. Changes the line style for a selected counter. Styles can be selected only when you are using the default line width.

Note

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.

Related Topics


Change sampling options

To change sampling options

  1. Open Performance.
  2. Right-click the System Monitor details pane and click Properties.
  3. On the General tab, specify the sampling option you want:
    • To sample automatically at regular intervals, select the Update automatically every check box and in seconds type the length of the interval in seconds. The default interval is one second.
    • To sample manually, clear the Update automatically every check box. You can also use the Freeze Display button on the toolbar to sample data manually.

      When manual sampling is selected, use the Update Data button to collect a sample.

Notes

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.
  • To clear all data samples from the display, click the Clear Display button on the toolbar. (This button is available only when working with current data, not with log data.)

Related Topics


Monitor a different computer

To monitor a different computer

  1. Open Performance.
  2. Right-click the System Monitor details pane and click Add Counters.
  3. Click Select counters from computer, and type the computer name in the text box.

    System Monitor will obtain counters from the computer you specify, regardless of where System Monitor is running.

  4. In Performance object, click an object to monitor.
  5. In Performance counters, click one or more counters.
  6. To use all counter instances available when System Monitor is in use, click All instances.

    Or, to use only selected counter instances, click Select instances from list and select the instances you want to use.

Notes

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.
  • If you don't have appropriate permissions to monitor the computer, an error message will be displayed but the counter will still appear in the histogram or graph legend without any data or any graph line.
  • If you select an object on a remote computer, you may notice a short delay as System Monitor refreshes the list to reflect objects present on that computer.
  • If you don't see a counter that you want to monitor, it could be because the service or feature that provides the counter object is not installed or enabled on that computer and you may need to add it before you can monitor related data.


Highlight counter data

To highlight counter data

  1. Open Performance.
  2. In the counter list, click the counter you want to highlight.
  3. Click the Highlight button or press CTRL+H.

    For the counter selected, a thick line replaces the colored chart line. For white or light-colored backgrounds (defined by the BackColor property), this line is black; for other backgrounds, this line is white.

Notes

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.
  • When working with the System Monitor control in Microsoft Word, note that default key settings in Microsoft Word may conflict with the CTRL+H combination used for System Monitor highlighting. You may need to change these to support highlighting when the System Monitor control (Sysmon.ocx in the systemroot\System32 folder) is used in Microsoft Word.


Change from graph view

To change from graph view

  1. Open Performance.
  2. Click the View Histogram button or the View Report button on the toolbar.

Notes

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.
  • You can also change display type by changing the Type setting on the General tab of the System Monitor Properties dialog box.
  • The counter data and path properties are displayed differently in a System Monitor report than they are in a graph. In report view, information is displayed in columns, with counter names and data values grouped by their associated performance objects, and separate columns for each instance and its data.

    The values found on the value bar in a graph are not included. Using the General tab of the System Monitor Properties dialog box, you can choose a single value to be displayed in the report: last (default), current, average, minimum, or maximum. The default value for reports based on current activity is current and for logged activity is average.

  • If you choose average, minimum, or maximum statistics in the Report view, the statistic is calculated at each sample interval. This incurs some additional performance overhead.
  • In histogram view, the chart lines are replaced by bars. The remainder of the display is identical to the graph view.
  • If selected, the toolbar remains displayed for all views.

Related Topics


Add titles, grids, and other attributes

To add titles, grids, and other attributes

  1. Open Performance.
  2. Right-click the System Monitor details pane and click Properties.
  3. On the Graph tab, specify the graph options you want to use.

Notes

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.
  • The default minimum and maximum scale values are 0 and 100, respectively.
  • To change the grid color, use the Colors tab.
  • To add or remove the legend, statistics, or the toolbar, use the General tab.
  • To change border style or appearance, use the General tab.

Related Topics


Change background, chart, and text colors

To change background, chart, text, and other colors

  1. Open Performance.
  2. Right-click the System Monitor details pane and click Properties.
  3. On the Colors tab, in Property Name, specify the display attribute for which you want to change the color. The available attributes are:
    • BackColorCtl. The background color that surrounds the window area where data is charted.
    • BackColor. The background color of the window area where counter data is charted.
    • ForeColor. The text color.
    • GridColor. The color used for vertical and horizontal grid lines.
    • TimerBarColor. The color used for the timer bar.
  4. Associate the attribute with a color in one of the following ways:
    • Click the colored button for the color you want to associate with the attribute.
    • In System Color, select a screen element. Selecting a screen element makes the selected attribute the same color as the screen element. You can define screen-element colors in the dialog box that appears when you double-click the Display icon in Control Panel.

Note

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.

Related Topics


Change font properties

To change font properties

  1. Open Performance.
  2. Right-click the System Monitor details pane and click Properties.
  3. On the Fonts tab, set any font options you want. The options include Font, Style, Size, and Effects.

Note

  • To open Performance, click Start, point to programs, point to Administrative Tools, and then click Performance.

Related Topics


Work with data

  • Copy data between windows
  • Print performance data
  • Save data to an HTML file
  • Collect data in a Word document
  • Collect performance data using WMI


Copy counter data between instances of System Monitor

To copy counter data between instances of System Monitor

  1. Open Performance.
  2. In the System Monitor details pane, click the Copy Properties button on the toolbar.

    This copies all current properties in HTML format to the Windows Clipboard.

  3. Open another instance of System Monitor and click the Paste Counter List button on the toolbar to load the counter path data from the Clipboard into the current window.

Note

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.


Print performance data

To print performance data

  1. Open Performance.
  2. Press ALT+PRINT SCREEN to copy a view of the active window.
  3. Click Start, point to Programs, point to Accessories, and click Paint.
  4. On the Edit menu, click Paste.

    If prompted with the alert message The image in the Clipboard is larger than the bitmap. Would you like the bitmap enlarged?, click Yes.

  5. On the File menu, click Print.

Notes

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.
  • You can also print performance data if you:
    • Add the System Monitor control to a Microsoft Office application such as Microsoft Word or Microsoft Excel and print from that program.
    • Save the performance data as an HTML file and print it from Internet Explorer or another program.
    • Import a log file in comma-separated (.csv) or tab-separated (.tsv) format into a Microsoft Excel spreadsheet and print from that application.

Related Topics


Save graph data as an HTML page

To save graph data as an HTML page

  1. Open Performance.
  2. Add counters to a graph.
  3. Right-click the displayed graph and click Save As.
  4. In the Save As dialog box, select a path and type the name of the new HTML file. By default, this is stored on the root volume under My Documents.

Note

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.
  • You can also import counter data from an HTML file to System Monitor or export all properties from System Monitor to an HTML file by means of the Windows Clipboard. Use the Copy Properties button on the toolbar to transfer to the Windows Clipboard the counter properties currently displayed in System Monitor. Use the Paste Counter List button in the toolbar to transfer properties from the Clipboard to the current window.

Related Topics


Insert the System Monitor control in a Microsoft Word document

To insert the System Monitor control in a Microsoft Word document

  1. Open a Word document and place the insertion point where you want to insert the control.
  2. On the View menu, point to Toolbars and click Control Toolbox.
  3. Click the More Controls icon, and click System Monitor Control.

Notes

  • The System Monitor control is inserted in the document at the location you selected. The control is currently in design mode, meaning that you can work with it using the Visual Basic editor. Notice that the control assumes the ambient properties of the application. That is, the control defaults to the BackColor, ForeColor, and Font settings for the Word document. To change these settings, or to add counters, click the Exit Design Mode icon to exit design mode.
  • After adding counters and configuring the graph according to your preferences, you can print the performance data or save the document using the appropriate commands provided by Microsoft Word.
  • Use Microsoft Word 97 or later.

Related Topics


Collect performance data using Windows Management Instrumentation (WMI)

To collect performance data using Windows Management Instrumentation (WMI)

  • At a command prompt, type

    mmc.exe perfmon.msc /s /sysmon_wmi

Notes

  • This procedure obtains performance data by means of WMI instead of the registry.
  • You can also perform this procedure by typing

    perfmon.exe /wmi


Work with settings

  • Save a monitoring console
  • Save log or alert settings to an HTML page
  • Create a custom console
  • Use Windows NT 4.0 Performance Monitor settings files


Saving a monitoring console

To save a monitoring console

  1. Open Performance.
  2. Using System Monitor or a tool under Performance Logs and Alerts, configure the tool with the settings you want.
  3. On the Console menu, click Save As, and then type the name you want for this console. The default directory for storing this file is System32 on the root volume.
  4. Click Save.

Note

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.

Related Topics


Save log or alert settings as an HTML page

To save log or alert settings as an HTML page

  1. Open Performance.
  2. Create a log or an alert.
  3. In the details pane, right-click the name of the log or the alert and click Save Settings As. By default, the settings are saved in the user's personal default directory; this is typically My Documents.

Note

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.

Related Topics


Create a custom monitoring console

To create a custom monitoring console

  1. Open Microsoft Management Console (MMC).
  2. On the Console menu, click Add/Remove Snap-in.
  3. On the Standalone tab, click Add.
  4. In the snap-in list, click ActiveX Control, and then click Add.
  5. In the Insert ActiveX Control wizard, click Next.

    There is a short delay before the next dialog box appears; this is normal.

  6. In Control category, click All Categories.
  7. In Control Type, click System Monitor Control.
  8. Click Next.

    The System Monitor control provides the functionality of System Monitor.

  9. In Select a name for the ActiveX control, type a name for the control, and then click Finish.

Note

  • To open MMC, click Start, click Run, and then type mmc.
  • Creating a custom console is useful if you want to have System Monitor hosted in the same console with Event Viewer or another tool.


Use Windows NT 4.0 Performance Monitor settings files

To use Windows NT 4.0 Performance Monitor settings files

  • At a command prompt, type

    perfmon.exe file_name

    where file_name is the name of the settings file you want to use.

Notes

  • This procedure will open a Windows 2000 Performance console configured with the settings from the Windows NT 4.0 Performance Monitor settings file.
  • This procedure works for the following types of Windows NT 4.0 Performance Monitor settings files: chart (.pmc), report (.pmr), alert (.pma), and log (.pml).
  • To display the Windows NT 4.0 settings file in System Monitor, the system temporarily converts the file for use with System Monitor but discards the converted version after the console starts. If you want to save the settings file for permanent use with System Monitor, type the following command:

    perfmon.exe /HTMLFILE:converted_file settings_file

    where converted_file is the name you are giving to the converted file and settings_file is the name of the original Windows NT 4.0 settings file.


Create and configure counter logs

  • Create a counter log
  • Add counters to a log
  • Get details about counters
  • Set file parameters for a log
  • Enable Network Segment counters


Create a counter log

To create a counter log

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Counter Logs.

    3. Any existing logs will be listed in the details pane. A green icon indicates that a log is running; a red icon indicates that a log has been stopped.

  3. Right-click a blank area of the details pane, and click New Log Settings.
  4. In Name, type the name of the log, and then click OK.
  5. On the General tab, click Add. Select the counters you want to log.
  6. If you want to change the default file and schedule information, make the changes on the Log Files tab and the Schedule tab.

Notes

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.
  • To save the counter settings for a log file or alert file, right-click the file in the details pane and click Save Settings As. You can then specify an .htm file in which to save the settings. To reuse the saved settings for a new log or alert, right-click the details pane, and then click New Log Settings From or New Alert Settings From. This is an easy way to generate log settings from an alert configuration.
  • To create or modify a log, you must have Full Control permission for the following registry key, which controls the Performance Logs and Alerts service:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysmonLog\Log Queries

    Administrators usually have this permission by default. Administrators can grant permission to users by using the Security menu in Regedt32.exe.

    To run the service (which runs in the background when you configure a log), you must have permission to start or otherwise configure services on the system. Administrators have this right by default and can grant it to users by using Group Policy.

    To log data on a remote computer, the Performance Logs and Alerts service must run under an account that has access to the remote system.

    Caution

    • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer. For more information, see Registry Editor Help.

Related Topics


Add counters to a log

To add counters to a log

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Counter Logs.
  3. In the details pane, double-click the log you want to modify.
  4. On the General tab, click Add. For each counter or group of counters that you want to add to the log, perform the following steps:
    1. To log counters from the computer on which the Performance Logs and Alerts service will run, click Use local computer counters.

      Or, to log counters from a specific computer regardless of where the service is run, click Select counters from computer and specify the name of the computer you want to monitor.

    2. In Performance object, click an object to monitor.
    3. In Performance counters, click one or more counters to monitor.
    4. To monitor all instances of the selected counters, click All Instances. (Binary logs can include instances that are not available at log startup but subsequently become available.)

      Or, to monitor particular instances of the selected counters, click Select Instances From List, and then click an instance or instances to monitor.

    5. Click Add.

Notes

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.
  • When creating a monitoring console for export, make sure to select Use local computer counters. Otherwise, counter logs will obtain data from the computer named in the text box, regardless of where the console file is installed.
  • For a description of a counter, click the counter in Performance counters and then click Explain.
  • To start network monitoring counters, see Enabling Network Segment counters.
  • Some object types have several instances. For example, if a system has multiple processors, the Processor object type will have multiple instances. The PhysicalDisk object type has two instances if a system has two disks. Some object types, such as Memory and Server, have only a single instance. If an object type has multiple instances, you can add counters to track statistics for each instance, or in many cases, for all instances at once. By default, counters are shown with both the instance name and an instance index. To turn off this feature, right-click the System Monitor graph, click Properties, and clear the Allow duplicate counter instances check box.

Related Topics


Set file parameters for a log

To set file parameters for a log

  1. Open Performance.
  2. Double-click Performance Logs and Alerts.
  3. To set file properties for a counter log, click Counter Logs.

    Or, to set file properties for a trace log, click Trace Logs.

  4. In the details pane, double-click the log.
  5. On the Log Files tab, complete the following options:
    • Log File Name. Select file-naming parameters using the following options.
      Option | Description
      Location | Type the name of the folder where you want the log file created, or click Browse to search for the folder.
      File name | Type a partial or base name for the log file. You can use File name in conjunction with End file names with if appropriate.
      End file names with | Select this and choose the suffix style you want from the list. Use End file names with to distinguish between individual log files with the same log file name that are in a group of logs that have been automatically generated.
      Start numbering at | Set this to the start number for automatic file numbering, when you select nnnnnn as the End file names with.
    • Log file type. In the list, select the format you want for this log file.
      Log file format | Description | Applies to
      Text File—CSV | This option defines a comma-delimited log file (with a .csv extension). Use this format to export the log data to a spreadsheet program. | Counter logs
      Text File—TSV | This option defines a tab-delimited log file (with a .tsv extension). Use this format to export the log data to a spreadsheet program. | Counter logs
      Binary File | This option defines a sequential, binary-format log file (with a .blg extension). Use this file format if you want to be able to record data instances that are intermittent—that is, stopping and resuming after the log has begun running. Nonbinary file formats cannot accommodate instances that are not persistent throughout the duration of the log. | Counter logs
      Binary Circular File | This option defines a circular, binary-format log file (with a .blg extension). Use this file format to record data continuously to the same log file, overwriting previous records with new data. | Counter logs
      Circular Trace File | This option defines a circular trace log file (with an .etl extension). Use this file format to record data continuously to the same log file, overwriting previous records with new data. | Trace logs
      Sequential Trace File | This option defines a sequential trace log file (with an .etl extension) that collects data until it reaches a user-defined limit and then closes and starts a new file. | Trace logs
    • Comment. If appropriate, type a comment or description for the log file.
    • Log file size. Decide, using the following options, whether or not you want to limit the size of the log file:
      • Maximum limit. When you select this option, data is continuously collected in a log file until it reaches limits set by disk quotas or the operating system.
      • Limit of. To define a size limit for the log file, specify the maximum size. (For counter logs, specify the maximum size in kilobytes, up to two gigabytes. For trace logs, specify the maximum size in megabytes.) Select this option if you want to do circular logging. There is a

Notes

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.
  • Windows generates an error message if available disk space falls below a specified minimum. If you choose to allow the file to grow to its maximum size, consider the available space on your disk and any quotas that may be in effect. An error might occur if you run out of disk space due to logging. The Log file size option works in conjunction with the When the log file is full option on the Schedule tab.
  • When you select a log file–size limit, the stop option When the log file is full reflects the size limit typed here.
  • The File name can identify a group of log files with similar parameters.
  • The End file names with suffix can be a numeric sequence or a character string indicating the date and time the log was started. For example, you might define the File name "DailyLog" and the Performance Logs and Alerts service would append the date as a suffix for each file so that you might have a series of files named as follows: DailyLog_010198, DailyLog_010298, for each day the log is run.
  • The comment text and the file name appear in the details pane in the Performance Logs and Alerts console window.

Related Topics


Create and configure trace logs

  • Create a trace log
  • Define trace providers and events
  • Define trace buffers


Create a trace log

To create a trace log

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Trace Logs.

    Any existing logs will be listed in the details pane. A green icon indicates that the logs are running; a red icon indicates logs have been stopped.

  3. Right-click a blank area of the details pane, and click New Log Settings.
  4. In Name, type the name of the trace log you want to create, and then click OK.

    By default, the log file is created in the PerfLogs folder in your root directory, a sequence number is appended to the file name you entered, and the sequential trace file type with the .etl extension. Use the Log Files and Advanced tabs to modify these parameters or define other parameters for your log. To define providers and events to log, use the General tab. To specify when you want logging to occur, use the Schedule tab.

Notes

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.
  • To save the settings for a log file, right-click the file in the details pane, and click Save Settings As. You can then specify an .htm file in which to save the settings. To reuse the saved settings for a new log, right-click the details pane, and click New Log Settings From.
  • In order to create or modify a log configuration, you must have Full Control access to the following subkey in the registry:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSetServices\SysmonLog\Log Queries

    In general, administrators have this access by default. Administrators can grant access to users using the Security menu in Regedt32.exe. In addition, to run the Performance Logs and Alerts service (which is installed by Setup and runs in the background when you configure a log to run), you must have the right to start or otherwise configure services on the system. Administrators have this right by default and can grant it to users by using Group Policy.

    Caution

    • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer. For more information, see Registry Editor Help.

Related Topics


Define trace log providers and events

To define trace log providers and events

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Trace Logs.
  3. In the details pane, double-click the log.
  4. For a list of the installed providers and their status (enabled or not), click Provider Status. By default, the Nonsystem providers option is selected to keep trace-logging overhead to a minimum.
  5. If you click Events logged by system provider, a default provider (the Windows kernel trace provider) is used to monitor processes, threads, and other activity. To define events for logging, click the check boxes as appropriate.
  6. If you click Nonsystem providers, you can select the data providers you want —for example, if you have written your own providers. Use the Add or Remove buttons as needed.

Notes

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.
  • Trace logging of file details and page faults can generate an extremely large amount of data. It is recommended that you limit trace logging using the file details and page fault options to a maximum of two hours.
  • Only one instance of each trace provider can be enabled at any given time.


Define trace log buffers

To define trace log buffers

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and click Trace Logs.
  3. In the details pane, double-click the log.
  4. Click the Advanced tab.
  5. In Buffer size, specify the size of the buffer you want to be used for trace data in kilobytes.
  6. In Minimum, specify the smallest number of buffers you want used for trace data.
  7. In Maximum, specify the largest number of buffers you want used for trace data.
  8. To have the trace provider periodically flush the buffers, select the Transfer data from buffers to log file every check box and specify the transfer interval in seconds.

Note

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.

Related Topics


Create and configure alerts

  • Create an alert
  • Define counters and thresholds for an alert
  • Define actions for an alert


Create an alert

To create an alert

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Alerts.

    Any existing alerts will be listed in the details pane. A green icon indicates that the alerts are running; a red icon indicates alerts have been stopped.

  3. Right-click a blank area of the details pane and click New Alert Settings.
  4. In Name, type the name of the alert, and then click OK.
  5. To define a comment for your alert, along with counters, alert thresholds, and the sample interval, use the General tab. To define actions that should occur when counter data triggers an alert, use the Action tab, and to define when the service should begin scanning for alerts, use the Schedule tab.

Notes

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.
  • To save the counter settings for a log file or alert file, right-click the file in the details pane, and click Save Settings As. You can then specify an .htm file in which to save the settings. To reuse the saved settings for a new log or alert, right-click the details pane, and click New Log Settings From or New Alert Settings From. This is an easy way to generate log settings from an alert configuration.
  • You must have Full Control access to a subkey in the registry in order to create or modify a log configuration. The subkey is:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysmonLog\Log Queries

    In general, administrators have this access by default. Administrators can grant access to users using the Security menu in Regedt32.exe. In addition, to run the Performance Logs and Alerts service (which is installed by Setup and runs in the background when you configure a log to run), you must have the right to start or otherwise configure services on the system. Administrators have this right by default and can grant it to users by using Group Policy.

    Caution

    • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer. For more information, see Registry Editor Help.

Related Topics


Define counters and thresholds for an alert

To define counters and thresholds for an alert

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Alerts.
  3. In the details pane, double-click the alert.
  4. In Comment, type a comment to describe the alert as needed.
  5. Click Add.
  6. For each counter or group of counters that you want to add to the log, perform the following steps:
    1. To monitor counters from the computer on which the Performance Logs and Alerts service will run, click Use local computer counters.

      Or, to monitor counters from a specific computer regardless of where the service is run, click Select counters from computer and specify the name of the computer you want to monitor.

    2. In Performance object, click an object to monitor.
    3. In Performance counters, click one or more counters to monitor.
    4. To monitor all instances of the selected counters, click All Instances. (Binary logs can include instances that are not available at log startup but subsequently become available.)

      Or, to monitor particular instances of the selected counters, click Select Instances From List, and then click an instance or instances to monitor.

    5. Click Add.
  7. In Alert when the value is, specify Under or Over, and in Limit, specify the value that triggers the alert.
  8. In Sample data every, specify the amount and the unit of measure for the update interval.
  9. Complete the alert configuration using the Action and Schedule tabs.

Notes

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.
  • When creating a monitoring console for export, be sure to select Use local computer counters. Otherwise, counter logs will obtain data from the computer named in the text box, regardless of where the console file is installed.
  • To start network monitoring counters, see Enabling Network Segment counters.
  • Some object types have several instances. For example, if a system has multiple processors, the Processor object type will have multiple instances. The PhysicalDisk object type has two instances if a system has two disks. Some object types, such as Memory and Server, have only a single instance. If an object type has multiple instances, you can add counters to track statistics for each instance, or in many cases, for all instances at once.


Define actions for an alert

To define actions for an alert

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Alerts.
  3. In the details pane, double-click the alert.
  4. Click the Action tab.
  5. To have the Performance Logs and Alerts service create an entry visible in Event Viewer, select Log an entry in the application event log.
  6. To have the service trigger the messenger service to send a message, select Send a network message to and type the name of the computer on which the alert message should be displayed.
  7. To run a counter log when an alert occurs, select Start performance data log and specify the counter log you want to run.
  8. To have a program run when an alert occurs, select Run this program and type the file path and name or click Browse to locate the file. When an alert occurs, the service creates a process and runs the specified command file. The service also copies any command-line arguments you define to the command line that is used to run the file. Click Command Line Arguments and select the appropriate check boxes for arguments to include when the program is run.

Note

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.

Related Topics


Work with logs and alerts

  • Start or stop a counter log, trace log, or alert
  • Remove counters from a log or alert
  • View or change properties of a log or alert
  • Define start or stop parameters for a log or alert
  • Delete a log or alert


Start or stop a counter log, trace log, or alert manually

To start or stop a counter log, trace log, or alert manually

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and click Counter Logs, Trace Logs, or Alerts.
  3. In the details pane, right-click the name of the log or alert you want to start or stop, and click Start to begin the logging or alert activity you defined, or click Stop to terminate the activity.

Notes

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.
  • There may be a slight delay before the log or alert starts or stops, indicated when the icon changes color (from green for started to red for stopped, and vice versa).


Remove counters from a log or alert

To remove counters from a log or alert

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Counter Logs or Alerts.
  3. In the details pane, double-click the name of the log or alert.
  4. Under Counters, click the counter you want to remove, and then click Remove.

Note

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.

Related Topics


View or change properties of a log or alert

To view or change properties of a log or alert

  1. Open Performance.
  2. Double-click Performance Logs and Alerts.
  3. Click Counter Logs, Trace Logs, or Alerts.
  4. In the details pane, double-click the name of the log or alert.
  5. View or change the log properties as needed.
    6. Tool to modify | Properties to define | Tab to use
Alerts | Comment, counters, alert thresholds, and update interval | General
Alerts | Actions to take when an event occurs: run a program, send a message, start a counter log, update the event log | Action
Counter logs | Counter log counters and update interval | General
Counter logs | Counter log file comment, file type, file size limits, path and name, automatic naming parameters | Log Files
Counter logs | Manual or automated start and stop methods and schedule | Schedule
Trace logs | Trace log providers and events to log | General
Trace logs | Trace log comment, file size limits, path and name, automatic naming parameters | Log Files
Trace logs | Trace log buffer size, limits, and transfer interval | Advanced

Notes

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.
  • To start or stop a log or alert, right-click its name in the details pane, and click Start or Stop as appropriate.

Related Topics


Define start or stop parameters for a log or alert

To define start or stop parameters for a log or alert

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Counter Logs, Trace Logs, or Alerts.
  3. In the details pane, double-click the name of the log or alert.
  4. Click the Schedule tab.
  5. Under Start log, click one of the following options:
    • To start the log or alert manually, click Manually. When this option is selected, to start the log or alert, right-click the log name in the details pane, and click Start.
    • To start the log or alert at a specific time and date, click At, and then specify the time and date.
  6. Under Stop log, select one of the following options:
    • To stop the log or alert manually, click Manually. When this option is selected, to stop the log or alert, right-click the log or alert name in the details pane, and click Stop.
    • To stop the log or alert after a specified duration, click After, and then specify the number of intervals and the type of interval (days, hours, and so on).
    • To stop the log or alert at a specific time and date, click At, and then specify the time and date. (The year box accepts four characters; the others accept two characters.)
    • To stop a log when the log file becomes full, select options as follows:
      • For counter logs, click When the log file is full. The file will continue to accumulate data according to the file-size limit you set on the Log Files tab (in kilobytes up to two gigabytes).
      • For trace logs, click When the n-MB log file is full. The file will continue to accumulate data according to the file-size limit you set on the Log Files tab (in megabytes).

      When setting this option, take into consideration your available disk space and any disk quotas that are in place. An error might occur if your disk runs out of disk space due to logging.

  7. Complete the properties as appropriate for logs or alerts:
    • For logs, under When a log file closes, select the appropriate option:
      • If you want to configure a circular (continuous, automated) counter or trace logging, select Start a new log file.
      • If you want to run a program after the log file stops (for example, a copy command for transferring completed logs to an archive site), select Run this command. Also type the path and file name of the program to run, or click Browse to locate the program.
    • For alerts, under When an alert scan finishes, select Start a new alert scan if you want to configure continuous alert scanning.

Notes

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.
  • When you schedule a log to close at a specific time and date or close the log manually, the Start a new log file option is unavailable.

Related Topics


Delete a log or alert

To delete a log or alert

  1. Open Performance.
  2. Double-click Performance Logs and Alerts.
  3. Click Counter Logs, Trace Logs, or Alerts.
  4. In the details pane, right-click the name of the log or alert, and click Delete.

Note

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.


Concepts

This section provides general background information about Windows 2000 performance monitoring tools:

  • Introduction to Performance
  • Understanding Performance
  • Using Performance
  • Resources


Introduction to Performance

Windows 2000 provides the following tools for monitoring resource usage on your computer:

  • System Monitor
  • Performance Logs and Alerts

Monitoring system performance is an important part of maintaining and administering your Windows 2000 installation. You use performance data to:

  • Understand your workload and the corresponding effect on your system's resources.
  • Observe changes and trends in workloads and resource usage so you can plan for future upgrades.
  • Test configuration changes or other tuning efforts by monitoring the results.
  • Diagnose problems and target components or processes for optimization.

System Monitor and Performance Logs and Alerts provide detailed data about the resources used by specific components of the operating system and by server programs that have been designed to collect performance data. The graphs provide a display for performance-monitoring data; logs provide recording capabilities for the data. Alerts send notification to users by means of the Messenger service when a counter value reaches, rises above, or falls below a defined threshold.

Microsoft technical support often uses the results of performance monitoring in problem diagnosis. Therefore, Microsoft recommends that you monitor system performance as part of your administrative routine.

Note

  • Task Manager is another tool that provides performance information about systems running Windows 2000. Task Manager presents a snapshot of programs and processes that are running on your computer, plus a summary of its processor and memory usage. For information about Task Manager, see Task Manager Help.

For overviews of the performance monitoring tools, see:

  • System Monitor overview
  • Performance Logs and Alerts overview


System Monitor overview

With System Monitor, you can measure the performance of your own computer or other computers on a network:

  • Collect and view real-time performance data on a local computer or from several remote computers.
  • View data collected either currently or previously in a counter log.
  • Present data in a printable graph, histogram, or report view.
  • Incorporate System Monitor functionality into Microsoft Word or other applications in the Microsoft Office suite by means of Automation.
  • Create HTML pages from performance views.
  • Create reusable monitoring configurations that can be installed on other computers using Microsoft Management Console.

With System Monitor, you can collect and view extensive data about the usage of hardware resources and the activity of system services on computers you administer. You can define the data you want the graph to collect in the following ways:

  • Type of data. To select the data to be collected, you specify
    • performance objects, performance counters, and object instances.

    Some objects provide data on system resources (such as memory); others provide data on the operation of applications (for example, system services or Microsoft BackOffice applications running on your computer).

  • Source of data. System Monitor can collect data from your local computer or from other computers on the network where you have permission. (By default, administrative permission is required.) In addition, you can include real-time data or data collected previously using counter logs.
  • Sampling parameters. System Monitor supports manual, on-demand sampling or automatic sampling based on a time interval you specify. When viewing logged data, you can also choose starting and stopping times so that you can view data spanning a specific time range.

In addition to options for defining data content, you have considerable flexibility in designing the appearance of your System Monitor views:

  • Type of display. System Monitor supports graph, histogram, and report views. The graph view is the default view; it offers the widest variety of optional settings.
  • Display characteristics. For any of the three views, you can define the colors and fonts for the display. In graph and histogram views, you can select from many different options when you view performance data:
    • Provide a title for your graph or histogram and label the vertical axis.
    • Set the range of values depicted in your graph or histogram.
    • Adjust the characteristics of lines or bars plotted to indicate counter values, including color, width, style, and so on.
    You can further extend use of System Monitor by incorporating its functionality into Microsoft Word or other Microsoft applications by means of Automation.

For more information about the performance monitoring process, see Introduction to Performance.

For more information about the System Monitor user interface, see System Monitor interface.


Performance Logs and Alerts overview

With Performance Logs and Alerts you can collect performance data automatically from local or remote computers. You can view logged counter data using System Monitor or export the data to spreadsheet programs or databases for analysis and report generation. Performance Logs and Alerts offers the following capabilities:

  • Performance Logs and Alerts collects data in a comma-separated or tab-separated format for easy import to spreadsheet programs. A binary log-file format is also provided for circular logging or for logging instances such as threads or processes that may begin after the log starts collecting data. (Circular logging is the process of continuously logging data to a single file, overwriting previous data with new data.)
  • Counter data collected by Performance Logs and Alerts can be viewed during collection as well as after collection has stopped.
  • Because logging runs as a service, data collection occurs regardless of whether any user is logged on to the computer being monitored.
  • You can define start and stop times, file names, file sizes, and other parameters for automatic log generation.
  • You can manage multiple logging sessions from a single console window.
  • You can set an alert on a counter, thereby defining that a message be sent, a program be run, or a log be started when the selected counter's value exceeds or falls below a specified setting.

Similar to System Monitor, Performance Logs and Alerts supports defining performance objects, performance counters, and object instances, and setting sampling intervals for monitoring data about hardware resources and system services. Performance Logs and Alerts also offers other options related to recording performance data:

  • Start and stop logging either manually on demand, or automatically based on a user-defined schedule.
  • Configure additional settings for automatic logging, such as automatic file renaming, and set parameters for stopping and starting a log based on the elapsed time or the file size.
  • Create trace logs. Using the default system data provider or another provider, trace logs record data when certain activities such as a disk I/O operation or a page fault occur. When the event occurs, the provider sends the data to the Performance Logs and Alerts service. This differs from the operation of counter logs; when counter logs are in use, the service obtains data from the system when the update interval has elapsed, rather than waiting for a specific event. A parsing tool is required to interpret the trace log output. Developers can create such a tool using application programming interfaces (APIs) provided on the Microsoft Web site (http://msdn.microsoft.com/).
  • Define a program that runs when a log is stopped.

Notes

  • If you want to export log data to Microsoft Excel, the Performance Logs and Alerts service must be stopped because Microsoft Excel requires exclusive access to the log file. Other programs are not known to require this exclusive access; therefore, in general you can work with data from a log file while the service is collecting data to that file.
  • For more information about the Performance Logs and Alerts user interface, see Performance Logs and Alerts interface.


Understanding Performance

This section describes the design and operation of System Monitor and Performance Logs and Alerts:

  • Performance objects and counters
  • Performance tool architecture
  • Performance monitoring in Windows NT 4.0 and Windows 2000


Performance objects and counters

Windows 2000 obtains performance data from components in your computer. As a system component performs work on your system, it generates performance data. That data is described as a performance object and is typically named for the component generating the data. For example, the Processor object is a collection of performance data about processors on your system.

A range of performance objects are built into the operating system, typically corresponding to the major hardware components such as memory, processors, and so on; other programs may install their own performance objects. For example, services such as WINS or server programs such as Microsoft Exchange provide performance objects, and performance graphs and logs can monitor these objects.

Each performance object provides counters that represent data on specific aspects of a system or service. For example, the Pages/sec counter provided by the Memory object tracks the rate of memory paging.

Although your system may typically make available many more objects, the default objects you'll use most frequently to monitor system components are:

  • Cache
  • Memory
  • Objects
  • Paging File
  • PhysicalDisk
  • Process
  • Processor
  • Server
  • System
  • Thread

The following services or features of Windows 2000 that you may be using in your configuration provide performance objects.

Feature or service to monitor | Performance object available
TCP/IP | ICMP, IP, NBT, TCP, and UDP objects
NetBEUI | NetBEUI and NetBEUI resource objects
Browser, Workstation, and Server services | Browser, Redirector, and Server objects
QoS Admission Control | ACS/RSVP Service and Interface objects
Windows Internet Name Service (WINS) | WINS object
Connection Point Services | PBServer Monitor object
Indexing Service | Indexing Service, Indexing Service Filter, and Http Indexing Service objects
Directory service | NTDS object
Print server activity | Print queue object

For a description of the data provided by a particular counter associated with a performance object, click Explain in the Add Counters dialog box. For information about adding counters, see To add counters to System Monitor.

Although some objects (such as Memory and Server) have only a single instance, some performance objects can have multiple instances. If an object has multiple instances, you can add counters to track statistics for each instance, or for all instances at once.

Depending on how the counter was defined, its value may be:

  • The most recent measurement of an aspect of resource utilization. These are also called instantaneous counters.

    An example is Process\ Thread Count, which shows the number of threads for a particular process as of the last time this was measured.

  • The average of the last two measurements over the period between samples. (Because counters are never cleared, this is actually an average of the difference between the measurements.)

    An example is Memory\ Pages/sec, a rate per second based on the average number of memory pages during the last two samples.

    • Other counter types can be defined as described in the Platform Software Development Kit.

The combination of computer name, object, counter, instance, and instance index is known as the counter path. Counter path is typically shown in the tools as follows:

Computer_name\Object_name(Instance_name#Index_Number)\Counter_name


Performance tool architecture

Various levels of the Windows architecture support operation of System Monitor and Performance Logs and Alerts. For example, the performance tools obtain data by default by means of the registry. You may optionally collect data by means of the Windows Management Instrumentation (WMI) interface for hardware resources or applications installed on the system. The Performance Data Helper dynamic-link library (DLL) acts as an intermediary between the WMI and the performance tools to format the data and make calculations, where necessary, to convert raw data for display or reporting. For information about configuring performance tools to collect data using WMI, see To collect performance data using WMI.

DLLs supplied by the operating system provide counters for monitoring the behavior of resources such as memory, processors, disks, and network adapters and protocols. In addition, many Windows services and BackOffice applications provide their own DLLs that install counters that you can use to monitor their operation.

System Monitor and Performance Logs and Alerts use the Remote Registry service process that manages user logon and logoff operations for remote monitoring connections. In addition, they use the Messenger service in Windows for sending users alert notification. (This service must be running for alert notifications to be received.)


Performance monitoring in Windows NT 4.0 and Windows 2000

The enhanced features of System Monitor and Performance Logs and Alerts replace the functionality of the Windows NT 4.0 Performance Monitor. You can use these tools to open settings files created in Windows NT 4.0 Performance Monitor.

The Windows 2000 Resource Kit provides the Windows NT 4.0 version of Performance Monitor (perfmon4.exe).


Using the performance tools

This section covers:

  • Setting up a monitoring configuration
  • Quick reference to System Monitor settings
  • System Monitor toolbar reference
  • System Monitor interface
  • Performance Logs and Alerts interface
  • Analyzing performance data
  • Solving performance problems
  • Evaluating trends and planning for additional resources


Setting up a monitoring configuration

Setting up a monitoring configuration is the first step in evaluating your system's performance. To monitor your Windows 2000 installation, you can choose to view data in a graph or collect the data in log files for use in other applications.

Note

  • For best results, read the following sections for setting up your monitoring configuration. However, to get started quickly, you can use the predefined log settings under Counter Logs. These settings, named System Overview, are configured to create a binary log that, after manual start-up, updates every 15 seconds and logs continuously until it achieves a maximum size. If you start logging with these settings, data is saved to the Perflogs folder on the root directory and includes the counters: Memory\ Pages/sec, PhysicalDisk(_Total)\Avg. Disk Queue Length, and Processor(_Total)\ % Processor Time.

Choosing the monitoring method

Graphs are useful for short-term, real-time monitoring of a local or remote computer — for example, when you want to observe a system event while it's happening. Choose the update interval so as to capture the type of activity you are interested in. Logs are useful for record keeping and for extended monitoring, especially of a remote computer; logged data can be exported for report generation and presented as graphs or histograms using System Monitor. Logging is the most practical way to monitor multiple computers.

Choosing how often to monitor

For routine monitoring, start by logging activity over 15-minute intervals. If you are monitoring for a specific problem, you might want to vary the interval. If you are monitoring activity of a specific process at a specific time, set a frequent update interval; however, if you are monitoring a problem that manifests itself slowly, such as a memory leak, use a longer interval.

Also consider the overall length of time you want to monitor when choosing this interval. Updating every 15 seconds is reasonable if you'll be monitoring for no more than four hours. If you'll be monitoring a system for eight hours or more, don't set an interval shorter than 300 seconds (five minutes). Setting the update interval to a frequent rate (low value) can cause the system to generate a large amount of data, which can be difficult to work with and can increase the overhead of running Performance Logs and Alerts.

Monitoring a large number of objects and counters can also generate large amounts of data and consume disk space. Try to strike a balance between the number of objects you monitor and the sampling frequency to keep log file size within manageable limits.

If you prefer to maintain a long update interval when logging, you can still view data fluctuations that occur between those intervals. To do so, see To use logged data for information about manipulating time ranges within logs.

Choosing what data to monitor

Start by monitoring the activity of the following components in order:

  • Memory
  • Processors
  • Disks
  • Network

The following table shows the minimum counters recommended for server monitoring. When examining specific resources, you should include other counters for the associated performance object.

Component | Performance aspect being monitored | Counters to monitor
Disk | Usage | Physical Disk\ Disk Reads/sec Physical Disk\ Disk Writes/sec LogicalDisk\ % Free Space Interpret the % Disk Time counter carefully. Because the _Total instance of this counter may not accurately reflect utilization on multiple-disk systems, it is important to use the % Idle Time counter as well. Note that these counters cannot display a value exceeding 100%.
Disk | Bottlenecks | Physical Disk\ Avg. Disk Queue Length (all instances)
Memory | Usage | Memory\ Available Bytes Memory\ Cache Bytes
Memory | Bottlenecks or leaks | Memory\ Pages/sec Memory\ Page Reads/sec Memory\ Transition Faults/sec Memory\ Pool Paged Bytes Memory\ Pool Nonpaged Bytes Although not specifically Memory object counters, the following are also useful for memory analysis: Paging File\ % Usage object (all instances) Cache\ Data Map Hits % Server\ Pool Paged Bytes and Server\Pool Nonpaged Bytes
Network | Usage | Network Segment\ % Net Utilization Note that you must install the Network Monitor driver for Network Monitor in order to use this counter.
Network | Throughput | Protocol transmission counters (varies with networking protocol); for TCP/IP: Network Interface\ Bytes total/sec Network Interface\ Packets/sec Server\ Bytes Total/sec or Server\ Bytes Transmitted/sec and Server\ Bytes Received/sec You may want to monitor other objects for network and server throughput as described in Monitoring network activity.
Processor | Usage | Processor\ % Processor Time (all instances)
Processor | Bottlenecks | System\ Processor Queue Length (all instances) Processor\ Interrupts/sec System\Context switches/sec

If some of the counters listed in the preceding table are not available on your computer, verify that you have installed the necessary services or activated the counters. See To enable Network Segment counters for instructions for activating the Network Segment object counters provided by Network Monitor.

Note

  • Unlike physical-disk counter data, logical-disk counter data is not collected by the operating system by default. To obtain performance counter data for logical drives or storage volumes, you must type diskperf -yv at the command prompt. This causes the disk performance statistics driver used for collecting disk performance data to report data for logical drives or storage volumes. By default, the operating system uses the diskperf -yd command to obtain physical drive data. For more information about using the diskperf command, type diskperf -? at the command prompt.

Choosing the computer to use for monitoring

When monitoring computers remotely, you have some options for how to collect data. For example, you could run performance logging on the administrator's computer, drawing data continuously from each remote computer. In another case, you could have each computer running the service to collect data and, at regular intervals, run a batch program to transfer the data to the administrator's computer for analysis and archiving.

Centralized data collection (that is, collection on a local computer from remote computers that you are monitoring) is simple to implement because only one logging service is running. You can collect data from multiple systems into a single log file. However, it causes additional network traffic and may be restricted by available memory on the administrator's computer. To do centralized data collection, use the Add Counters dialog box to select a remote computer while running System Monitor on your local computer.

Distributed data collection (that is, data collection that occurs on the remote computers you are monitoring) does not incur the memory and network traffic problems of centralized collection. However, it does result in delayed availability of the data, requiring that the collected data be transferred to the administrator's computer for review. To do distributed data collection, use Computer Management on a local computer to select a remote computer on which to collect data.

When monitoring remote computers, note that the remote computer will only allow access to user accounts that have permission to access it. In order to monitor remote systems from your computer, you must start the Performance Logs and Alerts service using an account that has permission to access the remote computers you want to monitor. By default, the service is started under the local computer's "system" account, which generally has permission only to access services and resources on the local computer. To start this under a different account, use Services under Computer Management and update the properties of the Performance Logs and Alerts service.

Keeping records of performance data

When you retain your logged data in a database, you can query the information and include it in reports. Using database analysis tools, you can query results and examine the results in detail using a variety of parameters. You can also use logs for trend analysis and capacity planning.

Exporting your monitoring configuration

After configuring the performance tools with the counters, update intervals, and other settings you want, you can save those settings on your local computer or for export to another computer. If you save the settings under the name Perfmon.msc, note that you are permanently changing the configuration of the tools on the computer. Therefore, it is recommended that you save the file under another name.

In addition to saving monitoring settings, you can add other tools or add multiple copies of System Monitor, for example, if you want to monitor graph and report views simultaneously. For information about adding tools to a console, see To create a custom monitoring console.


Quick Reference to System Monitor settings

For all of the following settings, start by right-clicking the System Monitor details pane and clicking Properties.

To add or change this | Use this tab
View type: graph, histogram, or report | General
Objects, counters, and instances (add or delete) | Data Note: You can also add counters by right-clicking the details pane and clicking Add Counters or by clicking the Add button on the toolbar. To delete counters, use the Remove button on the Data tab, the DELETE key on the keyboard, or the Delete button on the toolbar. To remove all counters and specify new ones, click the New Counter Set button on the toolbar.
Source of data displayed: current data input to the graph, current data input from a log, archived data input from a log | Source Note: You can also use the View Log File Data button on the toolbar to use a log file as the data source or View Current Activity to view real-time data.
Time range for a log and view time range | Source
Update frequency | General Note: You can also use the Freeze Display and Update Data buttons on the toolbar to take samples manually.
Report or histogram value type(minimum, maximum, average) | General
Display of counter legend | General
Display of last, minimum, and maximum values for a selected counter (the value bar); allow multiple counter instances | General
Color, width, style, or graph line | Data
Scale of counter data values | Data
Background color of results pane surrounding the graph area, color of graph data-display area | Colors
Title of graph | Graph
Label on value axis, vertical or horizontal grid lines, and upper and lower limits of graph axes | Graph
Font color in graph display or legend | Colors
Font type, size, and style | Fonts
Grid color, timer bar color | Colors
Border style, appearance of graph window | General
Toolbar | General

Note

  • Using report value types other than Current when monitoring real-time data incurs substantial overhead because of the need to make calculations across all samples for each value displayed.


System Monitor toolbar reference

The System Monitor toolbar contains buttons for easy access to commonly used functions. The following table associates buttons with their corresponding functions.

Button | Function
New Counter Set | New Counter Set
Clear Display | Clear Display
View Current Activity | View Current Data
View Log File Data | View Log File Data
View Graph | View Graph
View Histogram | View Histogram
View Report | View Report
Add | Add
Delete | Delete
Paste Counter List | Paste Counter List
Copy Properties | Copy Properties
Properties | Properties
Freeze Display | Freeze Display
Update Data | Update Data


System Monitor interface

When you open Performance, the graph view and a toolbar appear by default and the graph area is blank. When you have added counters to the graph, after a short delay (depending on the time you select for the update interval), System Monitor will begin charting counter values in this graph area. You can choose to have data updated automatically or on demand; for updating on-demand, use the Update Data button to start and stop the collection intervals. Click the Clear Display button to remove all data from the display.

The names and associated information for the counters you select are shown in the columns beneath the graph. This is called the legend. The legend shows the following information:

  • Computer on which System Monitor is running.
  • Performance object.
  • Performance counter.
  • Performance object instance. Note that by default counter instances are listed by name and numerical index. This index appears after the instance name, represented by a pound sign (#) and a number. This index makes it easier to monitor multiple instances, for example, when you are monitoring threads of a process. To turn off the index display, right-click the graph, click Properties, and clear the Allow duplicate counter instances check box.
  • Graphical properties of each counter.

Note

  • To match a line in a graph with the counter for which it is charting values, double-click a position in the line. The counter will be selected in the legend. If chart lines are close together, try to find a point in the graph where they diverge. Otherwise, System Monitor may not be able to pinpoint the value you are interested in.

Above the columns is the value bar, where you see the last, minimum, maximum, and average values for the counter that is currently selected. These values are calculated over the time period and number of samples displayed in the graph (reflected by the Duration value), not over the time that has elapsed since monitoring was started. The Duration value in the value bar indicates the total elapsed time displayed in the graph (based on the update interval). The movement of the timer bar across the graph indicates the passing of each update interval. Regardless of the update interval, the view will show up to 100 samples. System Monitor compresses log data as necessary to fit it in the display. To see the compressed data in a log, right-click the graph, click Properties, and select a shorter time range on the Source tab. Shorter time ranges contain less data, so it is less likely that data points will be eliminated.

You can define the attributes of the graph:

  • Type of display, with options for graph, histogram, or report
  • Background color of the detail pane and of the data-display area
  • Size, type, and style of font used to show text in the display
  • Color, width, and style of line used to chart data

To draw attention to a particular counter's data, use the highlighting feature. To do so, press CTRL+H or click the Highlight button on the toolbar. When highlighting is in effect, the bar or line representing data for the selected counter changes color to white for most background colors (including the default color) or black for white or light-colored backgrounds.

Note

  • Default key settings in Microsoft Word may conflict with the CTRL+H combination used for System Monitor highlighting. You may need to change these to support highlighting when the System Monitor control (Sysmon.ocx in the system_root\System32 folder) is used in Microsoft Word.

Clicking Object, Counter, Instance, or Computer in the counter legend sorts entries in ascending or descending order for that category. For example, to sort all counters by name, click Counter.

For more information, see Quick reference to System Monitor settings


Performance Logs and Alerts interface

In Performance Logs and Alerts you define settings for counter logs, trace logs, and alerts. The details pane of the console window shows logs and alerts that you have created. You can define multiple logs or alerts to run simultaneously. Each log or alert is a saved configuration that you define. If you have configured the log for automatic starting and stopping, a single log can generate many individual log data files. For example, if you were generating a log file for each day's activity, one file would close at 11:59 P.M. today, and a new file would open at 12:00 A.M. tomorrow. The following table explains the query summary information provided by the columns in the details pane.

Column | Description
Name This is the name of the log or alert. Think of this as a "friendly name," describing the type of data you are collecting or the condition you are monitoring. One log can generate multiple log files.

Note

  • Sample settings, named System Overview, have been predefined for counter logging. You can start logging using these settings or define your own settings, as appropriate.
Comment | This can be any descriptive information about the log or alert.
Log File Type | This is the log-file format you define. For alert, the type will always be alerts; for trace logs, it will always be sequential. For logs, this can be binary, binary circular, text-CSV (for comma-delimited text) or text-TSV (for tab-delimited text).
Log File Name | This is the path and base file name you defined for the files generated by this log. The base file name is used for automatically naming new files.

To see the parameters defined for each log, double-click the list entry for the log. In the dialog box that appears, you can choose how to name your log files, when logging is scheduled to occur, and what performance objects and counters you want to monitor in your log.

If a log is currently running and collecting data (based on the schedule you defined for the log or alert), a green data icon appears next to the log or alert. If a red icon appears, the log or alert has been defined but is not currently running.

Note

  • You can configure more than one type of log to run at a time. One log can generate multiple log files if the restart option is selected, or if the user starts and stops the log multiple times. However, you will not see these individual log files listed in the console window. Use Windows Explorer to view a listing of these files.


Analyzing performance data

Analyzing your monitoring data consists of examining counter values that are reported while your system is performing various operations. During this process you should determine which processes are most active and which programs or threads, if any, are monopolizing a resource. Using this type of performance-data analysis, you can understand how your system is responding to workload demands.

As a result of this analysis, you may find that your system performs satisfactorily at some times and unsatisfactorily at others. Depending on the causes of these variations and the degree of difference, you may choose to take corrective action or to accept these variations and delay tuning or upgrading resources to a later time.

The level of system performance that you consider acceptable when your system is handling a typical workload and running all required services is its baseline. The baseline performance is a subjective standard that the administrator determines based on the work environment. It may correspond to a range of counter values, including some that are temporarily unacceptable, but which generally indicate the best possible performance under the administrator's specific conditions. The baseline can be the measure used for setting performance expectations of your users and can be included in any service agreements you put in place.

Analyzing performance data includes:

  • Determining acceptable values for counters
  • Understanding variations in performance data


Determining acceptable values for counters

In general, deciding whether or not performance is acceptable is a subjective judgment that varies significantly with variations in user environments. The values you establish as the baselines for your organization are the best basis for comparison. Nevertheless, the following table containing threshold values for specific counters can help you determine whether values reported by your computer indicate a problem. If System Monitor consistently reports these values, it is likely that bottlenecks exist on your system and you should take action to tune or upgrade the affected resource.

Resource | Object\ Counter | Suggested threshold | Comments
Disk | PhysicalDisk\ % Disk Time | 90%
Disk | PhysicalDisk\ Disk Reads/sec, PhysicalDisk\ Disk Writes/sec | Depends on manufacturer's specifications | Check the specified transfer rate for your disks to verify that this rate doesn't exceed the specifications. In general, Ultra Wide SCSI disks can handle 50 I/O operations per second.
Disk | Physical Disk\ Current Disk Queue Length | Number of spindles plus 2 | This is an instantaneous counter; observe its value over several intervals. For an average over time, use Physical Disk\ Avg. Disk Queue Length.
Memory | Memory\ Available Bytes | Less than 4 MB | Research memory usage and add memory if needed.
Memory | Memory\ Pages/sec | 20 | Research paging activity.
Network | Network Segment\ % Net Utilization | Depends on type of network | You must determine the threshold based on the type of network you are running. For Ethernet networks, for example, 30% is the recommended threshold.
Paging File | Paging File\ % Usage | 99% | Review this value in conjunction with Available Bytes and Pages/sec to understand paging activity on your computer.
Processor | Processor\ % Processor Time | 85% | Find the process that is using a high percentage of processor time. Upgrade to a faster processor or install an additional processor.
Processor | Processor\ Interrupts/sec | Depends on processor. | A dramatic increase in this counter value without a corresponding increase in system activity indicates a hardware problem. Identify the network adapter causing the interrupts.
Server | Server\ Bytes Total/sec | If the sum of Bytes Total/sec for all servers is roughly equal to the maximum transfer rates of your network, you may need to segment the network.
Server Server\ Work Item Shortages 3 If the value reaches this threshold, consider tuning InitWorkItems or MaxWorkItems in the registry (under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer). For information about modifying the registry, see Registry Editor Help

Caution

  • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.
Server | Server\ Pool Paged Peak | Amount of physical RAM | This value is an indicator of the maximum paging file size and the amount of physical memory.
Server | Server Work Queues\ Queue Length | 4 | If the value reaches this threshold, there may be a processor bottleneck. This is an instantaneous counter; observe its value over several intervals.
Multiple Processors | System\ Processor Queue Length | 2 | This is an instantaneous counter; observe its value over several intervals.

For tuning and upgrade suggestions, see Solving performance problems.


Understanding variations in performance data

The following considerations may help you understand performance variations that you observe:

  • Resource usage can vary dramatically based on the work being done at various times of day.
  • Counters that show usage ratios over an interval are a more informative measurement than averages of instantaneous counter values because averages can include data for service startup or other events that can cause the numbers to go far out of range for a brief period, thereby skewing the results.


Solving performance problems

Analysis of your monitoring data may reveal problems such as excessive demand on certain resources resulting in bottlenecks. This section discusses common causes for bottlenecks and a recommended strategy for tuning and testing.

Causes of bottlenecks

Demand may become extreme enough to cause resource bottlenecks for the following reasons:

  • Resources are insufficient and additional or upgraded components are required.
  • Resources are not sharing workloads evenly and need to be balanced.
  • A resource is malfunctioning and needs to be replaced.
  • A program is monopolizing a particular resource; this may require substituting another program, having a developer rewrite the program, adding or upgrading resources, or running the program during periods of low demand.
  • A resource is incorrectly configured and configuration settings should be changed.

Strategy for tuning and testing

The table of threshold values that is presented in Determining acceptable values for counters helps to isolate the performance problem by resource. Find the tuning and upgrade discussion related to your specific problem in one of the following topics:

  • Monitoring and tuning memory usage
  • Monitoring processor activity
  • Monitoring disk activity
  • Monitoring network activity
  • Monitoring Windows 2000 services
  • Monitoring legacy programs

Lack of memory is by far the most common cause of serious performance problems in computer systems. If you suspect other problems, check memory counters to rule out a memory shortage. Poor response time on a workstation is most likely to result from memory and processor problems; servers are more susceptible to disk and network problems.

Before you start tuning, consider the following recommendations:

  • Make one change at a time. In some cases, a problem that appears to relate to a single component may be the result of bottlenecks involving multiple components. For this reason, it is important to address problems individually.

    Making multiple changes simultaneously may make it impossible to assess the impact of each individual change.

  • Repeat monitoring after every change. This is important for understanding the effect of the change and to determine whether additional changes are required. Proceed methodically, making one change to the identified resource at a time and then testing the effects of the changes on performance. Because tuning changes can affect other resources, it's important to keep records of the changes you make and to remonitor after you make a change.
  • In addition to monitoring, review event logs, because some performance problems generate output you can display in Event Viewer. For information about using Event Viewer, see Event Viewer Help.
  • To see whether network components are playing a part in performance problems, compare the performance of programs that run over the network with locally run programs.

Tuning and upgrade tips by component

This section lists tuning tips for resources you are monitoring:

  • Memory:
    • Increase physical memory above the minimum required.
    • Create multiple paging files.
    • Determine the correct size for the paging file.
    • Ensure that memory settings are properly configured as described in Making sure you have enough memory.
    • Run memory-intensive programs on your highest-performing computers or when system workload is light.
  • Disk:
    • Upgrade to a higher-speed disk, or add disks. When you do this, upgrade the disk controller and the bus.
    • On servers, use Disk Management to create striped volumes on multiple physical disks. This solution increases throughput because I/O commands can be issued concurrently.
    • Distribute programs among servers. Distributed File System (Dfs) can be used to balance workload.
    • Isolate tasks that heavily utilize disk I/O on separate physical disks or disk controllers.
    • Use Disk Defragmenter to optimize disk space.
    • If you want to improve the efficiency of disk access, consider installing the latest driver software for your host adapters. Contact your adapter manufacturer for information.
  • Processor:
    • Add a processor (especially for multithreaded programs), or upgrade to a faster processor.
    • On multiprocessor computers, manage the processor affinity with respect to process threads and interrupts.
  • Network:
    • Configure your network so that systems shared by the same group of people are on the same subnet.
    • Unbind infrequently used network adapters. See To modify the protocol bindings order for more information.
    • If you are using more than one protocol, you can set the order in which the workstation and NetBIOS software bind to each protocol. See Network and Dial-up Connections Help for more information. Some reasons for changing the list order are:
      • If the protocol you use most frequently is first in the binding list, average connection time decreases.
      • Some protocols are faster than others for certain network topologies. If you are optimizing a client computer, putting the faster protocol first in the bindings list improves performance. Because the server accepts incoming connections using the protocol chosen by the client computer, there is no reason to reorder server computer bindings.
    • Install a high-performance network adapter in the server. If your server uses a 16-bit adapter, you can significantly increase performance by replacing it with a high-performance 32-bit adapter.
    • Use multiple network adapters. Windows 2000 supports multiple adapters for a given protocol and multiple protocols for a given adapter. Although this configuration can create distinct networks that cannot communicate with one another, it is a way to increase file-sharing throughput.

Solving performance problems includes:

  • Monitoring and tuning memory usage
  • Monitoring processor activity
  • Monitoring disk activity
  • Monitoring network activity
  • Monitoring Windows 2000 services
  • Monitoring legacy programs


Monitoring and tuning memory usage

Monitoring and tuning memory usage includes:

  • Watching how programs use system resources
  • Making sure you have enough memory


Watching how programs use system resources

Because processor and memory resources have such a significant influence on the operation of your computer, it is important to understand how programs use these resources. This topic describes how observing certain counters in the System Monitor graph display can help you learn about processor and memory usage by programs. Start by working with the Process\ % Processor Time and Process\ Working Set counters:

  • % Processor Time. The percentage of elapsed time that a processor is busy executing all threads for a particular process. (Notice that % Processor Time is high for the Idle process when the system is not busy.)
  • Working Set. The current number of physical memory bytes used by or allocated to a process. This value can be larger than the minimum number of bytes actually needed by the process. It may reflect physical bytes that are shared by multiple processes.

Using these counters, you can graph some or all of the programs running on a computer, as shown in the following example, charting processor usage by System Monitor (shown as the MMC process).

Graph of processor usage by applications

Notice that, at program startup, the Process\ % Processor Time values climb sharply for each program, decrease, and then level off. It's important to be aware that processor usage spikes at program startup; you may want to omit temporarily high startup values from your monitoring data to obtain a more accurate picture of typical processor usage by your programs.

After startup, the graph should show increases in processor activity as the programs perform some activity — for example, as System Monitor reads a new set of counter values. You can observe this by changing the update interval for System Monitor. Notice that, if System Monitor is configured with a short update interval, it will read data more frequently and generate more processor activity by System Monitor. A longer update interval will generate less processor activity.

Monitoring memory-counter values for programs provides a similar illustration of how programs make demands on system resources and how those resources respond. For every program running on a computer, the operating system allocates a portion of physical memory. This is called the working set. Even if the program is not generating any activity, the operating system allocates memory for the program's working set.

The working-set value is of particular interest when the Memory\ Available Bytes counter falls below a certain threshold. Windows 2000 satisfies the memory requirements of programs by using free (available) bytes. As free bytes fall into short supply, the operating system begins to replenish the shortage by taking memory from the working sets of less active programs. As a result, you will see the values for one program's working set increase while the values for other programs decrease. If there isn't sufficient memory on the system to satisfy the requirements of all active programs, paging occurs and program performance suffers. For information about monitoring paging activity, see Checking for excessive paging.

Graph of memory usage by applications

You can expand sample reports and charts to include more programs and more counters. To understand system activity, watch these and other counter values as you change system activity levels.

For information about how you can monitor processor activity or memory usage, see the following topics:

  • Making sure you have enough memory
  • Monitoring processor activity


Making sure you have enough memory

Memory usage is perhaps the most important factor in system performance. One of the ways you may become aware of a memory shortage is if your system is paging frequently. Paging is the process of moving fixed size blocks of code and data from RAM to disk using units called pages in order to free memory for other uses. Although some paging is acceptable because it enables Windows 2000 to use more memory than actually exists, constant paging is a drain on system performance. Reducing paging will significantly improve system responsiveness.

This section describes how you can determine whether your system has an adequate amount of memory and an appropriate configuration for its role, plus how to begin to analyze its paging activity. (Further discussion of paging and related factors appears in Checking for excessive paging.)

Checking your configuration

Before beginning to monitor memory usage on your computer in detail, verify that your computer is properly equipped and configured:

  1. Make sure your system has the recommended amount of memory not only for running Windows 2000 but also for the programs or services you are running. Check the amount of memory on your system against requirements of the operating system and your programs. Consult product documentation for programs or services that you are running to verify that memory is adequate.

    To see the amount of system memory, see To determine the amount of RAM on your computer. To estimate your memory requirements, start with the memory required for the operating system and add the following factors:

    • Number of users multiplied by the average size of the open data files per user
    • Number of programs run on the server computer multiplied by the average size of programs run on the server

    If you are uncertain about the memory requirements of a process that you are running, you can note its working set in System Monitor, shut it down, and observe the corresponding effect on paging activity on your computer. The amount of memory freed by terminating programs is the amount of additional physical RAM needed on the system.

  2. Check that system settings are appropriate based on how you use your computer. When you install Windows 2000 Server, Windows 2000 Setup configures your computer with settings that optimize it for file sharing. However, in some cases, that configuration can cause excessive paging on your computer because it causes the system to maintain a large system-cache working set. If you are not using the server for file sharing or for other programs that specifically require this setting to be enabled, you can turn it off to reduce the amount of paging.

    To change these settings, see To configure memory-related settings on your computer.

Monitoring memory counters

To monitor for a low-memory condition, start with the following object counters:

  • Memory\ Available Bytes
  • Memory\ Pages/sec

Available Bytes indicates how many bytes of memory are currently available for use by processes. Pages/sec provides the number of pages that were either retrieved from disk due to hard page faults or written to disk to free space in the working set due to page faults.

Low values for Available Bytes (4 MB or less) may indicate there is an overall shortage of memory on your computer or that a program is not releasing memory. If the value of Pages/sec is 20 or more, you should research the paging activity further. A high rate for Pages/sec may not indicate a memory problem but may instead be the result of running a program that uses a memory-mapped file.

You must monitor Available Bytes along with Pages/sec and Paging File % Usage to determine whether this is the case. If you are reading a noncached memory-mapped file, you should also see normal or low cache activity. For more information, see Checking for excessive paging.

If you suspect a memory leak, monitor Memory\Available Bytes and Memory\ Committed Bytes to observe memory behavior and monitor Process\ Private Bytes, Process\ Working Set, and Process\ Handle Count for processes you think may be leaking memory. Also monitor Memory\ Pool Nonpaged Bytes, Memory\ Pool Nonpaged Allocs, and Process(process_name)\ Pool Nonpaged Bytes if you suspect that a kernel-mode process is causing the leak.

Checking for excessive paging

Because excessive paging can make substantial use of the hard disk, it is possible to confuse a memory shortage that causes paging with a disk bottleneck that results in paging. As a result, when you investigate the causes of paging, where a memory shortage is not apparent, make sure to track disk usage counters such as the following along with memory counters:

  • Physical Disk\ % Disk Time
  • Physical Disk\ Avg. Disk Queue Length

For example, include Page Reads/sec with % Disk Time and Avg. Disk Queue Length. If a low rate of page-read operations coincides with high values for % Disk Time and Avg. Disk Queue Length, there could be a disk bottleneck. However, if an increase in queue length is not accompanied by a decrease in the pages-read rate, then a memory shortage exists.

To determine the impact of excessive paging on disk activity, multiply the values of the Physical Disk\ Avg. Disk sec/Transfer and Memory\ Pages/sec counters. If the product of these counters exceeds 0.1, paging is taking more than 10 percent of disk access time. If this occurs over a long period, you probably need more memory.

Investigating program activity

Next, check for excessive paging due to programs that are running. If possible, stop the program with the highest working set value and see whether that dramatically changes the paging rate. If you suspect excessive paging, check the Memory\ Pages/sec counter. This counter shows the number of pages that needed to be read from disk because they were not in physical memory. (Notice the difference between this counter and Page Faults/sec, which indicates only that data was not immediately available in the specified working set in memory.)

Checking the paging file size

You have some options for how to manage your paging file for better performance:

  • You can place a paging file on other disk drives. If you have multiple hard disks, splitting up the paging file is a good idea because it will speed up the access time. If you have two hard disks and you split the paging file, both hard disks can be accessing information simultaneously, greatly increasing the throughput. However, if you have two hard disks and one hard disk is faster than the other, it may be more effective to store the paging file only on the faster hard disk. You may need to experiment to arrive at the best configuration for your system.
  • You can increase the size of the paging file. When you start Windows 2000, it automatically creates a paging file (Pagefile.sys) on the disk where you installed the operating system. Windows 2000 uses the paging file to provide virtual memory. The recommended size for the paging file is equivalent to 1.5 times the amount of RAM available on your system. However, the size of the file also depends on the amount of free space available on your hard disk when the file is created. You can find out how large your system's paging file is by looking at the file size shown for Pagefile.sys in Windows Explorer.

    Assuming you are not already short of disk space, you can increase the size of the paging file. If your users tend to run several programs simultaneously, they might find that increasing the size of the paging file will enable programs to start faster.

    Although you can reset both the initial and the maximum sizes for the paging file, it is more efficient to expand initial paging file size, rather than force the operating system to allocate more paging file space as programs start, which fragments the disk.

    If the paging file reaches its maximum size, a warning is displayed and the system may halt. To see whether your paging file is approaching its upper limit before it reaches the upper limit, check the actual file size and compare it to the maximum paging file size setting in the System utility in Control Panel. If these two numbers are close in value, consider increasing initial paging file size or running fewer programs.

    Paging file counters offer another way to see whether the size of the Pagefile.sys file is appropriate:

    • Paging File\ % Usage
    • Paging File\ % Usage Peak (bytes)

    If the % Usage Peak value approaches the maximum paging file setting, or if % Usage nears 100 percent, consider increasing the initial file size.

If multiple paging files are spread across multiple disk drives, the path name of each file appears as an instance of the Paging File object type. You can either add a counter for each paging file or select the _Total instance to look at combined usage data for all your paging files.


Monitoring processor activity

Monitoring the Processor and System object counters provides valuable information about the utilization of your processors and helps you determine whether or not a bottleneck exists. You will want to include the following:

  • Processor\ % Processor Time for processor usage.

    Optionally, you can also monitor Processor\ % User Time and % Privileged Time along with % Processor Time for more detail.

  • System\ Processor Queue Length for bottleneck detection.

Observing processor usage values

To gauge the activity of the processor, check the Processor\ % Processor Time counter. This counter shows the percentage of elapsed time that a processor is busy executing a nonidle thread.

When you examine processor usage, consider the role of the computer and the type of work being done. Depending on what the computer is doing, high processor values could mean either that the system is efficiently handling a heavy workload or that it is struggling to keep up. For example, if you are monitoring a user's computer, and that computer is used for computation, the computational program might easily use 100 percent of the processor's time. Even if this causes the performance of other applications on that computer to suffer, this can be addressed by changing workload.

On the other hand, values around 100 percent on a server computer that processes many client requests indicate that processes are queuing up, waiting for processor time, and causing a bottleneck. Such a sustained high level of processor usage is unacceptable for a server.

Investigating processor bottlenecks

A processor bottleneck develops when threads of a process require more processor cycles than are available. Long processor queues can build up and system response suffers. The two most common causes of processor bottlenecks are CPU-bound programs and drivers or subsystem components (typically disk or network components) that generate excessive interrupts.

To determine whether a processor bottleneck exists due to high levels of demand for processor time, check the value of the System\ Processor Queue Length counter. A queue of two or more items indicates a bottleneck. If more than a few program processes are contending for most of the processor's time, installing a faster processor will improve throughput. An additional processor can help if you are running multithreaded processes, but be aware that scaling to additional processors may have limited benefits. See Monitoring multiprocessor systems for more information.

In addition, the Server Work Queues\ Queue Length counter, which tracks the current length of the server work queue for the computer, can reveal processor bottlenecks. A sustained queue length greater than 4 indicates possible processor congestion. This counter is a value at a specific time, not an average over time.

To determine whether interrupt activity is causing a bottleneck, watch the values of the Processor\ Interrupts/sec counter, which measures the rate of service requests from input/output (I/O) devices. If this counter value increases dramatically without a corresponding increase in system activity, it can indicate a hardware problem.

You can also monitor Processor\ % Interrupt Time for an indirect indicator of the activity of disk drivers, network adapters, and other devices that generate interrupts.

Note

  • To detect hardware problems that may affect processor performance, such as IRQ conflicts, watch the values of System\ File Control Bytes/second.

Monitoring multiprocessor systems

To observe the efficiency of a multiprocessor computer, use the following additional counters.

Counter | Description
Process\ % Processor Time | The sum of processor time on each processor for all threads of the process.
Processor(_Total)\ % Processor Time | A measure of processor activity for all processors in the computer. This counter sums the average nonidle time of all processors during the sample interval and divides it by the number of processors. For example, if all processors are busy for half of the sample interval, on average, it displays 50%. It also displays 50% if half of the processors are busy for the entire interval, and the others are idle.
Thread\ % Processor Time | The amount of processor time for a thread.

Managing processor affinity on multiprocessor systems

If you want to assign a particular process or program to a single processor to improve its performance at the expense of other processes, in Task Manager, click Set Affinity. This option is available only on multiprocessor systems.

Controlling processor affinity can improve performance by reducing the number of processor cache flushes as threads move from one processor to another. This might be a good option for dedicated file servers. However, be aware that dedicating a program to a particular processor may not allow other program threads to migrate to the least-busy processor.

You may also want to control processor affinity for interrupts generated by disk or network adapters. A tool provided on the Windows 2000 Resource Kit companion disc enables you to manage interrupts in this way.


Monitoring disk activity

Disk-usage statistics help you balance the workload of network servers. System Monitor provides physical disk counters for troubleshooting, capacity planning, and for measuring activity on a physical volume.

At a minimum you should monitor the following counters:

  • Physical Disk\ Disk Reads/sec and Disk Writes/sec
  • Physical Disk\ Current Disk Queue Length
  • Physical Disk\ % Disk Time
  • LogicalDisk\ % Free Space

When testing disk performance, log performance data to another disk or computer so that it does not interfere with the disk you are testing.

Additional counters you may want to observe include Physical Disk\ Avg. Disk sec/Transfer, Avg. Disk Bytes/Transfer, and Disk Bytes/sec.

The Avg. Disk sec/Transfer counter reflects how much time a disk takes to fulfill requests. A high value might indicate that the disk controller is continually retrying the disk because of failures. These misses increase average disk transfer time. For most disks, high average disk transfer times correspond to values greater than 0.3 seconds.

You can also check the value of Avg. Disk Bytes/Transfer. A value greater than 20 KB indicates that the disk drive is generally performing well; low values result if an application is accessing a disk inefficiently. For example, applications that access a disk at random raise Avg. Disk sec/Transfer times because random transfers require increased seek time.

Disk Bytes/sec gives you the throughput rate of your disk system.

Because disk counters can cause a modest increase in disk access time, Windows 2000 does not automatically activate the counters at system startup.

Note

  • Unlike physical-disk counter data, logical-disk counter data is not collected by the operating system by default. To obtain performance counter data for logical drives or storage volumes, you must type diskperf -yv at the command prompt. This causes the disk performance statistics driver used for collecting disk performance data to report data for logical drives or storage volumes. By default, the operating system uses the diskperf -yd command to obtain physical drive data. For more information about using the diskperf command, type diskperf -? at the command prompt.

Determining workload balance

To balance loads on network servers, you need to know how busy the server disk drives are. Use the Physical Disk\ % Disk Time counter, which indicates the percentage of time a drive is active. If % Disk Time is high (over 90 percent), check the Physical Disk\ Current Disk Queue Length counter to see how many system requests are waiting for disk access. The number of waiting I/O requests should be sustained at no more than 1.5 to 2 times the number of spindles making up the physical disk.

Most disks have one spindle, although Redundant Array of Inexpensive Disks (RAID) devices usually have more. A hardware RAID device appears as one physical disk in System Monitor; RAID devices created through software appear as multiple drives (instances). You can either monitor the Physical Disk counters for each physical drive (other than RAID), or you can use the _Total instance to monitor data for all the computer's drives.

Use the values of the Current Disk Queue Length and % Disk Time counters to detect bottlenecks with the disk subsystem. If Current Disk Queue Length and % Disk Time values are consistently high, consider upgrading the disk drive or moving some files to an additional disk or server.

Notes

  • The LogicalDisk object counters have been removed. The system maps physical drives to logical drives using the same instance name. Therefore, if you have a dynamic volume that consists of multiple physical disks, instances might appear as "Disk 0 C:," "Disk 1 C:," and "Disk 2 D:," where C: is made up of physical drives 0 and 1. If you have two logical partitions on a disk, the instance appears as "0 C: D:."
  • For hardware-enabled stripe sets, per-disk statistics are not available. You can obtain this data only when monitoring stripe sets enabled in software.
  • If you are using a RAID device, the % Disk Time counter can indicate a value greater than 100 percent. If it does, use the Avg. Disk Queue Length counter to determine how many system requests on average are waiting for disk access.


Monitoring network activity

Network monitoring typically consists of observing server resource utilization and measuring overall network traffic. With System Monitor you can handle both of these activities, although for in-depth traffic analysis, you should use Network Monitor.

Start by tracking the counters that are described in the topic Setting up a monitoring configuration to observe resource usage on your server. To concentrate on network-related resource usage, add the counters that correspond to the various layers of your network configuration. Abnormal network counter values often indicate problems with a server's memory, processor, or disks. For that reason, the best approach to monitoring a server is to watch network counters in conjunction with Processor\ % Processor Time, PhysicalDisk\ % Disk Time, and Memory\ Pages/sec.

For example, if a dramatic increase in Pages/sec is accompanied by a decrease in Bytes Total/sec handled by a server, the computer is probably running short of physical memory for network operations. Most network resources, including network adapters and protocol software, use nonpaged memory. If a computer is paging excessively, it could be because most of its physical memory has been allocated to network activities, leaving a small amount of memory for processes that use paged memory. To verify this situation, check the computer's system event log for entries indicating that it has run out of paged or nonpaged memory.

Note

  • The operating system automatically sets a default limit for allocable nonpaged pool memory. This default value is approximately 80 percent of installed memory. If the system reaches this limit as a result of network activity, problems can result. To change this limit, modify the registry under:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\MaxNonpagedMemoryUsage

    For information about modifying the registry, see Registry Editor Help.

    Caution

    • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.

If you enable Network Monitor, you can use network-related objects with System Monitor to analyze overall network performance. For information on monitoring overall network traffic, see Monitoring overall network traffic.

Observing throughput across network layers

Investigating network performance includes monitoring activity at different network layers:

  • Data-link layer. This includes the network adapter. Use the Network Interface object counters:
    • Bytes total/sec
    • Bytes sent/sec
    • Bytes received/sec.
  • Network layer. Use the IP object counters:
    • Datagrams Forwarded/sec
    • Datagrams Received/sec
    • Datagrams/sec
    • Datagrams Sent/sec.
  • Transport layer. Varies with network protocol in use. For TCP/IP, use the TCP object counters:
    • Segments Received/sec
    • Segments Retransmitted/sec
    • Segments/sec
    • Segments Sent/sec.

    If the retransmission rate is high, there may be a hardware problem.

    The ICMP and UDP object counters are also provided and are useful for more extensive monitoring of TCP/IP network transmissions. The ICMP performance object consists of counters that measure the rates at which Internet Control Message Protocol (ICMP) messages are sent and received by using the ICMP protocol. It also includes counters that monitor ICMP protocol errors.The UDP performance object consists of counters that measure the rates at which User Data Protocol (UDP) datagrams are sent and received using the UDP. It includes counters that monitor UDP errors.

    If you are using the NetBEUI protocol, use the following counters:

    • NetBEUI\ Frame Bytes Received/sec
    • NetBEUI\ Frames Received/sec
    • NetBEUI\ Frames Rejected/sec
    • NetBEUI Resource\ Times Exhausted

    If you are using the NWLink protocol, three objects are available: NWLink IPX and NWLink NetBIOS for computers communicating over the IPX protocol; and NWLink SPX for computers connecting over the SPX protocol. Note that frame-related counters for these objects report only zeroes.

  • Presentation/program layer. Use the Server object counters if you are monitoring a server, or the Redirector object counters if you are monitoring a user's client computer. (Some program-layer processes, such as Web servers, may have their own object counters, which you would use for monitoring transmissions across this layer.)

    The Redirector object counters collect data about requests transmitted by the Workstation service; the Server object counters collect data about requests received and interpreted by the Server service.

    At a minimum, include the Bytes total/sec counter for both the Redirector object (for client computers that you monitor) and the Server object (for server computers).

    Each of these objects provides several other counters you may want to monitor if you suspect problems with either the Workstation or Server services:

    • Redirector\ Current Commands
    • Redirector\ Network Errors/sec
    • Redirector\ Reads Denied/sec
    • Redirector\ Writes Denied/sec
    • Redirector\ Server Sessions Hung
    • Server\ Sessions Errored Out
    • Server\ Work Item Shortages
    • Server\ Pool Paged Peak
    • Server\ Nonpaged Pool Failures

    If the Work Item Shortages counter value is increasing, consider changing the registry values InitWorkItems or MaxWorkItems under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer.

    The Sessions Errored Out counter reports automatic disconnections along with errored-out sessions. To get a more accurate value for errored-out sessions, obtain the value for Sessions Timed Out and reduce the Sessions Errored Out value by that amount. See Resources for more information.

Monitoring overall network traffic

If network traffic exceeds local area network (LAN) capacity, performance typically suffers across the network. To prevent this situation, it is important to monitor network-wide traffic levels, particularly on larger networks with bridges and routers, using the Network Segment object. When monitoring network traffic, three Network Segment object counters are of special interest.

Counter | Description
Network Segment\ Broadcast frames received/second | Can be used to establish a baseline if monitored over time. Large variations from the baseline can be investigated to determine the cause of the problem. Because each computer processes every broadcast, high broadcast levels mean lower performance.
Network Segment\ % Network utilization | Indicates how close the network is to full capacity. The threshold depends on your network infrastructure and topology. If the value of the counter is above 30 to 40 percent, collisions can cause problems.
Network Segment\ Total frames received/second | Indicates when bridges and routers might be flooded.

To analyze these statistics for your network segment, install Network Monitor. For information about Network Monitor, see Network Monitor Help.

For instructions on installing the Network Monitor driver that provides the counters for monitoring network utilization, see Enabling Network Segment counters.


Monitoring Windows 2000 services

Many services available under Windows 2000 Server provide their own performance objects and counters.

  • Monitoring the Browser service
  • Monitoring DHCP
  • Monitoring directory service activity
  • Monitoring Distributed Transaction Coordinator
  • Monitoring DNS
  • Monitoring Fax Service
  • Monitoring the File Replication service
  • Monitoring Indexing Service
  • Monitoring Internet Authentication Service
  • Monitoring Internet Information Services
  • Monitoring the Phone Book service
  • Monitoring QoS Admission Control
  • Monitoring SMTP
  • Monitoring telephony counters
  • Monitoring WINS


Monitoring the Browser service

If your organization is maintaining domains under Windows NT Server 4.0, use the following counters for monitoring the Browser service:

  • Browser\ Mailslot Allocations Failed
  • Browser\ Mailslot Opens Failed/sec
  • Browser\ Mailslot Receives Failed
  • Browser\ Mailslot Writes Failed
  • Browser\ Missed Mailslot Datagrams
  • Browser\ Missed Server Announcements
  • Browser\ Missed Server List Requests
  • Browser\ Server Announce Allocations Failed/Sec


Monitoring directory service activity

The NTDS object provides statistics about the activity of the directory service. Some important counters to monitor using this object include the following:

  • DRA Inbound Object Updates Remaining in Packet
  • DRA Pending Replication Synchronizations
  • LDAP Client Sessions
  • LDAP Bind Time


Monitoring DHCP

The DHCP Server performance object provides counters for monitoring activity of the DHCP Server service. For more information about using these counters, see DHCP Concepts.


Monitoring Distributed Transaction Coordinator

Tbe Distributed Transaction Coordinator performance object provides statistics about the activity of the Distributed Transaction Coordinator, a part of Component Services that coordinates external, or two-phase transactions. See Component Services for more information.


Monitoring QoS Admission Control

QoS Admission Control installs the ACS/RSVP performance object for monitoring purposes. Network administrators should monitor the counters provided by this object when QoS Admission Control is enabled.


Monitoring DNS

The DNS performance object provides statistics about the activity of the DNS service. For more information, see Using System Monitor.


Monitoring Fax Service

The Fax Service object tracks activity of Fax Service while the service is running. It is recommended that you use the counters in conjunction with event log data about fax events to assess service performance.

The following counters can indicate a system problem, such as installation of the wrong modem driver, which prevents the fax from being sent or received:

  • Inbound Failed Receptions. This counter indicates the number of faxes that were not received. This would be a call that was answered without a fax being received.
  • Outbound Failed Connections. This counter indicates the number of faxes that were not sent, for example, because there was no dial tone, no answer, a busy line, or another unknown error.
  • Outbound Failed Transmissions. This counter indicates the number of faxes that could not be sent.

If you see values for these counters, check the event log for details; no dial tone, no answer, or busy lines will be noted. An unknown error could indicate a system problem. In this case, check the phone line for line noise and check the sending and receiving fax devices for an incorrect modem driver.


Monitoring the File Replication service

The File Replication service provides the FileReplicaConn and FileReplicaSet objects to provide information about activity of the File Replication service.

The FileReplicaConn object displays performance statistics of the REPLICACONN object that defines replica connections to DFS roots.

The FileReplicaSet object displays performance statistics of the REPLICASET object that defines a replica set (one or more replicas, shared volumes, or directories that store duplicates of the contents of an original share). The object reports statistics for the computer that constitutes the original share. For example, in a bidirectional ring topology of three computers A, B, and C, where computer A and computer C both replicate from computer B, the FileReplicaSet counters would provide data for computer B.


Monitoring Indexing Service

Indexing Service provides three different performance objects. These are:

  • HTTP Indexing Service object. The counters for this object report statistics regarding queries run by Indexing Service.
  • Indexing Service object. The counters for this object report statistics pertaining to the creation of indexes and the merging of indexes by Indexing Service.
  • Indexing Service Filter object. The counters for this object report filtering activity of Indexing Service.

Use the HTTP Indexing Service\Total requests rejected counter to monitor Indexing Service for server bottlenecks.

For more information, see Indexing Service Concepts.


Monitoring Internet Authentication Service

The following objects report activity of Internet Authentication Service (IAS):

  • IAS Accounting Clients
  • IAS Accounting Server
  • IAS Authentication Clients
  • IAS Authentication Server


Monitoring Internet Information Services

Internet Information Services provides the following counters for monitoring service activity:

  • FTP Service object
  • Internet Information Services Global object
  • Web Service object
  • Active Server Pages object

FTP Service object counters

The FTP Service object counters show data about the anonymous and nonanonymous connections to the File Transfer Protocol (FTP) Server application. The counters can be reported on a per-site basis.

Internet Information Services Global object

The Internet Information Services Global object contains counters that report on bandwidth throttling and on usage of the Internet Information Services (IIS) Object Cache, a cache shared by the IIS services.

Bandwidth throttling is a feature of Internet Information Services that limits the bandwidth used by the IIS services to a value set by an administrator. If the bandwidth used by the IIS services approaches or exceeds this limit, bandwidth throttling delays or rejects IIS service requests until more bandwidth becomes available.

The IIS Object Cache stores frequently used objects and objects that would slow performance if they were retrieved repeatedly. The counters provided report on the size and content of the IIS Object Cache as well as its effectiveness, such as cache hits and misses.

Web Service object

The Web Service object provides counters that show data about the anonymous and nonanonymous connections to the Hypertext Transport Protocol (HTTP) service application and HTTP requests, listed by request method, that have been handled since the Web service was started.

Active Server Pages object

The Active Server Pages object is provided for monitoring applications running on your Web server that use Active Server Pages. To monitor requests processed by calls to Common Gateway Interface (CGI) applications or Internet Server Application Programming Interface (ISAPI) extensions, use counters on the Web Service object.


Monitoring the Phone Book service

The PBServer Monitor performance object monitors activity on the phone book server. The Total Hits/Sec counter is useful in determining the amount of traffic on the phone book server.


Monitoring SMTP

The SMTP Server performance object monitors message activity generated by the Simple Mail Transport Protocol (SMTP) service.


Monitoring telephony counters

If you are using a computer as a telephony server, such as a remote access server, or if you are using a non-Windows driver to enable Windows 2000 Server to emulate a small PBX or telephone switch, monitor the following counters and research server activity if these values are lower than expected:
  • Telephony\ Incoming calls/sec
  • Telephony\ Outgoing calls/sec
  • Telephony\ Total number of calls


Monitoring WINS

WINS installs the WINS Server performance object for monitoring service activity. The WINS Server performance counters are cleared each time you start and stop the service.

For more information about WINS performance counters, see WINS performance monitoring reference.


Monitoring legacy programs

This topic describes how to monitor a 16-bit Windows-based program or an MS-DOS-based program.

In Windows 2000, 16-bit Windows-based programs run as separate threads in a multithreaded process called Windows Virtual DOS Machine (NTVDM). The NTVDM process simulates a 16-bit Windows environment. An MS-DOS-based program runs in its own NTVDM process.

You can monitor a 16-bit program or an MS-DOS-based program running on your computer with System Monitor by monitoring the ntvdm instance of the Process performance object. Note that 16-bit programs running in an NTVDM appear only if they are started in a separate memory space.

If you find that your 16-bit programs are not performing well under Windows 2000, you can access some of the program's properties by right-clicking the name of the program in Windows Explorer and configuring the properties as follows:

  • If the program is in a window and the display performance is slow, on the Screen tab, click Full-Screen.
  • If the program is in a window and seems to pause periodically, click the Misc tab, and set the Idle Sensitivity slider to Low.

It is possible to turn off Compatible Timer Hardware Emulation for the program if performance does not improve by changing the previously described settings. To do so, right-click _Default.pif or the program name, point to Program, and click Windows NT. In the dialog box that appears, clear the Compatible Timer Hardware Emulation check box. This change typically causes a decrease in performance and should be made only if other efforts fail.


Evaluating trends and planning for additional resources

The data you accumulate through daily monitoring provides the information you need for trend analysis and capacity planning. Even if your computer is operating satisfactorily today, it is important to plan for changes in demand by users you may add or by technologies and programs you may deploy. Unanticipated network growth can result in overused resources and poor levels of network service. By characterizing system performance over time, you can justify the need for new resources before the need becomes critical.

Using the data collected from the counters described in Setting up a monitoring configuration, observe how the values for each component change over time. These changes may indicate a need to increase or upgrade components as described in Tuning and upgrade tips by component.


Resources

For a more detailed discussion of performance data and its analysis, see the Windows 2000 Resource Kit.

For information about optimizing programs or writing performance counters for programs, see the Microsoft Web site (http://msdn.microsoft.com/).

For more information about tuning network and service parameters in the registry to optimize performance, you can search for updated information at the Microsoft Web site. See Updated technical information.

Caution

  • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.

For information about including performance-monitoring functionality in Microsoft Office or Visual Basic applications, see Developing programs for performance monitoring.


Developing programs for performance monitoring

In addition to its wide variety of options that you can configure, System Monitor offers users the ability to extend monitoring capabilities programmatically. Because System Monitor is available as an ActiveX control (Sysmon.ocx in the systemroot\System32 folder) that supports Visual Basic Automation, developers can incorporate the System Monitor control's capabilities into their programs. The simplest way to take advantage of this extensibility is to embed the System Monitor control in a Microsoft Office application such as Microsoft Word. In this manner, you can include System Monitor graphs in reports and print them. For information about how to do this, see To insert the System Monitor control in a Microsoft Word document.

When you have placed the control in a program, you can access the properties, events, and methods by running the Visual Basic Editor from the container program or by running Visual Basic directly.

For information about programming the System Monitor control, see the Microsoft Web site (http://msdn.microsoft.com/).

In addition to programming the System Monitor control, developers can also write new performance counters for programs that do not include them. For information about building performance counters into programs, see the Windows 2000 Resource Kit.


Troubleshooting

What problem are you having?

Counter values consistently equal zero.

Cause: The process being monitored has stopped so there is no data for the process in the performance tools.

Solution: If you stopped the process manually, restart it to see the process in System Monitor. Otherwise, check Event Viewer for concurrent entries. You may find an error associated with this process.

Cause: The counter DLL was disabled after you selected the corresponding counters in a log or display. The performance tools will not detect that the counter was removed or disabled but will report the counter data as zeroes.

Solution: Enable the corresponding counter DLL.

Cause: You lack permissions on the computer being monitored. If you don't have appropriate permissions to monitor the computer, an error message will be displayed when you attempt to select the counter but the counter will still appear in the histogram or graph legend without any data or any graph line.

Solution: An administrator must ensure that your user account has permissions to use the performance tools.

System Monitor shows gaps in its line graphs.

Cause: This could be because data collection was subordinated to higher priority processing activity on a system with a heavy load. When the system has adequate resources to continue with data collection, the graphing will resume as usual. A message appears describing this.

Solution: Reduce the performance overhead of system monitoring.

See also: Best practices

Values recorded in a log don't appear in the graph view.

Cause: The graph is limited to 100 samples.

Solution: Reduce the selected time range.

See also: To use logged data

Objects, counters, or instances seem to be missing or invalid.

Cause: Test routines that run when you start Performance have detected a problem with installed counters and have disabled the counters automatically to prevent the counters from slowing the system. Disabled objects and counters do not appear in the Add Counters dialog box.

Solution: Using Registry Editor, change the value under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Service_name\Performance\Disable Performance Counters from 1 for disable to 0 for enable. Note that counters that have been disabled after initial testing are likely to contain errors and may cause system problems. For information about debugging problems with counter DLLs, see the Microsoft Web site (http://msdn.microsoft.com/).

Caution

  • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.

Cause: The process that starts the object counters is not started or installed.

Solution: Use Task Manager to verify that the process is running. If so, use Exctrlst.exe on the Windows 2000 Resource Kit companion CD to verify that the counter DLL is enabled.

Cause: The counters haven't been enabled (such as with the Network Segment object counters).

Solution: Make sure that the service or feature that provides the counter has been installed or configured.

Cause: The DLL that installs the counters is generating errors. An example is if the counter does not handle localization functions correctly.

Solution: Check Event Viewer to see whether the counter DLL or the Performance Data Helper reported any errors. If necessary, you can disable counter DLLs that are causing errors by using Exctrlst.exe on the Windows 2000 Resource Kit companion CD.

Cause: You are trying to monitor a 16-bit or MS-DOS application. Only 32-bit processes appear in the instances list. Active 16-bit processes appear as threads running in a Windows Virtual DOS Machine (NTVDM) process.

Solution: Monitor the application via the NTVDM process.

See also: Monitoring legacy programs

Cause: The instance you want to monitor is not currently active. If you are configuring System Monitor to collect real-time data, you can only select active instances for data collection. (If you are viewing logged data, you can select inactive instances for which the log contains data.) If you select the process and it stops after you've selected it, it will continue to appear in the list box but the reported data will be zeroes.

Solution: Make sure the instance is active.

You sometimes see an extremely high value for one instance and not the other when you are monitoring processes of the same name.

Cause: The performance tools sometimes misrepresent data for separate instances of processes with the same name by reporting the combined values of the instances as the value of a single instance.

Solution: Use the instance index and track the Process\ ID Process and Process\ Creating Process ID counters.

When monitoring several threads, if one thread stops its data appears to be reported for another.

Cause: This is because of the way threads are numbered. For example, assume you are monitoring three threads, numbered 0, 1, and 2. If thread 0 stops, the remaining threads get renumbered. The original thread 0 is now gone and the original thread 1 is renamed to 0. As a result data for the stopped thread 0 could be reported along with data for the running thread 1 because old thread 1 is now old thread 0.

Solution: Use the instance index with Thread ID to track these threads.

An error message is displayed if you try to export log data to Microsoft Excel while the Performance Logs and Alerts service is actively collecting data to that log.

Cause: Microsoft Excel requires exclusive access to the log file. Other programs are not known to require this exclusive access; therefore, in general, you can work with data from a log file while the service is collecting data to that file.

Solution: Stop the Performance Logs and Alerts service before trying to use it with Microsoft Excel.

I lost my connection to a remote computer from which I was logging data and I cannot resume logging.

Cause: Logging data from a remote computer requires the use of Remote Registry Service. If the service stops due to failure, by default the system restarts it automatically only once.

Solution: If Remote Registry Service stops more than once, you must restart the service manually on the second and any subsequent failures. To change this default behavior, use Computer Management or Services (on the Administrative Tools menu) to modify the properties for Remote Registry Service.

Help for System Monitor does not appear in MMC Help; only Performance Logs and Alerts is displayed.

Cause: Because System Monitor is designed as an ActiveX control, its behavior differs from other MMC snap-ins. For example, System Monitor Help is not available when you right-click System Monitor and then click Help on the shortcut menu, or when you click Help Topics on the Help menu.

Solution: Click the Help button on the System Monitor toolbar.


Get details about counters

To get details about counters

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Counter Logs.
  3. In the details pane, double-click the counter log.
  4. Click Add.
  5. In Performance object, click an object, and in Performance counters, click a counter.
  6. Click Explain.

Note

  • To open Performance, click Start, point to Programs, point to Administrative Tools, and then click Performance.
  • Clicking Explain opens a pop-up window that contains information about the selected counter, including a detailed description of how the counter is calculated and why it is useful in diagnosing performance problems. For information about all counters in Windows 2000, see the Windows 2000 Performance Counter Help Reference (Counters.chm) on the Windows 2000 Professional Resource Kit compact disc.

Related Topics


Work with data

  • Print performance data
  • Save data to an HTML file
  • Collect performance data using WMI


Choosing which counters to use

See the following topics for help in determining which counters to select to monitor usage of a specific resource or activity of a particular service and to investigate related bottlenecks:

  • Finding memory bottlenecks
  • Finding disk bottlenecks
  • Finding processor bottlenecks
  • Finding network bottlenecks
  • Finding printer bottlenecks


Work with settings

  • Save a monitoring console
  • Create a custom console
  • Use Windows NT 4.0 Performance Monitor settings files


Finding memory bottlenecks

Use the following counters to identify bottlenecked memory resources:
  • Memory\ Available Bytes
  • Memory\ Pages/sec

See Analyzing performance for counter threshold values that should not be exceeded and see Solving performance problems for tuning techniques that may alleviate performance problems.


Finding processor bottlenecks

Use the following counters to identify bottlenecked processor resources:

  • Processor\ Interrupts/sec
  • Processor\ % Processor Time
  • Process(process)\ % Processor Time
  • System\ Processor Queue Length

See Analyzing performance for counter threshold values that should not be exceeded and see Solving performance problems for tuning techniques that may alleviate performance problems.


Finding disk bottlenecks

Use the following counters to identify bottlenecked disk resources:

  • PhysicalDisk\ % Disk Time and % Idle Time
  • PhysicalDisk\ Disk Reads/sec and Disk Writes/sec
  • PhysicalDisk\ Avg. Disk Queue Length
  • LogicalDisk\ % Free Space

Also monitor memory counters to determine whether excessive paging is putting a strain on the disk.

See Analyzing performance for counter threshold values that should not be exceeded and see Solving performance problems for tuning techniques that may alleviate performance problems.

Note

  • Unlike physical-disk counter data, logical-disk counter data is not collected by the operating system by default. To obtain performance counter data for logical drives or storage volumes, you must type diskperf -yv at the command prompt. This causes the disk performance statistics driver used for collecting disk performance data to report data for logical drives or storage volumes. By default, the operating system uses the diskperf -yd command to obtain physical drive data. For more information about using the diskperf command, type diskperf -? at the command prompt.


Finding network bottlenecks

Use the following counters to identify bottlenecked network resources:

  • Network Interface\ Bytes Total/sec, Bytes Sent/sec, and Bytes Received/sec
  • Protocol_layer_object\ Segments Received/sec, Segments Sent/sec, Frames Sent/sec, and Frames Received/sec

    • For NWLink performance objects, frame-related counters report only zeroes. Use datagram-based counters for these objects.

  • Server\ Bytes Total/sec, Bytes Received/sec, and Bytes Sent/sec
  • Network Segment\ % Network Utilization

See Analyzing performance for counter threshold values that should not be exceeded and see Solving performance problems for tuning techniques that may alleviate performance problems.


Finding printer bottlenecks

Use the following counters to identify bottlenecked printer resources:

  • Print Queue\ Bytes Printed/sec
  • Print Queue\ Job Errors

Low values for Bytes Printed/sec can indicate a printer throughput problem. Note that this value varies based on the type of printer. Consult your printer documentation for acceptable values for printer throughput.

Job errors are typically caused by improper port configuration. Check your port configuration for invalid settings.


Configure memory-related settings on your computer

To configure memory-related settings on your computer

  1. Open Network and Dial-up Connections.
  2. Right-click Local Area Connection and click Properties.
  3. In Components checked are used by this connection, double-click File and Printer Sharing for Microsoft Networks.
  4. Under Optimization, notice that Maximize data throughput for file sharing is selected by default. To turn this option off to reduce paging activity, click Maximize data throughput for network applications.

Note


Determine the amount of RAM on your computer

To determine the amount of RAM on your computer

  1. On the Windows 2000 desktop, right-click My Computer and click Properties.
  2. On the General tab, the amount of memory in kilobytes (KB) appears beneath the Computer information.