MONITORING MICROSOFT WINDOWS SERVER 2003

Transcription

1 1 Chapter 3 MONITORING MICROSOFT WINDOWS SERVER 2003 Chapter 3: MONITORING MICROSOFT WINDOWS SERVER CHAPTER OVERVIEW Use Event Viewer to monitor system logs. Configure Task Manager to display performance data. Use System Monitor to display real-time performance data. Create counter logs and alerts. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER SERVER MONITORING PRACTICES Real-time monitoring Uses tools that display a continuous stream of statistics about what the system is doing right now Logged monitoring Enables administrators to observe trends that develop over longer periods of time than those observed in a typical real-time monitoring session 1

2 Chapter 3: MONITORING MICROSOFT WINDOWS SERVER BASIC MONITORING SUBSYSTEMS Processor Disk Memory Network Chapter 3: MONITORING MICROSOFT WINDOWS SERVER ESTABLISH A BASELINE WHAT IS A BASELINE? WHAT IS THE PURPOSE? Chapter 3: MONITORING MICROSOFT WINDOWS SERVER USING EVENT VIEWER TO MONITOR ERROR 2

3 Chapter 3: MONITORING MICROSOFT WINDOWS SERVER EVENT VIEWER LOGS Application Information about specific programs running on the computer System Events generated by components such as services and device drivers Security Security-related events such as failed logons and attempts to access resources Chapter 3: MONITORING MICROSOFT WINDOWS SERVER UNDERSTANDING EVENT TYPES Event Type Icon Description Error A significant problem, such as loss of data or loss of functionality Warning An event that might not be significant but might indicate a future problem Information An event that describes the successful operation of an application, driver, or service Success Audit Failure Audit An audited security access attempt that succeeds An audited security access attempt that fails Chapter 3: MONITORING MICROSOFT WINDOWS SERVER VIEWING EVENTS 3

4 Chapter 3: MONITORING MICROSOFT WINDOWS SERVER EVENT LOG RETENTION SETTINGS Chapter 3: MONITORING MICROSOFT WINDOWS SERVER USING FILTERS Chapter 3: MONITORING MICROSOFT WINDOWS SERVER FINDING SPECIFIC EVENTS 4

5 Chapter 3: MONITORING MICROSOFT WINDOWS SERVER ACCESSING REMOTE EVENT LOGS Allows you to view event logs on another system. Select Connect To Another Computer from the Action menu. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER ARCHIVING EVENT LOGS Might be required in certain environments. Reduces space used by log files. Save as.evt files in order to view in Event Viewer. Save as.txt or.csv (commas separated values) files to import into other applications. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER USING TASK MANAGER Real-time monitoring tool Displays information on: Processor and memory performance Applications and processes Network utilization Users connected to the system 5

6 Chapter 3: MONITORING MICROSOFT WINDOWS SERVER WORKING WITH APPLICATIONS Chapter 3: MONITORING MICROSOFT WINDOWS SERVER MONITORING PROCESSES Chapter 3: MONITORING MICROSOFT WINDOWS SERVER MONITORING PERFORMANCE LEVELS 6

7 Chapter 3: MONITORING MICROSOFT WINDOWS SERVER MONITORING NETWORK ACTIVITY Chapter 3: MONITORING MICROSOFT WINDOWS SERVER MONITORING USERS Chapter 3: MONITORING MICROSOFT WINDOWS SERVER USING THE PERFORMANCE CONSOLE System Monitor Displays real-time performance data collected from performance counters Performance Logs and Alerts Records data from performance counters over a period of time and executes specific actions when counters reach a certain value 7

8 Chapter 3: MONITORING MICROSOFT WINDOWS SERVER USING SYSTEM MONITOR Chapter 3: MONITORING MICROSOFT WINDOWS SERVER MODIFYING THE GRAPH VIEW Chapter 3: MONITORING MICROSOFT WINDOWS SERVER HISTOGRAM VIEW 8

9 Chapter 3: MONITORING MICROSOFT WINDOWS SERVER REPORT VIEW Chapter 3: MONITORING MICROSOFT WINDOWS SERVER ADDING COUNTERS Chapter 3: MONITORING MICROSOFT WINDOWS SERVER CREATING AN EFFECTIVE DISPLAY Limit the number of counters. Modify the counter display properties. Choose counters with comparable values. 9

10 Chapter 3: MONITORING MICROSOFT WINDOWS SERVER SAVING A SYSTEM MONITOR CONSOLE Allows you to access commonly used counters more easily Reduces time needed to monitor critical components Can allow you to develop an eye for issues Chapter 3: MONITORING MICROSOFT WINDOWS SERVER WHAT ARE YOU DRINKING? WHAT IS A BOTTLENECK? Chapter 3: MONITORING MICROSOFT WINDOWS SERVER MONITORING PROCESSOR PERFORMANCE Processor: % Processor Time Should be < 85% System: Processor Queue Length Should be < 10 Server Work Queues: Queue Length Should be < 4 Processor: Interrupts/sec Varies depending on configuration 10

11 Chapter 3: MONITORING MICROSOFT WINDOWS SERVER MONITORING MEMORY PERFORMANCE Memory: Page Faults/Sec Should be < 5 Memory: Pages/Sec Should be < 20 Memory: Available Bytes Should not fall below 5 percent of the system s total physical memory Memory: Committed Bytes Should always be less than the physical RAM in the computer Memory: Pool Non-Paged Bytes Should be a stable number that does not grow without a corresponding growth in server activity Chapter 3: MONITORING MICROSOFT WINDOWS SERVER MONITORING DISK PERFORMANCE PhysicalDisk: Disk Bytes/sec Should be equivalent to the levels established in the original baseline readings or higher PhysicalDisk: Avg. Disk Bytes/Transfer Should be equivalent to the levels established in the original baseline readings or higher PhysicalDisk: Current Disk Queue Length Should be < 2 PhysicalDisk: % Disk (busy) Time Should be < 80% LogicalDisk: % Free Space Should be > 20% Chapter 3: MONITORING MICROSOFT WINDOWS SERVER MONITORING NETWORK PERFORMANCE Network Interface: Bytes Total/sec Should be equal to baseline readings or higher Network Interface: Output Queue Length Preferably 0, < 2 acceptable Server: Bytes Total/sec Should be < 50 percent of the total bandwidth capacity 11

12 Chapter 3: MONITORING MICROSOFT WINDOWS SERVER MONITORING SERVER ROLES Different server roles place different demands on underlying hardware. Different server roles require different components to be monitored. Be aware of over monitoring. SERVER ROLES Application Database File and Print Web Backup Domain controller Mail/Messaging Chapter 3: MONITORING MICROSOFT WINDOWS SERVER USING PERFORMANCE LOGS AND ALERTS Counter logs Captures statistics for specific counters to a log file Trace logs Records information about system applications when certain events occur Alerts Performs an action when the counter reaches a specified value Chapter 3: MONITORING MICROSOFT WINDOWS SERVER CREATING A COUNTER LOG 12

13 Chapter 3: MONITORING MICROSOFT WINDOWS SERVER CREATING A TRACE LOG Chapter 3: MONITORING MICROSOFT WINDOWS SERVER VIEWING A COUNTER LOG Chapter 3: MONITORING MICROSOFT WINDOWS SERVER CREATING ALERTS 13

14 Chapter 3: MONITORING MICROSOFT WINDOWS SERVER CHAPTER SUMMARY Event Viewer is an MMC snap-in that displays logs maintained by the computer. Task Manager displays real-time performance data for the computer. The Performance console consists of two snap-ins: System Monitor and Performance Logs and Alerts. System Monitor shows real-time performance data for system hardware and software components using graph, histogram, and report views. Performance Logs and Alerts records performance counter information to counter logs and operating system events to trace logs over scheduled periods of time, enabling you to capture large data samples for later examination. 14