Active Directory Monitoring With PATROL

Active Directory Monitoring With PATROL

Contents What is Active Directory?...1 Why Monitor?...1 Active Directory and PATROL...2 Critical Active Directory Components to Monitor...3 Address Book...3 Domain Controllers...4 Domain Name Service...5 FSMO Roles...6 LDAP...7 Member Servers...7 Replication...8 Security Accounts Manager...9 Trusts...9 In Summary...9 BMC Software Professional Services...10

What is Active Directory? Active Directory is the directory service included with Microsoft Windows 2000 Servers. Active Directory provides a place to store information about network-based objects such as computers, groups, printers, folders, and users. It provides a comprehensive, ongoing way to name, describe, locate, access, manage, and secure information about these individual resources. Active Directory is important because it provides a single point of management for Windows-based user accounts and other network-based objects. Having and using a directory service such as Active Directory can help you simplify management, strengthen security, standardize tools, and extend operability. With all this functionality, it is mandatory that Active Directory be managed efficiently and effectively. However, because of its complexity, only a small set of skilled technicians understand its infrastructure. BMC Software has incorporated comprehensive monitoring and management for Active Directory into its PATROL for Microsoft Windows Servers product. With this product, you can monitor various aspects of your environment and, in turn, improve the management, security, and interoperability of your Windows network operating system. Why Monitor? You monitor Active Directory to detect and resolve potential network problems before they seriously impact end users. No one knows better than a Windows administrator the feeling of a domain controller crashing in a production environment. Administrators often discover problems with their systems only after users call with complaints. Proactive monitoring helps the administrator retain control of the environment. Because Active Directory controls resource access (logging on to the domain, accessing printers, accessing computers, accessing applications such as Exchange), monitoring it is extremely important. Active Directory is the root of all things in a Windows 2000 domain. Monitoring resources is a partial solution, but managing the underlying service that provides these resources is even more important. Page 1

To emphasize how important it is to monitor Activity Directory, here is a list of some potential problems that can result when Active directory is not properly managed: login failures password problems group policy application problems resource access problems application access problems (for example, Exchange 2000) replication conflicts This list names only a few of the potential problems. Imagine your users not being able to log on nor being able to access email. What if they could not print nor access a share where critical documents are stored? In Windows 2000, Active Directory is the driving force that provides these resources centrally and consistently. To keep your servers working effectively, you must monitor Active Directory. Active Directory and PATROL PATROL s role is to ensure that the customer s applications and business processes, including Active Directory, are always available and performing at their optimum level. PATROL manages Active Directory in three main areas: availability, by tracking whether Active Directory services are actually up and operating performance, by monitoring relevant Windows 2000 performance counters and event log utilization Because the continuous operation of Active Directory is so critical to the Windows 2000 environment, PATROL also uses synthetic transactions to ensure that Active Directory servers are actually working properly. PATROL monitors the replication process confirming that connections can be made among Active Directory servers. On the console, PATROL presents icons for each Active Directory server in the domain. From there, users can drill into each server to ensure the servers are working together correctly. Page 2

Critical Active Directory Components to Monitor Many components are critical to the success of an Active Directory deployment. Management of each of these components is explained in detail in the subsections that follow. Address Book Domain Controllers Domain Name Service (DNS) FMSO Roles Member Servers Replication Security Accounts Manager (SAM) Trusts Lightweight Directory Access Protocol (LDAP) Each type of monitoring (presented alphabetically) is followed by a table describing the aspects of Active Directory that PATROL monitors. Address Book PATROL monitors the performance of address book requests made against the Domain Controller. The address book is simply a Lightweight Directory Access Protocol (LDAP) search client that can be used to query Active Directory. The PATROL application class for monitoring the items in the following table is NT_AD_ADDRESS_BOOK. Ambiguous Name Resolution Requests The rate at which Address Book clients perform Ambiguous Name Resolutions operations Browse Rate Client Sessions Match Rate Property Read Rate Proxy Lookup Rate Search Rate AB Browses/sec is the rate at which Address Book clients perform browse operations AB Client Sessions is the number of connected Address Book client sessions The rate at which Address Book clients perform find operations The rate at which Address Book clients perform property read operations The rate at which proxy clients perform search operations The rate at which Address Book clients perform key search operations Page 3

Domain Controllers Part of the Active Directory deployment is the automatic creation of a Domain Controller where the Active Directory database resides. For this, and for other Domain Controllers in the Windows environment, PATROL monitors available disk space, connection performance, and general server availability. Metrics related to monitoring Domain Controllers can be found on the PATROL console under the heading NT_AD_DOMAIN_CONTROLLER. Disk Space Disk Space Available Read Rate Search Rate Write Rate Client Name Translations Server Name Translations Threads in Use Event Log Error, Warning and Information Count Online De-fragmentation Count Server Availability Ping Response Disk space used by Active Directory database The Active Directory database is placed on each Domain Controller. As more and more objects are added to the domain, the size of the database can grow substantially. Disk Space available on the Active Directory volume as a result of the Active Directory database increasing in size Active Directory read operations occurring every minute The Active Directory database must be ready to answer queries. Active Directory search operations issued against the Domain Controller every minute Number of write operations issued against the Domain Controller every minute As objects are created in Active Directory, these objects and values of the objects are written to the Active Directory database. Number of Active Directory client name translations issued against the Active Directory server each minute Number of Active Directory server name translations issued against the Domain Controller The number of threads in use by the Domain Controller The number of errors, warnings, and informational events on the Domain Controller since the last collection cycle. Events are a key factor in determining if an Active Directory implementation is faulty and is the first place administrators look when troubleshooting. The number of online de-fragmentations that have occurred on the Domain Controller since the last collection cycle As the Active Directory database becomes fragmented, it must be de-fragmented to allow for quick data access. The amount of time each server is available If a server is consistently going down and unavailable, this server may have to be upgraded or replaced, with an ultimate goal of 100 percent. The amount of time required to perform a PING against the server Page 4

Connect Response PATROL Agent Status Connect Status The amount of time each server takes to report to connection requests Clients cannot obtain consistent service from the Domain Controller if this value is too high. The status of the PATROL Agent on the remote server (requires setup) Whether or not a connection test was successful based on a connection test Domain Name Service Domain Name Service (DNS) is an essential component of Active Directory for name resolution. PATROL reports on DNS status and alarms if the service is compromised. PATROL also monitors performance by measuring how long it takes the DNS server to process synthetic requests. Most metrics related to DNS can be found on the PATROL console under the heading NT_DNS for NT Servers or under NT_DNS_2000 for Windows 2000 Servers. DNS Service Status Query Response Time Query Rate Query Success Rate Query Failure Rate WINS Lookup Rate WINS Response Rate WINS Reverse Lookup Rate WINS Reverse Response Rate Dynamic Update Received Rate Dynamic Update Write Rate Dynamic Update Timeout Rate Dynamic Update Reject Rate Is the DNS service is up or down? The time it takes the DNS server to process a sample request calculated using a synthetic transaction The number of queries received this parameter can help you decide if you need additional DNS servers installed for load-balancing purposes The average number of successful queries The average number of failed queries The rate at which WINS queries are being received by the DNS server The rate at which responses to WINS queries are being processed at the DNS server The rate at which reverse lookup WINS queries are received by the DNS server The rate at which reverse lookup WINS queries are being processed by the DNS server each minute The rate at which dynamic updates are being received at the DNS server each minute The rate at which dynamic updates are written to the DNS database each minute The rate at which dynamic updates are failing do to timeout each minute The rate at which dynamic updates are being rejected by the DNS server Page 5

Dynamic Update Queued Rate Secure Update Received Rate Secure Update Failed Rate Event Log Error, Warning and Information count The rate at which dynamic updates are being queued by the DNS server The rate at which secure updates are being received at the DNS server each minute The rate at which secure updates are failing on the DNS database each minute The number of related events since the last collection cycle FSMO Roles Flexible Single-Master Operations (FMSO) is a key feature in Windows 2000 networking. Active Directory performance can be enhanced by distributing the FSMO roles among the Domain Controllers in Windows 2000. PATROL discovers and reports on all five FSMO roles: Schema Master (1 per forest) Domain Naming Master (1 per forest) PDC Emulator (1 per domain) Infrastructure Master (1 per domain) RID Master (1 per domain) Metrics related to FSMO roles can be found on the PATROL Console under the heading NT_AD_FSMO_ROLE. Role Server Role Server Changed Agent Connection Status Role Status Which Domain Controller is holding the role If the role is transferred or seized, an administrator can easily access this parameter for that information. Of course, alerts can be set up to notify administrators of role changes. Role server changes Again alerts can be set up for notification. Microsoft does not provide a notification method for a role change. Administrators discover a role has been changed when tasks are attempted such as changing a user s password. PATROL lets you know about these changes. Connection status of Agent to role holder Status of role holder fulfilling updates Page 6

LDAP When Active Directory is accessed for data related to network resources printers, users, and computers, PATROL uses LDAP protocol. PATROL monitors the LDAP connection status and uses automated synthetic transactions to measure the time that it takes to complete typical LDAP queries. The following metrics can be found on the PATROL Console under NT_AD_LDAP. Active Threads Bind Time Client Sessions Search Rate Bind Rate Write Rate Response Time Connect Status Percent Writes Percent Searches The number of LDAP active threads that exist on the DC The average amount of time that LDAP requests are taking to bind to the Domain Controller The number of active client LDAP sessions that exists on the Domain Controller The rate at which LDAP searches are occurring on the Active Directory server The number of successful binds that are occurring on the Domain Controller The number of Active Directory LDAP write operations issued against the Domain Controller The amount of time required to issue an LDAP bind and query operation (configure synthetic transaction) Connection status based on the LDAP response time The percentage of directory write operations that are initiated from LDAP The percentage of directory search operations that are initiated from LDAP Member Servers Although Active Directory resides on Domain Controllers and not on member servers, the management of member servers is still an important part of the network management strategy. PATROL monitors the availability of each member server on the network. Companies use member servers for things such as print servers, CD-ROM servers, or Exchange servers. The following metrics can be found on the PATROL Console under NT_AD_MEMBER_SERVER. Server Availability Ping Response Connect Response The amount of time each server is available The amount of time required to perform a PING against the server The amount of time each server takes to report to connection requests Page 7

PATROL Agent Status Connection Status The status of the PATROL Agent on the server Connection tests Replication As Active Directory objects are created or updated, changes are replicated among Domain controllers within the network. This feature is critical to maintaining the performance and availability of your Windows 2000 environment. PATROL monitors the replication between servers to ensure that it occurs successfully. PATROL also provides many utilization statistics to ensure that optimal replication takes place. The following metrics can be found on the PATROL Console under NT_AD_REPLICATION. Inbound Object Rate Outbound Object Rate Inbound Byte Rate Outbound Byte Rate Inbound Value Rate Outbound Value Rate Inbound Property Rate Outbound Property Rate Pending Synchronizations Synchronization Requests Successful Synchronization Requests Failed Synchronization Requests Number of objects received from Domain Controller partners through inbound replication Number of objects replicated out to Domain Controller partners Total number of bytes replicated in Sum of the number of uncompressed bytes (never compressed) and the number of compressed bytes (after compression) Total number of bytes replicated out Sum of the number of uncompressed bytes (never compressed) and the number of compressed bytes (after compression). Total number of object property values received from inbound replication partners Each inbound object has one or more properties, and each property has zero or more values. Zero values indicate property removal. Number of object property values sent to outbound replication partners. Total number of object properties received from inbound replication partners Number of properties replicated out DRA Pending Replication Synchronizations is the number of directory synchronizations that are queued for this server but not yet processed. Number of synchronization requests made to the neighbors Number of synchronization requests made to the neighbors that successfully returned Number of synchronization requests made to the neighbors that were not successful Page 8

File Replication Service Status Whether or not the File Replication Service is running Security Accounts Manager The Security Accounts Manager (SAM) exists in a mixed mode environment (Windows NT 4.0 and Windows 2000). SAM requests are generated when an NT 4.0 client of a Windows 2000 Active Directory server initiates an account change request. PATROL monitors the performance of SAM requests made against the Active Directory server. The following metrics can be found on the PATROL Console under NT_AD_SAM. Attempted Object Creation Successful Object Creation Failed Object Creation Group Evolutions Query Rate Percent Reads Percent Writes Percent Searches Number of attempts at creating objects (machines and users) Number of successful object creations from both machines and users Number of failed object creations from both machines and users Number of evaluations of groups dealing with account group membership, GC evaluations, and nontransitive group membership Number of display information queries and the number of enumerations occurring on the Domain Controller Percent of directory reads coming from SAM Percent of directory writes coming from SAM Percent of directory searches coming from SAM Trusts Trusts refer to a transparent relationship between domains that allows for resource sharing. Domains trust each other, which provides resource access to users between domains. The following metrics can be found on the PATROL Console under NT_AD_TRUSTS. Trust Status Is the trust up or down? In Summary Active Directory serves an important need to Windows 2000 administrators through its ability to simplify management tasks, strengthen network security, and ease the interoperability of systems. Using PATROL for Microsoft Windows Servers to get the Page 9

most out of your Active Directory service is an intelligent, cost-effective, and comprehensive solution to ensure that Active Directory performs continually at its peak level. BMC Software Professional Services BMC Software Professional Services helps your company maintain its competitive advantage through a comprehensive suite of services that includes service level management consulting, installation, implementation, configuration, and customization. Our professional services and education offerings are designed to ensure the ongoing availability of critical business applications, maximize product potential, reduce project risk, deliver IT value to your business, and improve your operations. For more information about BMC Software Professional Services, visit http://www.bmc.com/profserv. About BMC Software BMC Software, Inc. [NYSE: BMC], is the leading provider of enterprise management solutions. Through its Assuring Business Availability approach, BMC Software delivers control over infrastructure management costs, control of market advantage and differentiation via service management, and growth of business value with solutions for business optimization. BMC Software is a member of the S&P 500, with fiscal year 2001 revenues exceeding $1.5 billion and offices worldwide. For more information, please visit the BMC Software Web site at http://www.bmc.com Page 1

For more information visit BMC Software on the Web at www.bmc.com BMC Software, the BMC Software logos and all other BMC Software product or service names are registered trademarks or trademarks of BMC Software, Inc. All other registered trademarks or trademarks belong to their respective companies. 2002, BMC Software, Inc. All rights reserved. 100041974 2/02