Performance Counters. Microsoft Windows. Technical Data Sheet. Overview:

Transcription

1 Performance Counters Technical Data Sheet Microsoft Windows Overview: Key Features and Benefits: Key Definitions: Performance counters are used by the Operations Management Architecture (OMA) to collect data and answer the questions posed to the various devices by the polling engine to determine its state of wellbeing. These counters provide the OMA with the data and information it needs to establish how well an application, server, service or driver is performing and whether there are any issues. By comparing the counter result with the defined threshold, the OMA is able to determine a problem or predict a future problem. They are also used for capacity planning. Performance analysis Capacity planning Determine system bottlenecks Page Fault: A page fault occurs when a process requires code or data not in its working set (its space in physical memory). This includes both hard faults (those that require disk access) and soft faults (where the faulted page is found elsewhere in physical memory). Sourcing has spent a great deal of time building an expertise on this complex subject both in its OMA and its people. There are thousands of performance counters for each device, system or application and the selection of those counters which will provide the customer or technical team with the most value is where the complexity lies. To some degree, the selection of the counters is considered an art. The selection depends on what the application, device or system does for the organisation and how important that role is to the business. Monitoring for the sake of monitoring is a waste of resources, time and money. System fine-tune Application performance Privileged Mode: Privileged mode is a processing mode designed for operating system components and hardware-manipulating drivers. It allows direct access to hardware and all memory. SNMPD: An SNMP agent which binds to a port and awaits requests from

2 Performance Counters: SNMP management software. Upon User Mode: This is a restricted receiving a request, it processes the processing mode designed for request(s), collects the requested applications, environment information and/or performs the subsystems and integral requested operation(s) and returns subsystems. the information to the sender. The following performance counters are used by Sourcing and the OMA for the monitoring of Windows Servers: Processor Counters processor spent receiving and o CPU Interrupts Per Sec: This servicing hardware interrupts during counter shows the average number the sample interval. This value is an of hardware interrupts per second indirect indicator of the activity of over the length of the test that the devices that generate interrupts, central processor is experiencing or such as the system clock, the receiving and servicing. It is an mouse, disk drivers, data indirect indicator of the activity communication lines, network generated by the various devices interfaces cards and other peripheral connected to the server such as disk devices. These devices normally interrupt the processor when they have completed a task or require attention. Normal thread execution is suspended drives, network interface cards and during interrupts. Most system sound cards which impact the clocks interrupt the processor every processor by interrupting it when 10 milliseconds, creating a they have a task to complete or background of interrupt activity. require attention. If there are multiple processors, this number is o CPU % Privileged Time: The the total of all the processors. percentage of non-idle processor o CPU % Interrupt Time: The time spent in privileged mode. This percentage of time that the includes time servicing interrupts Page 2 of 15

3 and DPCs. A high rate of privileged time might be attributed to a large number of interrupts generated by a failing device. o CPU % Processor Time: The percentage of time the processor is executing a non-idle thread. This was designed as a primary indicator of processor activity. It is calculated by measuring the time the processor spends executing the thread of the idle process in each sample interval, and subtracting that value from 100%. (Each processor has an idle time thread which consumes cycles when no other threads are ready to run). It can be viewed as the percentage of the sample interval spent doing useful work. o CPU % User Time: The percentage of non-idle processor time spent in user mode. User mode is a restricted processing mode designed for applications, environment subsystems, and integral subsystems. The alternative, privileged mode is designed for operating system components and allows direct access to hardware and all memory. The operating system switches application threads to privileged mode to access operating system services. o CPU Processor Queue: This is the number of threads waiting in the processor queue. Computers with multiple processors will have at least a single queue. For the average per processor, divide this value by the number of processors which are servicing the workload. It shows only the ready threads and not those running. o CPU Average Busy: The average, over the last minute, of the percentage of time that this processor was not idle. Page 3 of 15

4 Hard Drive Counters o Disk Percent busy: The percentage of elapsed time the disk drive is busy servicing read or write requests. o Disk Free Space / Free Megabytes: The amount of the free megabytes available on the disk. o Disk Percent Free Space: Reports the percentage of unallocated disk space to the total usable space on the logical volume. o Disk Average Disk Queue Length: This is an estimate of requests on the physical or logical disk that are either in service or waiting for service. It is the average number of read and write requests queued for the disk during the test interval. The value is the product of Disk Transfers/sec (response X I/O) and Avg Disk sec/transfer. It can be used as a general representation of the condition of your storage system. o Disk Average Disk Read Queue Length: Tracks the number of requests queued and waiting for a disk during the sample interval, as well as requests in service. It is the average number of read requests queued for the disk during the test interval. It might overstate activity. If more than two requests are continuously waiting on a singledisk system, the disk might be a bottleneck. o Disk Average Disk Write Queue Length: This calculates the average number of write requests that were queued for the selected disk during the sample interval. o Disk Average MSecs Per Transfer: Indicates how fast data is being moved (in milliseconds). It measures the average time of each data transfer, regardless of the number of bytes read or written. It shows the total time of the read or write, from the moment it leaves the Diskperf.sys driver to the moment it is complete. A high value for this counter might mean that the system is retrying requests due to lengthy queuing or, less commonly, disk failures. o Disk Current Disk Queue Length: Indicates the number of disk requests currently waiting as well as requests currently being Page 4 of 15

5 serviced. Subject to wide variations unless the workload has achieved a steady state and a sufficient number of samples have been collected to establish a pattern. An instantaneous value or snapshot of the current queue length. o Disk Percent Disk Read Time: Reports the percentage of busy time spent by the selected disk drive servicing read requests. o Disk Percent Disk Write Time: Reports the percentage of busy time spent by the selected disk drive servicing write requests. o Disk Percent Idle Time: Reports the percentage of time the disk system was not processing requests and no work was queued. o Disk Split IO Per Sec: Reports the rate at which the operating system divides I/O requests to the disk into multiple requests. A split I/O request might occur if the program requests data in a size that is too large to fit into a single request or if the disk is fragmented. Factors that influence the size of an I/O request can include application design, the file system, or drivers. A high rate of split I/O might not, in itself, represent a problem. However, very often a high rate for this counter tends to indicate disk fragmentation. Memory Counters o Memory Available MBytes: The amount of physical memory available to run processes on the computer. Free memory is ready for use. o Memory Cache data maps/second: The frequency a file system such as NTFS maps a page of a file into the file system cache to read the page. o Memory Hard page Page 5 of 15

6 faults: The number of times the disk was read to resolve hard page faults. Hard Page faults occur when a process requires code or data not in its working set or elsewhere in physical memory, and must be retrieved from disk. This is a primary indicator of the kinds of faults that cause systemwide delays. It includes reads to satisfy faults in the file system cache (usually requested by applications) and in non-cached mapped memory files. This counter counts numbers of read operations, without regard to the numbers of pages retrieved by each operation. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval. Network Interface Card Counters o Network Output errors: The number of outbound packets that could not be transmitted because of errors o Network Input Errors: The number of inbound packets that contained errors preventing them from being deliverable to a higher-layerprotocol. o Memory Page fault rate: The overall rate faulted pages handled by the processor. It is measured in number of pages faulted per second. Most processors can handle large numbers of soft faults without consequence. However hard faults can cause significant delays. This counter displays the different between the values observed in the last two samples, divided by the duration of the sample interval. o Pagefile C: Pagefile Percent Usage: The amount of the page file instance in use reflected as a percentage. o Network InOctets: The total number of octets received on the interface, including framing characters. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other Page 6 of 15

7 times as indicated by the value of Counter Discontinuity Time o Network OutOctets: The total number of octets transmitted out of the interface, including framing characters. Discontinuities in the value of this counter can occur at re-initialisation of the management system, and at other times as indicated by the value of Counter Discontinuity Time o Network OutQLen: The length of the output packet queue (in packets). o Network Operating Status: Is the actual state of the interface. Services Counters o Service Number Of Processes Running snmpd: The number of processes that are sending SNMP information to the OMA. An SNMP agent which binds to a port and awaits requests from SNMP management software. Upon receiving a request, it processes the request(s), collects the requested information and/or performs the requested operation(s) and returns the information to the sender. o Service Operating State snmpd: Reflects the state of SNMP agent as to whether it is ready and able to receive SNMP data. o Service Operating State Backup Exec Remote Agent for Windows Systems: Reflects the state of the Backup Exec remote agent for Windows. o Service Operating State Computer Browser: Reflects the status of the computer browser service. The primary function of the browser service is to provide a list of computers sharing resources in a client's domain along with a list of other domain and workgroup names across the widearea network (WAN). This list is provided to clients that view network resources with Network Neighborhood or the NET VIEW Page 7 of 15

8 command. This service is replaced by Active Directory. o Service Operating State DHCP Server: Reflects the status of the DHCP server. Dynamic Host Configuration Protocol (DHCP) is a client/server protocol that automatically provides an Internet Protocol (IP) host with its IP address and other related configuration information such as the subnet mask and default gateway. The Microsoft Windows Server 2003 operating system includes a DHCP Server service, which is an optional networking component. All Windows-based clients include the DHCP client as part of TCP/IP, including Windows Server 2003, Microsoft Windows XP, Windows 2000, Windows NT 4.0, Windows Millennium Edition (Windows Me), and Windows 98. o Service Operating State DNS Server: Reflects the status of the DNS server. Domain Name System (DNS) is a system for naming computers and network services that is organized into a hierarchy of domains. DNS naming is used in TCP/IP networks, such as the Internet, to locate computers and services through user-friendly names. When a user enters a DNS name in an application, DNS services can resolve the name to other information associated with the name, such as an IP address. o Service Operating State File Replication Service: Reflects the status of the FRS. File Replication Service (FRS) is used for synchronizing the SYSVOL shared folders on domain controllers and for synchronizing DFS link targets on servers running Windows 2000 and Windows Server o Service Operating State OfficeScan NT Listener: State of the Trend Office Scan Service that communicates with the OfficeScan / OfficeScan server to retrieve updates, report status, etc. Page 8 of 15

9 o Service Operating State OfficeScan NT Real Time Scan: State of the Trend OfficeScan Service that enables the firewall features of OfficeScan program. o Service Operating State OMA Agent Updater: Reflects the status of the Sourcing OMA agent updater. The OMA agent updater allows updating of configuration and patches. o Service Operating State OMA Application Agent: Reflects the status of the Sourcing OMA application agent. The OMA application agent allows the Sourcing OMA to talk to the server and enquire on the status of currently configured Log File Parsing profiles o Service Operating State OMA Trapper: Reflects the status of the OMA trapper service. OMA Trapper is the service that runs against log files to determine matches. o Service Operating State OMAosAgent: Reflects the status of the OMAosAgent which allows Sourcing to extend the MIB tree to add to the monitoring profile. o Service Operating State OpsMgr Health Service: Reflects the state of Windows OpsMgr s ability to monitor the health of managed objects. Microsoft System Center Operations Manager 2007 (OpsMgr) is a monitoring and operations management system, implemented using one or more computers that perform their assigned roles as components of a management group. The components cooperate over several secure communication channels to achieve management information workflow and present information to operators and administrators. The most important data collected is the health of the managed objects; this health status is arrived at via models that affect the tactical placement of software probes called monitors. Page 9 of 15

10 o Service Operating State Print Spooler: The status of the programme responsible for managing printing. The print spooler is a software program responsible for managing all print jobs currently being sent to the computer printer or print server. The print spooler program may allow a user to delete a print job being processed or otherwise manage the print jobs currently waiting to be printed. o Service Operating State Remote Procedure Call RPC: The status of the RPC service. Remote Procedure Call (RPC) is a protocol that one program can use to request a service from a program located in another computer in a network without having to understand network details. o Service Operating State Server: The status of the server. o Service Operating State SNMP Service: Reflects the status of the SNMP status. Simple Network Management Protocol (SNMP) is used in network management systems to monitor networkattached devices for conditions that warrant administrative attention. o Service Operating State Workstation: Reflects the status of the VMWare workstation service. VMware Workstation lets you use your virtual machines to run Windows, Linux and a host of other operating systems side-by-side on the same computer. o Service Operating State Distributed File System: Reflects the status of the Windows Distributed File System. The Distributed File System (DFS) technologies in Windows Server 2003 R2 offer wide area network (WAN)-friendly replication as well as simplified, fault-tolerant access to geographically dispersed files. The two technologies in DFS are as follows: Page 10 of 15

11 DFS Replication. New statebased, multimaster replication engine that is optimized for WAN environments. DFS Replication supports replication scheduling, bandwidth throttling, and a new byte-level compression algorithm known as remote differential compression (RDC). DFS Namespaces. Technology that helps administrators group shared folders located on different servers and present them to users as a virtual tree of folders known as a namespace. DFS Namespaces was formerly known as Distributed File System in Windows 2000 Server and Windows Server o Service Operating State Network News Transport Protocol NNTP: Reflects the status of the NNTP service. The Network News Transfer Protocol or NNTP is an Internet application protocol used primarily for reading and posting Usenet articles (aka netnews), as well as transferring news among news servers. o Service Operating State Report Server: The status of the Microsoft SQL Report Server. The report server is the central component of a Reporting Services installation. It consists of a pair of core processors plus a collection of special-purpose extensions that handle authentication, data processing, rendering, and delivery operations. o Service Operating State Simple Mail Transport Protocol SMTP: Reflects the status of the SMTP service. Simple Mail Transfer Protocol (SMTP) is an Internet standard for electronic mail ( ) transmission across Internet Protocol (IP) networks. While electronic mail servers and other mail transfer agents use SMTP to send and receive mail messages, Page 11 of 15

12 user-level client mail applications typically only use SMTP for sending messages to a mail server for relaying. o Service OperatingState Certificate Services: Reflects the status of the certificate services. Windows Server 2003 Certificate Services provides customisable services for creating and managing public key certificates used in software security systems employing public key technologies. Organisations use certificates to enhance security by binding the identity of a person, device, or service to a corresponding private key. o Service Operating State Microsoft Active Directory Connector: Reflects the status of the Active Directory Connector (ADC). The task of the ADC is to replicate directory information (such as mailboxes, users and groups) between the Exchange 5.5 directory and Active Directory. o Service OperatingState Task Scheduler: Reflects the status of the Task Scheduler. By using Task Scheduler, you can schedule tasks such as to automate web testing and site monitoring or system tools like the Disk Defragmenter to run at a time that is most convenient for you. Task Scheduler starts each time you start Windows, and runs in the background. With Task Scheduler, you can: Schedule a task to run daily, weekly, monthly, or at certain times (such as system startup). o Service Operating State IIS Admin Service: Reflects the status of the IIS Admin service. IIS Admin Service is used by operating systems to expose the IIS metabase to other applications, including the core components of IIS, applications that are built on IIS, and third-party applications that are independent of IIS, such as management or monitoring tools. o Service Operating State World Wide Web Publishing Service: Page 12 of 15

13 Reflects the operating status of the component provides the Windows W3SVC. The Internet Information Firewall. Windows Firewall Services (IIS) World Wide Web provides a barrier between your Publishing Service (W3SVC), device and network connections to sometimes referred to as the WWW help reduce attacks by hackers, Service, manages the HTTP viruses, and worms across protocol and HTTP performance networks. All networked devices, counters. not just devices connected to the Internet, are vulnerable to these attacks. Internet Connection Sharing allows multiple computers to use a o Service Operating State Windows single public Internet Protocol (IP) Firewall/Internet Connection address. This component makes it Sharing ICS: Reflects the status of possible for you to selectively the Windows Firewall/Internet enable access for specific programs, Connection Sharing ICS. The services, and ports through the Windows Firewall/Internet firewall and to block others. Connection Sharing (ICS) For more services counters for Windows, please refer to the Technical Data Sheet Services Performance Counters. Web Site Web Server Counters o Current Connections: The number of active connections to the WWW service. o Current Anonymous Users: The number of users who currently have an anonymous request pending with the WWW service. In IIS 6.0, Current Users (Anonymous or Non Anonymous) is the number of requests currently being worked on by the server. The Current Anonymous Users performance counter is often used Page 13 of 15

14 for capacity planning and performance troubleshooting. o Current NonAnonymous Users: The number of users who currently have a nonanonymous request pending with the WWW service. In IIS 6.0, Current Users (Anonymous or NonAnonymous) is the number of requests currently being worked on by the server. o Bytes Per Second: The sum of Bytes Sent/sec and Bytes Received/sec. o Get Requests Per Sec: The rate, in seconds, at which HTTP requests that use the GET method have been made to the WWW service. o Maximum Anonymous Users: The maximum number of users who have made concurrent anonymous requests to the WWW service since the service started. o Maximum Connections: The maximum number of simultaneous connections made to the WWW service since the service started. o Service Uptime: The time (in hundredths of a second) since the web service was last re-initialised. o Connection Attempts Per Sec: The rate, in seconds, at which connections to the WWW service have been attempted since the service started. AspDotNet Counters o Application Restarts: Number of times the application has been restarted during the web server's lifetime. o Request Execution Time: The number of milliseconds that it took to execute the most recent request. o Requests Queued: The number of requests waiting to be processed. o Requests Rejected: The number of requests rejected because the request queue was full. o Request Wait Time: The number of milliseconds the most recent request was waiting in the queue. o Worker Process Restarts: Number of times a worker process has restarted on the machine. Page 14 of 15

15 SMTP Counters o Local Queue Length: Reports the total number of messages found in the Simple Mail Transfer Protocol (SMTP) local queue. o Remote Queue Length: Reports the total number of messages found in the Simple Mail Transfer Protocol (SMTP) remote queue. General System Counters o AVAIL - System Availability since Windows was rebooted. o SYS System Uptime: The time (in hundredths of a second) since the SNMP agent was last re-initialised. Top Processes o All Processes for Last Hour o MEM (Usage in Bytes) o CPU (Percentage Used) Technical Specifications: Contact Information: Learn More: Windows server performance counters for Windows Servers. Sourcing Sales Department Daniel Lorenzo Mike Tel: Tel: Tel: Mail: daniel@sourcing.co.za Mail: lorenzo@sourcing.co.za Mail: mike@sourcing.co.za For more information, please visit our website on or contact us on requests@sourcing.co.za or