Monitoring performance

System Monitor and Performance Logs and Alerts support detailed monitoring of the utilization of operating system resources.

  • To find features that have been changed in the Windows Server 2003 family, see New ways to do familiar tasks.
  • For tips about monitoring performance, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem solving instructions, see Troubleshooting.


New ways to do familiar tasks

The following table lists common tasks for System Monitor and Performance Logs and Alerts (hosted in the Performance console, named Perfmon.msc). The user interface for performing these tasks is different in the Windows Server 2003 family and Windows 2000 from the way it was in Windows NT version 4.0. Many of the toolbar buttons remain the same among the three operating systems and can be used instead of the steps listed in this table.

If you want to | In Windows NT 4.0 use | In Windows 2000 or the Windows Server 2003 family use
Create a chart of performance data: See Work with monitoring views. | Performance Monitor on the Administrative Tools menu. | Open System Monitor.
Create a report of performance data: See To change from graph view to histogram or report views. | Performance Monitor on the Administrative Tools menu. | Open System Monitor.
Create a log: See To create a counter log or To create a trace log. | Performance Monitor on the Administrative Tools menu. | Open Performance.
Create an alert: See To create an alert. | Performance Monitor on the Administrative Tools menu. | Open Performance.


Best practices

  • Set up a monitoring configuration. Configure Performance Logs and Alerts to report data for the recommended counters at regular intervals, such as every 10 to 15 minutes. Retain logs over extended periods of time, store data in a database, and query the data to report on and analyze the data as needed for overall performance assessment, trend analysis, and capacity planning.

    For best results, do the following before starting System Monitor or Performance Logs and Alerts on the computer you want to monitor for diagnostic purposes:

    • If the server in question has halted or is not responding, run System Monitor from another computer.
  • Keep monitoring overhead low. In general, the performance tools are designed for minimal overhead. However, you might find that the overhead increases under the following conditions:
    • You are running System Monitor in graph view.
    • You have selected an option other than the default (current value) for either the System Monitor graph or report views.
    • You are sampling at very frequent intervals (less than three seconds apart).
    • You have selected many different objects and counters.

    Other aspects of performance tool operation that affect performance include file size and disk space taken up by log files. To reduce file size and related disk space usage, extend the update interval. Also, log to a disk other than the one you are monitoring. Frequent logging also adds demand on disk input and output (I/O).

    If monitoring overhead is a concern, run only the Performance Logs and Alerts service and do not monitor using a System Monitor graph.

    During local logging of remote counters, frequent updating can slow performance due to network transport. In this case, it is recommended that you log continuously on remote computers but upload logs infrequently — for example, once a day.

  • Analyze performance results, and establish a performance baseline. Review logged data by graphing it using the System Monitor display or exporting it for printing. Compare the values against the counter thresholds shown in Analyzing performance data to verify that resource usage or other activity is within acceptable limits. Set your baseline according to the level of performance that you consider satisfactory for your typical workload.
  • Set alerts. Set alerts according to the counter values you consider to be unacceptable, as defined by baseline evaluation.
  • Tune performance. Tune system settings and workload to improve performance and repeat monitoring to examine tuning results. For more information on ways to improve performance, see Solving performance problems.
  • Plan ahead. Monitor trends for capacity planning and add or upgrade components as needed. Maintain logged data in a database and observe changes to identify changes in resource requirements. After you observe changes in activity or resource demand, you can identify areas that might require additional resources.


How to...

  • Work with counters
  • Work with monitoring views
  • Work with data
  • Work with settings
  • Create and configure counter logs
  • Create and configure trace logs
  • Create and configure alerts
  • Work with logs and alerts


Work with counters

  • Add counters to System Monitor
  • Delete counters from System Monitor
  • Get counter descriptions


Add counters to System Monitor

Microsoft Windows graphic

To add counters to System Monitor

  1. Open Performance.
  2. Right-click the System Monitor details pane and click Add Counters.
  3. To monitor any computer on which the monitoring console is run, click Use local computer counters.

    Or, to monitor a specific computer, regardless of where the monitoring console is run, click Select counters from computer and specify a computer name or IP address.

  4. In Performance object, click an object to monitor.
  5. To monitor all counters, click All counters.

    Or, to monitor only selected counters, click Select counters from list and select the counters you want to monitor.

  6. To monitor all instances of the selected counters, click All instances.

    Or, to monitor only selected instances, click Select instances from list and select the instances you want to monitor.

  7. Click Add, and then click OK.

Notes

  • To perform this procedure, you must be a member of the Administrators group, the Performance Log Users group, or the Performance Monitor Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • By default, the following three counters are displayed in System Monitor -- Memory\Pages/sec, PhysicalDisk(_Total)\Avg. Disk Queue Length, and Processor(_Total)\%Processor Time.
  • If you select an object on a remote computer, you might notice a short delay as System Monitor refreshes the list to reflect objects present on that computer.
  • Unless you are configuring data from a log, you can select only active instances in the list box.
  • Some object types have several instances. For example, if a system has multiple processors, the Processor object type will have multiple instances. The Physical Disk object type has two instances if a system has two disks. Some object types such as Memory and Server have only a single instance. If an object type has multiple instances, you can add counters to track statistics for each instance, or in many cases, for all instances at once.
  • To monitor the sum of the values all of a particular counter's instances, select the _Total instance.
  • By default, process and thread instances have a #n appended (where n is an integer). To append the process ID instead, create a DWORD value called ProcessNameFormat under the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfProc\Performance subkey and set its value to 2. Likewise, to append the thread ID instead, create a DWORD value called ThreadNameFormat under the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfProc\Performance subkey and set its value to 2. To turn off any of these options and return to the default, set the value of the appropriate DWORD to 1.

    • Caution

    • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.
  • By default, counters are shown with both the instance name and an instance index. To turn off this feature, right-click the details pane, click Properties, select the General tab, and clear the Allow duplicate counter instances check box.
  • When you select two instance indexes of the same counter, for example, if you are monitoring multiple threads of a process, note that the instance index number assigned to that instance changes over time as the instance, such as a thread, starts and stops. The index number does not necessarily correspond to the same thread over the life of the process.
  • When creating a monitoring console for export, make sure to select Use local computer counters. Otherwise, System Monitor will obtain data from the computer named in the text box, regardless of where the console file is installed.
  • For a description of a particular counter, click the name of the counter in Add counters, and then click Explain.
  • You can change the default display characteristics assigned to a counter such as the color, line style and width, and graph scale by using the Data tab in the System Monitor Properties dialog box. To access the Data tab, right-click the details pane, and click Properties.
Related Topics


Delete counters from System Monitor

Microsoft Windows graphic

To delete counters from System Monitor

  1. Open Performance.
  2. In the System Monitor details pane, click the name of the counter in the legend.
  3. Press DELETE.

Notes

  • To perform this procedure, you must be a member of the Administrators group, the Performance Log Users group, or the Performance Monitor Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • You can also delete counters by using the Remove button on the Data tab in the System Monitor Properties dialog box. The Remove button is helpful for deleting a group of counters at once.

Related Topics


Get counter descriptions

Microsoft Windows graphic

To get counter descriptions

  1. Open Performance.
  2. Right click the System Monitor details pane and click Add Counters.
  3. In Performance object, click an object.
  4. In Select counters from list, click the counter for which you want information.
  5. Click Explain, and then click OK.

Notes

  • To perform this procedure, you must be a member of the Administrators group, the Performance Log Users group, or the Performance Monitor Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX


Working with monitoring views

Microsoft Windows graphic

Work with monitoring views

  • Use logged data
  • Change counters and counter properties
  • Change sampling options
  • Monitor a different computer
  • Highlight counter data
  • Change from graph view to histogram or report views
  • Add titles, grids, and other attributes to a graph
  • Change background, chart, text, and font properties


Use logged data

Microsoft Windows graphic

To use logged data

  1. Open Performance.
  2. Right-click the System Monitor details pane and click Properties.
  3. On the Source tab under Data Source, click Log files, and then add the file(s) you want to use as a data source.

    4. To specify a SQL server data source, click Database.

  4. Click Time Range.
  5. Click the Data tab and click Add to open the Add Counters dialog box. The counters you selected during log configuration appear.

Notes

  • You do not need administrative credentials to view counters from log files on the local computer.
  • XOX
  • Unless you specifically want to monitor start-up events, you should exclude times that include such events from your time window because these temporary high values tend to skew overall performance results.

Related Topics


Change counters and counter properties

Microsoft Windows graphic

To change counters and counter properties

  1. Open Performance.
  2. Right-click the System Monitor details pane and click Properties.
  3. On the Data tab, specify the options you want to use:
    • Add. Opens the Add Counters dialog box, where you can select other counters to add.
    • Remove. Removes the counter selected in the counter list.
    • Color. Changes the color of the selected counter.
    • Scale. Changes the displayed scale of a selected counter in the graph or histogram view. Counter values can be scaled linearly from .0000001 to 1000000.0. You can adjust the counter scale settings to enhance the visibility of counter data in the graph. Changing the scale does not affect the statistics displayed in the value bar.
    • Width. Changes the line width of a selected counter. Note that defining a line width can determine the line styles that are available.
    • Style. Changes the line style for a selected counter. You can select a style only when you are using the default line width.

Notes

  • If you want to view counters in real-time mode, or set up a monitoring configuration, you must be a member of the Administrators group, the Performance Log Users group, or the Performance Monitor Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • If you want to simply work with data from log files, you do not need administrative credentials on the local computer.
  • XOX
  • By default, System Monitor displays Pages/sec, Avg. Disk Queue Length, and % Processor Time counter data for the local computer.

Related Topics


Change sampling options

Microsoft Windows graphic

To change sampling options

  1. Open Performance.
  2. Right-click the System Monitor details pane and click Properties.
  3. On the General tab, specify the sampling option you want:
    • To sample automatically at regular intervals, select the Sample automatically every check box and in seconds type the length of the interval in seconds. The default interval is one second.
    • To sample manually, clear the Sample automatically every check box.

      When manual sampling is selected, click the Update Data button to collect a sample.

Note

  • To perform this procedure, you must be a member of the Administrators group, the Performance Log Users group, or the Performance Monitor Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Related Topics


Monitor a different computer

Microsoft Windows graphic

To monitor a different computer

  1. Open Performance.
  2. Right-click the System Monitor details pane and click Add Counters.
  3. Click Select counters from computer, and in the text box, type the name of the computer that you want to monitor (\\computer_name), or enter the IP address of the computer you want to monitor.
  4. In Performance object, click an object to monitor.
  5. In Select counters from list, click one or more counters, or click All counters to use all counters for that object.
  6. To use all counter instances available when System Monitor is in use, click All instances.

    Or, to use only selected counter instances, click Select instances from list, and select the instances you want to use.

Notes

  • You do not need administrative credentials to simply view counters on a remotely managed computer unless you use Perfmon with the /WMI option. To use the Windows Management Instrumentation (WMI) interface, you must be a member of the Administrators group on the remotely managed computer.
  • To monitor (rather than simply view) counters on remotely managed computers, you must be a member of the Administrators group, the Performance Log Users group, or the Performance Monitor Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • If you select an object on a remote computer, you might notice a short delay as System Monitor refreshes the list to reflect objects present on that computer.
  • If you do not see a counter that you want to monitor, it could be because the service or feature that provides the counter object is not installed or enabled on that computer and you might need to add it before you can monitor related data.

Related Topics


Highlight counter data

Microsoft Windows graphic

To highlight counter data

  1. Open Performance.
  2. In the legend, click the counter you want to highlight.
  3. Click the Highlight button, or press CTRL+H.

Notes

  • XOX
  • XOX
  • When you highlight a counter, a thick line replaces the colored chart line. For white or light-colored backgrounds (defined by the Graph Background property), this line is black; for other backgrounds, this line is white.
  • When using the System Monitor control in an application that supports Active-X controls, note that the CTRL+H combination used for System Monitor highlighting may conflict with the default key settings in the application. You may need to change the default key settings to support highlighting when you use the System Monitor control (Sysmon.ocx in the systemroot\System32 folder) in other applications.

Related Topics


Change from graph view to histogram or report views

Microsoft Windows graphic

To change from graph view to histogram or report views

  1. Open Performance.
  2. On the toolbar, click the View Histogram button to view a histogram or bar graph.

    Click the View Report button to view a report.

Notes

  • XOX
  • XOX
  • You can also change the display by clicking the View Log Data button to open the System Monitor Properties dialog box. Click the General tab, and use the View setting to specify your display preference.
  • Graph view displays counter data over a given time period in line graph format. The histogram view displays counter data in bar chart format, showing only a single value per counter instance. Report view displays counter data in table format, also showing only a single value per counter instance. In report view, counter names and data values appear in rows beneath their associated performance objects, and a separate column displays each instance and its data.
  • For both the histogram and report views, choosing average, minimum, or maximum statistics causes the statistic to be calculated at each sample interval. This incurs some additional performance overhead for realtime data only.

Related Topics


Add titles, grids, and other attributes to a graph

Microsoft Windows graphic

To add titles, grids, and other attributes to a graph

  1. Open Performance.
  2. Right-click the System Monitor details pane and click Properties.
  3. On the Graph tab, specify the graph options you want to use:

    • To change the grid color, use the Appearance tab.
    • To add or remove the legend, statistics, or the toolbar, use the General tab.
    • To change border style or appearance, use the General tab.

Notes

  • XOX
  • XOX

Related Topics


Change background, chart, text, and font properties

Microsoft Windows graphic

To change background, chart, text, and font properties

  1. Open Performance.
  2. Right-click the System Monitor details pane and click Properties.
  3. Click the Appearance tab.
  4. To change the color elements, in Color, select the graph element for which you want to change the color. To change the color used for the selected graph element, click the Change button.

    Or, to change the font used for the text or numbers on your graph, in Font, click the Change button. In Font, set any font options you want. The options include Font, Font style, Size, and Script.

  5. The available elements in Color are:
    • Graph Background. The background color of the window area where counter data is charted.
    • Control Background. The background color that surrounds the window area where data is charted.
    • Text. The text color.
    • Grid. The color used for vertical and horizontal grid lines.
    • Time Bar. The color used for the timer bar.

Notes

  • XOX
  • XOX

Related Topics


Work with data

  • Collect performance data using Microsoft SQL Server
  • Collect performance data using WMI
  • Copy counter data between instances of System Monitor
  • Print performance data
  • Save graph settings as an HTML page
  • Insert the System Monitor control in a Web page
  • Save data to a log file


Collect performance data using Microsoft SQL Server

  • Set up a user account on a SQL server
  • Set up the System Data Source Name (DSN) on each test computer


Set up a user account on a SQL server

Microsoft Windows Graphic

To set up a user account on a SQL server

  1. Open Enterprise Manager.
  2. In the console tree, double-click Microsoft SQL Servers, click SQL Server Group, and then SQLComputerName (Windows NT).
  3. Double-click Databases, and then double-click your database of choice.
  4. Right-click Users, and then click the New Database User menu.
  5. Next to Login name, type:

    6. domain\username

  6. Next to User name, type your user name.
  7. Select the Public check box, and then select all of the following objects:
    • db_owner
    • db_accessadmin
    • db_securityadmin
    • db_ddladmin
    • db_datareader
    • db_datawriter
    • db_backupoperator

    Important

    • Do not select db_denydatareader or db_denydatawriter. These objects allow members to deny Read or Write permissions to data in the database.

Notes

  • To open Enterprise Manager, click Start, point to Programs, click Microsoft SQL Server, and then click Enterprise Manager.
  • Before you begin, confirm that a domain and your administrative credentials are set up:
    • You have permissions to read from and write to the SQL Server database.
    • Your user name has administrative credentials on each of the above computers; you will use it to log on at all times.
    • This is a quick start procedure only. Consult your Microsoft SQL Server documentation for detailed instructions on setting up and configuring a SQL database.
    • Windows Server 2003 family, not Microsoft SQL Server, authentication is used when you connect to a SQL server for performance monitoring purposes.

Related Topics


Set up the System Data Source Name (DSN) on each test computer

Microsoft Windows Graphic

To set up the System Data Source Name (DSN) on each test computer

  1. Open ODBC Data Source Administrator.
  2. Click the SystemDSN tab.
  3. Click Add.
  4. In the Create New Data Source wizard, click SQL Server, and then Finish.
  5. In the Create a New Data Source to SQL Server dialog box, fill in the Name and Description text boxes. In the Server box, type or select the name of the computer.

    6. Important

    • If you previously configured an ODBC data source for the same SQL server, a dialog box may appear which reads, "A new data source will be created with the following configuration." Click Finish if you do not want to change databases. Otherwise, follow steps 6 through 9.
  6. Click Next to accept the following default settings:
    • With Windows NT authentication using the network login ID.
    • Connect to SQL Server to obtain default settings for the additional configuration options.
  7. Click Next a second time to accept the following default settings:
    • Use ANSI quoted identifiers.
    • Use ANSI nulls, paddings and warnings.

    Important

    • The Change the default database to check box should be cleared. If, when setting up a user account, you selected a database other than master, you should now select the Change the default database to check box, and then click that database in the list.
  8. Click Finish to accept the default setting, Perform translation for character data.
  9. In the ODBC Microsoft SQL Server Setup dialog box, click Test Data Source, and verify that the "Tests completed successfully!" message appears.

Notes

  • Before you begin, confirm that your computer is connected to the domain, and that you are logged into the domain as a user. See Related Topics for more information.
  • XOX

Related Topics


Collect performance data using WMI

Microsoft Windows graphic

To collect performance data using WMI

  • Open Command Prompt and type:

  • perfmon.exe /wmi

Notes

  • To perform this procedure, you must be a member of the Administrators group, the Performance Log Users group, or the Performance Monitor Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • When this option is specified, the program obtains performance data by means of Windows Management Instrumentation (WMI) instead of the registry. WMI Hi-Perf providers can then expose performance counters, which in turn appear in System Monitor or are logged by the Performance Logs and Alerts Service. For XOX and the Windows Server 2003 family, all WMI counters now appear through the use of a reverse adapter regardless of whether you use the /wmi option.

Related Topics


Copy counter data between instances of System Monitor

Microsoft Windows graphic

To copy counter data between instances of System Monitor

  1. Open Performance.
  2. In the System Monitor details pane, click the Copy Properties button on the toolbar.
  3. Open another instance of System Monitor and click the Paste Counter List button on the toolbar to load the counter path data from the Clipboard into the current window.

Notes

  • XOX
  • XOX

Related Topics


Print performance data

Microsoft Windows graphic

To print performance data

  1. Open Performance.
  2. Press ALT+PRINT SCREEN to copy a view of the active window.
  3. XOX
  4. On the Edit menu, click Paste.

    If prompted with the alert message ”The image in the Clipboard is larger than the bitmap. Would you like the bitmap enlarged?”, click Yes.

  5. On the File menu, click Print.

Notes

  • XOX
  • XOX
  • For the best quality prints, choose one of the following options:
    • Add the System Monitor control to a Microsoft Office application such as Microsoft Word or Microsoft Excel and print from that program.
    • Save the System Monitor control data as an HTML file and print it from Internet Explorer or another program using Save As.
    • Import a log file in comma-separated (.csv) or tab-separated (.tsv) format into a Microsoft Excel spreadsheet and print from that application.

Related Topics


Save graph settings as an HTML page

Microsoft Windows graphic

To save graph settings as an HTML page

  1. Open Performance.
  2. Add counters to a graph.
  3. Right-click the displayed graph, and click Save As.
  4. In the Save As dialog box, select a path and type the name of the new HTML file.

Notes

  • XOX
  • XOX
  • The System Monitor configuration is saved to the HTML file, including View type (graph, histogram, report), graph title, and so on.
  • You can apply the counter settings that are saved as an HTML file by dragging the HTML file from Windows Explorer onto a System Monitor graph.
  • You can print a static System Monitor graph by opening the HTML file in a browser. The graph will display the data at the time the HTML file was saved. If you click on the graph, it will become live.
  • You can use the Copy Properties button in the toolbar to transfer all System Monitor settings to the Windows Clipboard as a System Monitor HTML object. You can paste this HTML object into any HTML page.
  • Use the Paste Counter List button on the toolbar (or drag and drop) to transfer the counter settings from the saved System Monitor object configuration in the Clipboard or HTML file to the System Monitor.

Related Topics


Insert the System Monitor control in a Web page

Microsoft Windows graphic

To insert the System Monitor control in a Web page

  1. Open Performance.
  2. In the System Monitor toolbar, click the Copy Properties button.
  3. Open your Web page in Notepad or a different text editor.
  4. Insert the cursor at the point you want the control to appear, right-click, and select Paste.

Notes

  • XOX
  • XOX
  • When you open your Web page in the browser, the System Monitor graph will appear static. It represents the performance data as it appeared the moment you copied the graph. To monitor performance in real time, go to the toolbar and click the Freeze Display button.

Related Topics


Save data to a log file

Microsoft Windows graphic

To save data to a log file

  1. Open Performance.
  2. Right-click the System Monitor details pane and click Save Data As.
  3. Type the name of the saved log file and select the format.
  4. Enter the data filter (value n) for the saved log file in Reduce log file size by only writing one out of every n original log records.

    By default, n is set to 1, and the saved log file contains the same number of data points as the original log file.

  5. Click Save.

Notes

  • To perform this task, you do not need administrative credentials on the local computer.
  • XOX
  • To select a log file or a SQL server as the data source, see Related Topics.
  • The Save Data As feature only works on log files and not on real-time data.
  • Only the counters that are currently loaded from the log and are displayed in the current view will be relogged, or resampled.
  • Although the extension for a log file is .blg, the file format is changed in the Windows Server 2003 family and therefore cannot be read on an earlier version of the operating system. For example, if you copy a binary file from XOX, to Windows 2000, you will be unable to read it on the latter system.

Related Topics


Work with settings

  • Save a monitoring console
  • Save log or alert settings as an HTML page
  • Create a custom monitoring console
  • Use a Windows NT Server 4.0 Performance Monitor settings file


Save a monitoring console

Microsoft Windows graphic

To save a monitoring console

  1. Open Performance.
  2. Using System Monitor or a tool under Performance Logs and Alerts, configure the tool with the settings you want.
  3. On the File menu, click Save As, and then type the name you want for this console. The default directory for storing this file is System32 on the root volume.
  4. Click Save.

Notes

  • To perform this procedure, you must be a member of the Administrators group, or the Performance Log Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • Only modifications to the System Monitor are saved.

Related Topics


Save log or alert settings as an HTML page

Microsoft Windows graphic

To save log or alert settings as an HTML page

  1. Open Performance.
  2. Create a log or an alert.
  3. In the details pane, right-click the name of the log or the alert and click Save Settings As. By default, the settings are saved in the user's personal default directory; this is typically My Documents.

Notes

  • To perform this procedure, you must be a member of the Administrators group, or the Performance Log Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • As a security precaution, the RunAs user name and password are not copied to the HTML file when you save a log or alert configuration to it.
  • A second security feature is that you can use this HTML settings file to create a new log or alert, not to modify the settings of an existing log or alert. In the existing log or alert file, right-click the details pane, and click New Log Settings From or New Alert Settings From. This is an easy way to generate log settings from an alert configuration.
  • For counter logs and alerts, you can open the HTML page in a browser, displaying a System Monitor object. The System Monitor object will specify the current log file as the data source.

    Or, you can drag the HTML file and drop it on a System Monitor object. In this case, the counters specified in the HTML file will be added to the System Monitor display.

Related Topics


Create a custom monitoring console

Microsoft Windows graphic

To create a custom monitoring console

  1. Open Microsoft Management Console (MMC).
  2. On the File menu, click Add/Remove Snap-in.
  3. On the Standalone tab, click Add.
  4. In the snap-in list, click ActiveX Control, and then click Add.
  5. In the Insert ActiveX Control wizard, click Next.

    There is a short delay before the next dialog box appears; this is normal.

  6. In Control category, click All Categories.
  7. In Control type, click System Monitor Control.
  8. Click Next.

    The System Monitor control provides the functionality of System Monitor.

  9. In Select a name for the ActiveX control, type a name for the control, and then click Finish.

Notes

  • To open MMC, click Start, click Run, and then type mmc.
  • Creating a custom console is useful if you want to have System Monitor hosted in the same console with Event Viewer or another tool.

Related Topics


Use a Windows NT Server 4.0 Performance Monitor settings file

Microsoft Windows graphic

To use a Windows NT Server 4.0 Performance Monitor settings file

  • At a command prompt, type

    perfmon.exe file_name

    where file_name is the name of the settings file you want to use.

Notes

  • This procedure will open a Performance console configured with the settings from the Windows NT Server 4.0 version of Performance Monitor settings file.
  • This procedure works for the following types of Windows NT Server 4.0 version of Performance Monitor settings files: chart (.pmc), report (.pmr), alert (.pma), and log (.pml). Workspace (.pmw) files that were created with Windows NT Server 4.0 version of Performance Monitor are not fully compatible with System Monitor. Only one of the views previously saved in the workspace will be available in System Monitor.
  • To display the Windows NT Server 4.0 settings file in System Monitor, the system temporarily converts the file for use with System Monitor but discards the converted version after the console starts. If you want to save the settings file for permanent use with System Monitor, type the following command:

    perfmon.exe /HTMLFILE:converted_file settings_file

    where converted_file is the name you are giving to the converted file and settings_file is the name of the original Windows NT Server 4.0 settings file.

Related Topics


Create and configure counter logs

  • Create a counter log
  • Add objects to a log
  • Add counters to a log
  • Get details about objects and counters
  • Set parameters for a log


Create a counter log

Microsoft Windows graphic

To create a counter log

Using the Windows interface

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Counter Logs.

    3. Any existing counter logs will be listed in the details pane. A green icon indicates that a log is running; a red icon indicates that a log has stopped.

  3. Right-click a blank area of the details pane, and click New Log Settings.
  4. In Name, type the name of the counter log, and then click OK.
  5. On the General tab, click Add Objects and select the performance objects you want to add, or click Add Counters to select the individual counters you want to log.
    • You must use the Run as text box and Password button to collect counter data from a remotely managed computer. These features enable you to specify the logon account name for the log. You can access them from the General tab.
  6. If you want to change the default file and schedule information, make the changes on the Log Files tab and the Schedule tab.

Notes

  • To perform this procedure, you must be a member of the Administrators group, or the Performance Log Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • To save the settings for a counter log, trace log, or alert, right-click the log or alert in the details pane and click Save Settings As. You can then specify an .htm file in which to save the settings. To reuse the saved settings for a new log or alert, right-click the details pane, and then click New Log Settings From or New Alert Settings From. This is an easy way to generate new settings from a log or alert configuration. You can also open the HTML file in Internet Explorer to display a System Monitor graph.
  • Although the extension for a log file is .blg, the file format is changed in the Windows Server 2003 family and therefore cannot be read on an earlier version of the operating system. For example, if you copy a binary file from XOX, to Windows 2000, you will be unable to read it on the latter system.

Using a command line

  1. Open Command Prompt
  2. Type:

    logman create counter collection_name –c {path [path...]} | {–cf filename}

Value | Description
create counter collection_name | Creates a counter collection query named collection_name.
–c {path [path...]} | –cf {filename} | Specifies the performance counter path to log (path), or specifies the path name of the log file that lists these counters (–cf filename). To list multiple counter paths, separate the command line by a space, or use the -cf option to list counter paths in an input file, one per line. Use this format [\\computer]\object[instance]\counter] for each counter path where: Computer is the optional computer name or the IP address of a remote computer. If a computer name is not supplied, the local computer will be used by default. Object is the performance counter object (process or memory). Instance (if any) is the performance object (process). Counter is the performance counter for the object (processor time).
For example, to create a collection query named perf_log to collect Total % Processor Time counter data, type:

logman create counter perf_log –c "\Processor(_Total)\% Processor Time"

Notes

  • To perform this procedure, you must be a member of the Administrators group, or the Performance Log Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    logman /?

Related Topics


Add objects to a log

Microsoft Windows graphic

To add objects to a log

Using the Windows interface

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then double-click Counter Logs or Alerts.
  3. In the details pane, double-click the log or alert you want to modify.
  4. On the General tab, click Add Objects. For each object that you want to add to the log, perform the following steps:
    • To log objects from the computer on which the Performance Logs and Alerts service will run, click Use local computer counter objects.

      Or, to log objects from a specific computer regardless of where the service is run, click Select counter objects from computer: and specify the Universal Naming Convention (UNC) name, such as \\MyLogServer, of the computer you want to monitor.

    • In Performance object, click an object to monitor, and then click Add.

Notes

  • To perform this procedure, you must be a member of the Administrators group, or the Performance Log Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • When creating counter log settings for export, make sure to select Use local computer counter objects. Otherwise, counter logs will obtain data from the computer named in the text box.
  • For a description of an object, click the object in Performance counters and then click Explain.
  • When you specify the name of a remote computer using Select counter objects from computer, only the name of the local computer and those computer names entered during the current Performance session are listed. Computer names entered in previous sessions will not be listed.
  • The Run as feature enables you to run log collections under different accounts. For example, if you need to log data from a remote computer that requires administrative credentials, you can use the feature to specify an account with the necessary permissions.

Using a command line

  1. Open Command Prompt
  2. Type:

    logman update collection_name –c {path [path...]} | {–cf filename}

Value | Description
update collection_name | Updates the collection query named collection_name. For counter collections, modifications to the query will stop, and then restart the collections.
–c {path [path...]} | –cf {filename} | Specifies the performance object path to log (path), or specifies the path name of the log file that lists these objects (–cf filename). To list multiple object paths, separate the command line by a space, or use the -cf option to list object paths in an input file, one per line. Use this format [\\computer\object] for each object path where: Computer is the optional computer name or the IP address of a remote computer. If a computer name is not supplied, the local computer will be used by default.< /P> Object is the performance counter object (process or memory).
For example, to add the PhysicalDisk object to the collection query named perf_log on computer \\COMP1, type:

logman update perf_log –c "\\COMP1\PhysicalDisk(*)\*"

Notes

  • To perform this procedure, you must be a member of the Administrators group, or the Performance Log Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    logman /?

Related Topics


Add counters to a log

Microsoft Windows graphic

To add counters to a log

Using the Windows interface

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Counter Logs.
  3. In the details pane, double-click the log you want to modify.
  4. On the General tab, click Add Counters. For each counter or group of counters that you want to add to the log, perform the following steps:
    • To log counters from the computer on which the Performance Logs and Alerts service will run, click Use local computer counters.

      Or, to log counters from a specific computer regardless of where the service is run, click Select counters from computer and specify the Universal Naming Convention (UNC) name, such as \\MyLogServer, of the computer you want to monitor.

    • In Performance object, select an object to monitor.
    • In Select counters from list, click one or more counters to monitor.
    • To monitor all instances of the selected counters, click All Instances. (Binary logs can include instances that are not available at log startup but subsequently become available.)

      Or, to monitor particular instances of the selected counters, click Select Instances From List, and then click an instance or instances to monitor.

    • Click Add.

Notes

  • To perform this procedure, you must be a member of the Administrators group, or the Performance Log Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • When creating a monitoring console for export, make sure to select Use local computer counters. Otherwise, counter logs will obtain data from the computer named in the text box, regardless of where the console file is installed.
  • For a description of a counter, click the counter in Performance counters and then click Explain.
  • Some object types have several instances. For example, if a system has multiple processors, the Processor object type will have multiple instances. The PhysicalDisk object type has two instances if a system has two disks. Some object types, such as Memory and Server, have only a single instance. If an object type has multiple instances, you can add counters to track statistics for each instance, or in many cases, for all instances at once. By default, counters are shown with both the instance name and an instance index. To turn off this feature, right-click the System Monitor graph, click Properties, and click the General tab.
  • When you specify the name of a remote computer using Select counters from computer, only the name of the local computer and those computer names entered during the current Performance session are listed. Computer names entered in previous sessions will not be listed.

Using a command line

  1. Open Command Prompt
  2. Type:

    logman update collection_name –c {path [path...]} | {–cf filename}

Value | Description
update collection_name | Updates the collection query named collection_name. For counter collections, modifications to the query will stop, and then restart the collections.
–c {path [path...]} |
–cf {filename} 		Specifies the performance counter path to log (path), or specifies the path name of the log file that lists these counters (–cf filename). To list multiple counter paths, separate the command line by a space, or use the -cf option to list counter paths in an input file, one per line. Use this format [\\computer]\object[instance]\counter] for each counter path where:

Computer is the optional computer name or the IP address of a remote computer. If a computer name is not supplied, the local computer will be used by default.

Object is the performance counter object (process or memory).

Instance (if any) is the performance object (process).

Counter is the performance counter for the object (processor time).

Note

  • An asterisk (*) can be used as a wild card when specifying the counter path. For example, to specify all instances of the % Processor Time, use "\Processor(*)\% Processor Time".
For example, to add all instances of the % Interrupt Time to the collection query named perf_log on computer \\COMP1, type:

logman update perf_log –c "\\COMP1\Processor(*)\% Interrupt Time"

Notes

  • To perform this procedure, you must be a member of the Administrators group, or the Performance Log Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    logman /?

Related Topics


Get details about objects and counters

Microsoft Windows graphic

To get details about objects and counters

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Counter Logs.
  3. In the details pane, double-click the counter log.
  4. Click the Add Objects button to open the Add Objects dialog box or click the Add Counters button to open the Add Counters dialog box.
  5. In the Add Objects dialog box, select Performance objects, click an object, then click Explain.
  6. In the Add Counters dialog box, select Performance object, click an object, and in Performance counters, click a counter and then click Explain.

Notes

  • XOX
  • Clicking Explain opens a pop-up window that contains information about the selected object or counter. For more information on counters, including detailed descriptions of how each counter is calculated and guidelines on using counters to diagnose performance problems, see the Performance Counter Help Reference at the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/)

Related Topics


Set parameters for a log

Microsoft Windows graphic

To set parameters for a log

Using the Windows interface

  1. Open Performance.
  2. Double-click Performance Logs and Alerts.
  3. To set parameters for a counter log, double-click Counter Logs.

    Or, to set parameters for a trace log, double-click Trace Logs.

  4. In the details pane, double-click the log.
  5. On the Log Files tab, complete the following options:
    • Log file type. In the list, select the format you want for this log file, complete the options, and then click the Configure button. See "Quick reference to log file formats" under Related Topics for more information.
    • End file names with. Select this and choose the suffix style you want from the list. Use End file names with to distinguish between individual log files with the same log file name that are in a group of logs that have been automatically generated.
    • Start numbering at. Set this to the start number for automatic file numbering, when you select nnnnnn as the End file names with.
    • Comment. If appropriate, type a comment or description for the log file.
    • Configure. Select the configuration parameters using the following options for either Configure Log Files or Configure SQL Logs, based on the log file type selected from the drop-down menu.
      Option | Description | Applies to
      Location | Type the name of the folder where you want the log file created, or click Browse to search for the folder. | Configure Log Files
      File name | Type a partial or base name for the log file. You can use File name in conjunction with End file names with if appropriate. | Configure Log Files
      Repository name | Select the System DSN (Data Source Name) from the drop-down list, and then type the Log set name. The Log set name will be stored in the database within the System DSN. | Configure SQL Logs
  6. Log file size. Decide, using the following options, whether or not you want to limit the size of the log file.
  7. Or, under Log set size. Decide, using the following options, whether or not you want to limit the size of the log set.
    • Maximum limit. When you select this option, data is continuously collected in a log file until it reaches limits set by disk quotas or the operating system. (For SQL logs, data is collected in a database until it reaches its limits set by the number of records written.)
    • Limit of. To define a size limit for the log file, specify the size. For counter and trace logs, specify the maximum size in megabytes. For SQL logs, specify the maximum size in records.

Notes

  • To perform this procedure, you must be a member of the Administrators group, or the Performance Log Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • If you choose to allow the log file to grow to its maximum size, consider the available space on your disk and any quotas that may be in effect. An error might occur if you run out of disk space due to logging. The Log file size option works in conjunction with the When the log file is full option on the Schedule tab.
  • When you select a log file limit or log set size limit, the stop option When the log file is full reflects the size limit typed here.
  • The File name can identify a group of log files with similar parameters.
  • The End file names with suffix can be a numeric sequence or a character string indicating the date and time the log was started. For example, you might define the File name "DailyLog" and the Performance Logs and Alerts service would append the date as a suffix for each file so that you might have a series of files named as follows: DailyLog_19990715, DailyLog_19990716, for each day the log is run.
  • The comment text and the file name appear in the details pane in the Performance Logs and Alerts console window.
  • Sequential counter or trace log files can grow to a size larger than the maximum file size specified by the user. This can occur for different reasons, depending on the type of log configured. For counter logs, the log service postpones checking the log's file size until after it has collected the last data sample, at which point the file size might already have exceeded the defined limit. For trace logs, the log service writes additional buffers to the log when the log service stops, which can cause the final log file size to be slightly larger than the defined limit.

Using a command line

  1. Open Command Prompt
  2. Type the appropriate command below:
Command | Action
logman update collection_name -f {bin | bincirc | csv | tsv | SQL} | Defines the log file format.
logman update collection_name –v {nnnnn | mmddhhmm} | Specify the file suffix.
logman update collection_name –v nnnnn | Set the automatic file numbering start number.
logman update collection_name –o path | Specify the location of the log file.
logman update collection_name –o DSN!counter_log | Specify the location of the SQL database and log set where output data will be written.
Value | Description
update collection_name | Updates the collection query named collection_name. For counter collections, modifications to the query will stop, and then restart the collections.
-f bin | bincirc | csv | tsv | SQL Specifies the file format used for collecting performance counter and trace data. You can use binary (bin), circular binary (circbin), comma (csv) and tab (tsv) separated, or SQL database (SQL) formats when collecting performance counters.

Note

  • For SQL database formats, you must use the -o option in the command line with the DNS!counter_log option, the System Database System Name (System DSN) must be predefined, and you must have Write permissions to the database. The log set counter_log is created in the database, and is specified by the DSN.
If a file format is not specified, it defaults to binary.
–v nnnnn | mmddhhmm | Attaches the version control information to the end of the output file and path name. Use numeric nnnnn format, or date format mmddhhmm (month, day, 24-hour, minute) for version control.
–o path | Specifies the path name of the output file that collects performance counter or trace data. By default, the collection log file name is the collection query name suffixed by either .blg for performance counters, or .etl for trace data.
–o DSN!counter_log | Specifies the location of the SQL database and log set.
For example, to specify that the output for counter collection perf_log be written to a SQL log set named daily_log in the perfdb database, type:

Logman update perf_log –f sql –o perfdb!daily_log

Notes

  • To perform this procedure, you must be a member of the Administrators group, or the Performance Log Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    logman /?

Related Topics


Create and configure trace logs

  • Create a trace log
  • Select trace providers and events
  • Define trace log buffers


Create a trace log

Microsoft Windows graphic

To create a trace log

Using the Windows interface

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Trace Logs.

    Any existing trace logs will be listed in the details pane. A green icon indicates that a log is running; a red icon indicates that a log has stopped.

  3. Right-click a blank area of the details pane, and click New Log Settings.
  4. In Name, type the name of the trace log, and then click OK.

    By default, the log file is created in the PerfLogs folder in the root directory on your system drive, a sequence number is appended to the file name you entered, and the sequential trace file type with the .etl extension. Use the Log Files and Advanced tabs to modify these parameters or define other parameters for your log. To define providers and events to log, use the General tab. To specify when you want logging to occur, use the Schedule tab.

Notes

  • To perform this procedure, you must be a member of the Administrators group, or the Performance Log Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • To save the settings for a counter log, trace log, or alert, right-click the log or alert in the details pane and click Save Settings As. You can then specify an .htm file in which to save the settings. To reuse the saved settings for a new log or alert, right-click the details pane, and then click New Log Settings From or New Alert Settings From. This is an easy way to generate new settings from a log or alert configuration. You can also open the HTML file in Internet Explorer to display a System Monitor graph.

Using a command line

  1. Open Command Prompt.
  2. To create a trace log type:

    Logman create trace collection_name

Value | Description
create trace | Creates a trace log collection query.
collection_name | Specifies the name of the collection query.

For example, to create a trace log collection query named perf_log, type:

logman create trace perf_log

Once the collection query is created, providers then need to be enabled.

Notes

  • To perform this procedure, you must be a member of the Administrators group, or the Performance Log Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    Logman /?

Related Topics


Select trace log providers and events

Microsoft Windows graphic

To select trace log providers and events

Using the Windows interface

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Trace Logs.
  3. In the details pane, double-click the log.
  4. For a list of the installed providers and their status (enabled or not), click Provider Status.

    Only one instance of each trace provider can be enabled at any given time.

    By default, the Nonsystem providers option is selected to keep trade logging overhead to a minimum.

  5. If you click Events logged by system provider, a default provider (the Windows kernel trace provider) is used to monitor processes, threads, and other activity. To define events for logging, click the check boxes as appropriate.
  6. If you click Nonsystem providers, you can select the data providers you want—for example, if you have written your own providers. Use the Add or Remove buttons as needed.

Notes

  • XOX
  • Trace logging of file details and page faults can generate an extremely large amount of data. It is recommended that you limit trace logging using the file details and page fault options to a maximum of two hours.
  • The Windows kernel trace provider and some other providers require you to run the collection under the authority of an account with administrative credentials. By default, the service runs under the NT Authority\NetworkService account. Use the Run as text box to specify an administrator account to do this.

Using a command line

  1. Open Command Prompt.
  2. Type the appropriate command below:
Action | Command
To view each installed provider and its status. | logman query providers
To specify that data collected by the system trace provider is logged. | logman update collection_name -P "Windows kernel trace" (process, thread, disk, net, page, file)
To specify that data collected by a provider other than the Windows kernel trace provider is logged. | logman update collection_name -P provider
Value | Description
query providers | Queries the providers installed on the local system.
update collection_name | Updates the collection query named collection_name.
-P "Windows kernel trace" (process, thread, disk, net, page, file) | Specifies "Windows kernEl trace" as the provider that collects data for the trace log. Process, thread, disk, net, pf, hf, registry, image, and file are optional events to include in the trace log. Use process to include data on the creating and ending processes. Use thread to include data on the creating and ending threads. Use disk to include data on disk input/output operations. Use net to include data on TCP/IP send or receive requests. Use pf to enable soft page fault tracing. Use hf to enable hard page fault tracing. Use registry to include data on registry operations. Use image to include data on the program name for the loaded process. Use file to include file I/O data.
-P provider | Specifies the non-system provider that collects data for the trace log.

For example, to specify that a provider named Nonsystem01 is used to collect data for a trace log named perf_log, type:

logman update perf_log -P Nonsystem01

Notes

  • The Windows kernel trace provider and some other providers require you to run the collection under the authority of an account with administrative credentials. By default, the service runs under the NT Authority\NetworkService account. Use the -u option to specify an account with administrative credentials.
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    logman /?

Related Topics


Define trace log buffers

Microsoft Windows Graphic

To define trace log buffers

Using the Windows interface

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and click Trace Logs.
  3. In the details pane, double-click the log, and click the Advanced tab on the dialog box that appears.
  4. In Buffer size, specify the size of the buffer you want to use in kilobytes for trace data collection.
  5. In Minimum, specify the smallest number of buffers you want to use for trace data.
  6. In Maximum, specify the largest number of buffers you want to use for trace data.
  7. To have the trace provider periodically flush the buffers, select the Transfer data from buffers to log file at least every check box and specify the transfer interval in seconds.

Note

  • XOX

Using a command line

  1. Open Command Prompt.
  2. Type:

    logman update collection_name –bs {value} –nb {min max} –ft [[hh:]mm:]ss

Value | Description
update collection_name | Updates the collection query named collection_name.
–bs {value} | Specifies the buffer size in n kilobytes for the trace log.
–nb {min max} | Specifies the minimum and maximum number of buffers for the trace log.
–ft [[hh:]mm:]ss | Specifies whether the buffer will be flushed and the interval at which the buffer will be flushed.

For example, to specify a buffer size of 128 kilobytes, a minimum of 10 buffers, and a maximum of 25 buffers for a trace log named perf_log, type:

logman update perf_log –bs 128 –nb 10 25

Notes

  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    logman /?

Related Topics


Create and configure alerts

  • Create an alert
  • Define counters and thresholds for an alert
  • Define actions for an alert


Create an alert

Microsoft Windows graphic

To create an alert

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Alerts.

    Any existing alerts will be listed in the details pane. A green icon indicates that an alert is running; a red icon indicates that an alert has stopped.

  3. Right-click a blank area of the details pane and click New Alert Settings.
  4. In Name, type the name of the alert, and then click OK.
  5. To define a comment for your alert, along with counters, alert thresholds, and a sample interval, use the General tab.

    To define actions that should occur when counter data triggers an alert, use the Action tab. To define when the service should begin scanning for alerts, use the Schedule tab.

Notes

  • To perform this procedure, you must be a member of the Administrators group, or the Performance Log Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • To save the settings for a counter log, trace log, or alert, right-click the log or alert in the details pane and click Save Settings As. You can then specify an .htm file in which to save the settings. To reuse the saved settings for a new log or alert, right-click the details pane, and then click New Log Settings From or New Alert Settings From. This is an easy way to generate new settings from a log or alert configuration. You can also open the HTML file in Internet Explorer to display a System Monitor graph.

Related Topics


Define counters and thresholds for an alert

Microsoft Windows graphic

To define counters and thresholds for an alert

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Alerts.
  3. In the details pane, double-click the alert.
  4. In Comment, type a comment to describe the alert as needed, and click Add.
  5. For each counter or group of counters that you want to add to the log, perform the following steps:
    1. To monitor counters from the computer on which the Performance Logs and Alerts service will run, click Use local computer counters.

      Or, to monitor counters from a specific computer regardless of where the service is run, click Select counters from computer and type the Universal Naming Convention (UNC) name, such as \\MyLogServer, of the computer you want to monitor in the text box.

    2. In Performance object, click an object to monitor.
    3. In Select counters from list, click one or more counters to monitor.
    4. To monitor all instances of the selected counters, click All Instances. (Binary logs can include instances that are not available at log startup but subsequently become available.)

      Or, to monitor particular instances of the selected counters, click Select Instances From List, and then click an instance or instances to monitor.

    5. Click Add.
  6. In Alert when the value is, specify Under or Over, and in Limit, specify the value that triggers the alert. Perform this step for each counter or group of counters that you added to the log.
  7. In Sample data every, specify the amount and the unit of measure for the update interval.
  8. Complete the alert configuration using the Action and Schedule tabs.

Notes

  • To perform this procedure, you must be a member of the Administrators group or the Performance Log Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • You can add a counter to an alert multiple times, and specify different thresholds for each instance.
  • To save the settings for a counter log, trace log, or alert, right-click the log or alert in the details pane and click Save Settings As. You can then specify an .htm file in which to save the settings. To reuse the saved settings for a new log or alert, right-click the details pane, and then click New Log Settings From or New Alert Settings From. This is an easy way to generate new settings from a log or alert configuration. You can also open the HTML file in Internet Explorer to display a System Monitor graph.
  • Some object types have several instances. For example, if a system has multiple processors, the Processor object type will have multiple instances. The PhysicalDisk object type has two instances if a system has two disks. Some object types, such as Memory and Server, have only a single instance. If an object type has multiple instances, you can add counters to track statistics for each instance, or in many cases, for all instances at once.

Related Topics


Define actions for an alert

Microsoft Windows graphic

To define actions for an alert

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Alerts.
  3. In the details pane, double-click the alert.
  4. Click the Action tab.
  5. To have Performance Logs and Alerts create an entry visible in Event Viewer, select Log an entry in the application event log. This option is selected by default.
  6. To have Performance Logs and Alerts trigger the Messenger service to send a message, select Send a network message to and type the IP address or name of the computer on which the alert message should be displayed.
  7. To run a counter log when an alert occurs, select Start performance data log and specify the counter log you want to run.
  8. To have a program run when an alert occurs, select Run this program and type the file path and name, or click Browse to locate the file. Click Command Line Arguments and select the appropriate check boxes for arguments to include when the program is run.

Notes

  • To perform this procedure, you must be a member of the Administrators group or the Performance Log Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

    • Important

    • Note the security implications running an interactive program: When an alert stops, it will run the program on the desktop. If you schedule a collection to run on a system that other users have access to under an account with administrative credentials, then the program will appear on the desktop under the authentication of the administrator account, possibly when other users are logged onto the system.
  • XOX
  • When you select Run this program, by default, the program runs in the background.
  • When an alert occurs, the service creates a process and runs the specified executable or command file. The service also copies any command line arguments that you define to run the file to the command line.

    • XOX

    Related Topics


Work with logs and alerts

  • Start or stop a counter log, trace log, or alert manually
  • Remove counters from a log or alert
  • View or change properties of a log or alert
  • Define start or stop parameters for a log or alert
  • Delete a log or alert


Start or stop a counter log, trace log, or alert manually

Microsoft Windows graphic

To start or stop a counter log, trace log, or alert manually

Using the Windows interface

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and click Counter Logs, Trace Logs, or Alerts.
  3. In the details pane, right-click the name of the log or alert you want to start or stop, and click Start to begin the logging or alert activity you defined, or click Stop to terminate the activity.

    Or, click the Start or Stop buttons in the toolbar.

Notes

  • To perform this procedure, you must be a member of the Administrators group, or the Performance Log Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • There might be a slight delay before the log or alert starts or stops, indicated when the icon changes color (from green for started to red for stopped, and vice versa). This delay might reflect the startup time for a service or the fact that you have added many counters. If a log or alert does not start, you can view the Application Log for errors.

Using a command line

  1. Open Command Prompt
  2. Type:

    logman start collection_name

    or

    logman stop collection_name

Value | Description
start collection_name | Starts the data collection query collection_name. Use this option to change from scheduled collections to manual ones. Use the update parameter in the command line with begin-time (–b), end-time (–e), or repeat-time (–rt) to reschedule collections.
stop collection_name | Stops the data collection query collection_name. Use this option to change from scheduled collections to manual ones. Use the update parameter in the command line with begin-time (–b), end-time (–e), or repeat-time (–rt) to reschedule collections.
For example, to stop the collection query named perf_log, type:

logman stop perf_log

Notes

  • To perform this procedure, you must be a member of the Administrators group, or the Performance Log Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    logman /?

Related Topics


Remove counters from a log or alert

Microsoft Windows graphic

To remove counters from a log or alert

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Counter Logs or Alerts.
  3. In the details pane, double-click the name of the log or alert.
  4. Under Counters, click the counter you want to remove, and then click Remove.

Notes

  • To perform this procedure, you must be a member of the Administrators group or the Performance Log Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX

Related Topics


View or change properties of a log or alert

Microsoft Windows Graphic

To view or change properties of a log or alert

Using the Windows interface

  1. Open Performance.
  2. Double-click Performance Logs and Alerts.
  3. Click Counter Logs, Trace Logs, or Alerts.
  4. In the details pane, double-click the name of the log or alert.
  5. View or change the log properties as needed.

Notes

  • To perform this procedure, you must be a member of the Administrators group, or the Performance Log Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • To start or stop a log or alert, right-click its name in the details pane, and click Start or Stop as appropriate. This overrides any scheduled start and stop settings, resetting the start and stop mode to manual.

Using a command line

  1. Open Command Prompt.
  2. Type the appropriate command below:
Action | Command
To update counter log counters and the update interval. | logman update collection_name –c {path [path...]} | –cf {filename} –si [[hh:]mm:]ss
To update a counter log collection, file type, file size limits, path and name, and automatic naming parameters. | logman update collection_name –f {bin | bincirc | csv | tsv | SQL} –max value –o path –v {nnnnn | mmddhhmm}
To update manual to automated start and stop methods and schedule. | logman update collection_name –b M/d/I h:mm:ss [AM | PM] –e M/d/yyyy h:mm:ss [AM | PM] –r
To update trace log providers and events to log. | logman update collection_name –p provider
To update a trace log collection, file type, file size limits, path name, and automatic naming parameters. | logman update collection_name –f {bin | bincirc} –max value –o path –v {nnnnn | mmddhhmm}
To update a trace log's buffer size, limits, and transfer interval. | logman update collection_name –bs {value} –nb {min max} –ft [[hh:]mm:]ss
Value | Description
update collection_name | Updates the collection query named collection_name. For counter collections, modifications to the query will stop, and then restart the collections.
–c {path [path...]} | –cf {filename} | Specifies the performance counter path to log (path), or specifies the path name of the log file that lists these counters (–cf filename). To list multiple counter paths, separate the command line by a space, or use the -cf option to list counter paths in an input file, one per line. Use this format [\\computer]\object[instance]\counter] for each counter path where: Computer is the optional computer name or the IP address of a remote computer. If a computer name is not supplied, the local computer will be used by default. Object is the performance counter object (process or memory). Instance (if any) is the performance object (process). Counter is the performance counter for the object (processor time).
–si [[hh:]mm:]ss | Specifies the update interval for counter collection in hours, minutes, and seconds.
-f bin | bincirc | csv | tsv | SQL | Specifies the file format used for collecting performance counter and trace data. You can use binary (bin), circular binary (circbin), comma (csv) and tab (tsv) separated, or SQL database (SQL) formats when collecting performance counters. If a file format is not specified, it defaults to binary. Binary (bin) and circular binary (circbin) are the only types supported for trace collections.
–max {value} | Specifies the maximum size of the collected log file in megabytes. If the log file exceeds the maximum size, the collection will stop. For a SQL database, the maximum size is the number of records to be written.
–o path | Specifies the path name of the output file that collects performance counter or trace data. By default, the collection log file name is the collection query name suffixed by either .blg for performance counters, or .etl for trace data.
–v {nnnnn | mmddhhmm} | Attaches the version control information to the end of the output file and path name. Use numeric nnnnn format, or date format mmddhhmm (month, day, 24-hour, minute) for version control.
–b M/d/yyyy h:mm:ss[AM | PM] | Specifies the begin-time for collections in a 24-hour format. You can also specify begin-time for collections in a 12-hour format by adding AM or PM in the command line. By default, the current day and time is used unless otherwise specified.
–e M/d/yyyy h:mm:ss[AM | PM] | Specifies the end-time for collections in a 24-hour format. You can also specify end-time for collections in a 12-hour format by adding AM or PM in the command line. By default, the current day and time is used unless otherwise specified.
–r –[–]r | Repeats the collection every day at the time periods specified by the –b and –e options. This is valid only for begin- and end-times specified on the same day, month, and year. –[–]r turns off the repeat option.
–p {provider [flags [level]]} | Specifies the name of the provider.
–bs {value} | Specifies the buffer size in n kilobytes for the trace log.
–nb {min max} | Specifies the minimum and maximum number of buffers for the trace log.
–ft [[hh:]mm:]ss | Specifies whether the buffer will be flushed, and the interval at which the buffer will be flushed.

Notes

  • To perform this procedure, you must be a member of the Administrators group, or the Performance Log Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    logman /?

Related Topics


Define start or stop parameters for a log or alert

Microsoft Windows Graphic

To define start or stop parameters for a log or alert

Using the Windows interface

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Counter Logs, Trace Logs, or Alerts.
  3. In the details pane, double-click the name of the log or alert.
  4. Click the Schedule tab.
  5. Under Start log, click one of the following options:
    • To start the log or alert manually, click Manually. When this option is selected, to start the log or alert, right-click the log name in the details pane, and click Start.
    • To start the log or alert at a specific time and date, click At, and then specify the time and date.
  6. Under Stop log, select one of the following options:
    • To stop the log or alert manually, click Manually. When this option is selected, to stop the log or alert, right-click the log or alert name in the details pane, and click Stop.
    • To stop the log or alert after a specified duration, click After, and then specify the number of intervals and the type of interval (days, hours, and so on).
    • To stop the log or alert at a specific time and date, click At, and then specify the time and date. (The year box accepts four characters; the others accept two characters.)
    • To stop a log when the log file becomes full, select options as follows:
      • For counter logs and trace logs, click When the n-MB log file is full. The file will continue to accumulate data according to the file-size limit you set on the Log Files tab.

      When setting this option, take into consideration your available disk space and any disk quotas that are in place. An error might occur if your disk runs out of disk space due to logging.

  7. Complete the properties as appropriate for logs or alerts:
  8. For logs, under When a log file closes, select the appropriate option:
    • If you want to configure a continuous (automated) counter or trace logging, select Start a new log file.
    • If you want to run a program after the log file stops (for example, a copy command for transferring completed logs to an archive site), select Run this program. Also, type the path and file name of the program to run, or click Browse to locate the program.
    • For alerts, under When an alert scan finishes, select Start a new scan if you want to configure continuous alert scanning.

Notes

  • To perform this procedure, you must be a member of the Administrators group, or the Performance Log Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • When you schedule a log to close at a specific time and date or close the log manually, the Start a new log file option is unavailable.
  • If the log is set to start at a scheduled time using Start At, the log will restart if the system reboots during the scheduled time. The scheduled time is based on the Stop settings.
  • When you select Run this program, by default, the program runs in the background.

    • XOX

Important

  • Note the security implications running an interactive program: When log stops, it will run the program on the desktop. If you schedule a collection to run on a system that other users have access to under an account with administrative credentials, then the program will appear on the desktop under the authentication of the administrator account, possibly when other users are logged onto the system.
  • To run an interactive program, open Services and double-click Performance Logs and Alerts. Click the Log On tab, and fill the Local System account and Allow service to interact with desktop check boxes.
  • When creating a monitoring console for export, make sure to select Use local computer counters. Otherwise, System Monitor will obtain data from the computer named in the text box, regardless of where the console file is installed.
  • For a description of a particular counter, click the name of the counter in Add counters, and then click Explain.
  • To monitor the sum of the values all of a particular counter's instances, select the _Total instance.
  • Unless you are configuring data from a log, you can select only active instances in the list box.
  • By default, counters are shown with both the instance name and an instance index. To turn off this feature, right-click the details pane, click Properties, select the General tab, and clear the Allow duplicate counter instances check box.

Using a command line

  1. Open Command Prompt.
  2. Type:

    logman update collection_name –m start stop

Value | Description
update collection_name | Updates the collection query named collection_name.
–m start stop | Specifies that the logging will start and stop manually. Start specifies the time you want logging to start. Stop specifies the time you want logging to stop.

Notes

  • To perform this procedure, you must be a member of the Administrators group, or the Performance Log Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    logman /?

Related Topics


Delete a log or alert

Microsoft Windows Graphic

To delete a log or alert

Using the Windows interface

  1. Open Performance.
  2. Double-click Performance Logs and Alerts.
  3. Click Counter Logs, Trace Logs, or Alerts.
  4. In the details pane, right-click the name of the log or alert, and click Delete.

Notes

  • To perform this procedure, you must be a member of the Administrators group, or the Performance Log Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX

Using a command line

  1. Open Command Prompt.
  2. Type:

    logman delete collection_name

Value | Description
delete collection_name | Deletes the collection query named collection_name. If collection_name does not exist, you will receive an error.

For example, to delete a log named perf_log, type:

logman delete perf_log

Notes

  • To perform this procedure, you must be a member of the Administrators group, or the Performance Log Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    logman /?

  • This command is used only for deleting logs. You cannot use this command to delete an alert.

Related Topics


Concepts

This section provides general background information on performance-monitoring tools in the Windows Server 2003 family:

  • Performance console overview
  • Understanding the Performance console
  • Using the Performance console
  • Resources


Performance console overview

The Windows Server 2003 family provides the following tools as part of the Performance console:

  • System Monitor
  • Performance Logs and Alerts
  • Task Manager

Monitoring system performance is an important part of maintaining and administering your operating system. You use performance data to do the following:

  • Understand your workload and the corresponding effect on your system's resources.
  • Observe changes and trends in workloads and resource usage so you can plan for future upgrades.
  • Test configuration changes or other tuning efforts .
  • Diagnose problems and target components or processes for optimization.

System Monitor and Performance Logs and Alerts provide detailed data about the resources that are used by specific components of the operating system and by programs that have been designed to collect performance data. Graphs provide a display for performance-monitoring data. Logs provide recording capabilities for the data. Alerts send notification to users when a counter value reaches, rises above, or falls below a defined threshold.

Task Manager is another tool that provides performance information about systems running the Windows Server 2003 family. Task Manager provides information about programs and processes that are running on your computer, plus a summary of its processor and memory usage. For information about Task Manager, see Task Manager overview.

Microsoft technical support often uses the results of performance monitoring in problem diagnosis. Therefore, Microsoft recommends that you monitor system performance as part of your administrative routine.

For information on server reliability, availability, and performance and tuning features in the Windows Server 2003 family, see Features for management, security, and best performance.

For overviews of the performance-monitoring tools, see the following topics:

  • System Monitor overview
  • Performance Logs and Alerts overview


System Monitor overview

With System Monitor, you can measure the performance of your own computer or other computers on a network in the following ways:

  • Collect and view the real-time performance data of a local computer or several remote computers: Usability has been modified in the Windows Server 2003 family. For example, you can delete multiple counters at once and display the data properties page for a counter directly from the list window. You can save selected data from a performance log file or an SQL database to a new file for analysis at a later time.
  • Also new in the Windows Server 2003 family are two new security groups that help you to ensure that only trusted users can access and manipulate sensitive performance data. These are the Performance Log Users group and the Performance Monitor Users group.
  • View data collected either currently or previously in a counter log. With the Windows Server 2003 family, you can now simultaneously view data from multiple log files.
  • Present data in a printable graph, histogram, or report view.
  • Incorporate System Monitor functionality into applications that support ActiveX controls, for example, Web pages, and Microsoft Word or other applications in Microsoft Office
  • Create HTML pages from performance views. Views stored in HTML format can be displayed by a browser.
  • Create reusable monitoring configurations that can be installed on other computers using Microsoft Management Console (MMC).

With System Monitor, you can collect and view extensive data about the usage of hardware resources and the activity of system services on computers you administer. You can define the data you want System Monitor to collect in the following ways:

  • Type of data. To select the data to be collected, you specify
    • performance objects, performance counters, and performance object instances.

    Some objects provide data on system resources (such as memory); others provide data on the operation of applications (for example, system services).

  • Source of data. System Monitor can collect data from your local computer or from other computers on the network for which you have administrative credentials. By default, administrative credentials are required. In addition, you can include real-time data or data collected previously using counter logs. With the Windows Server 2003 family, you can now view performance data that was previously collected and stored in an SQL database by the Performance Logs and Alerts service.
  • Sampling parameters. System Monitor supports manual, on-demand sampling or automatic sampling based on a time interval you specify; this functionality applies to real-time data only. When viewing logged data, you can also choose starting and stopping times so that you can view data spanning a specific time range.

In addition to options for defining data content, you have considerable flexibility in designing the appearance of your System Monitor views:

  • Type of display. System Monitor supports graph, histogram, and report views. The graph view is the default view; it offers the widest variety of optional settings.
  • Display characteristics. For any of the three views, you can define the colors and fonts for the display. In graph and histogram views, you can select from many different options when you view performance data:
    • Provide a title for your graph or histogram and label the vertical axis.
    • Set the range of values depicted in your graph or histogram.
    • Adjust the characteristics of lines or bars plotted to indicate counter values, using color, width, style, and other graphical features.

For more information about the performance-monitoring process and interface, see Performance console overview and System Monitor interface.


Performance Logs and Alerts overview

With Performance Logs and Alerts you can collect performance data automatically from local or remote computers. You can view logged counter data using System Monitor or export the data to spreadsheet programs or databases for analysis and report generation. The following list explains the capabilities of Performance Logs and Alerts:

  • New in the Microsoft® Windows® Server 2003 family is the ability to run log collections under different accounts. For example, if you need to log data from a remote computer that requires administrative credentials, you can specify an account with the necessary credentials.
  • Also new in the Windows Server 2003 family are two new security groups that help you to ensure that only trusted users can access and manipulate sensitive performance data. These are the Performance Log Users group and the Performance Monitor Users group.
  • The Windows Server 2003 family supports log files greater than 1 GB in size, and with its new log-file format, you can append performance data to an existing log file.
  • Performance Logs and Alerts collects data in a comma-separated or tab-separated format for easy import to spreadsheet programs. A binary log-file format is also provided for circular logging or for logging instances such as threads or processes that may begin after the log starts collecting data. (Circular logging is the process of continuously logging data to a single file, overwriting previous data with new data.)
  • You can also collect data in an SQL database format. This option defines the name of an existing SQL database and log set within the database where the performance data will be read or written. This file format is useful when collecting and analyzing performance data at an enterprise level rather than on a per-computer basis. Logging data directly to a SQL database is supported through open database connectivity(ODBC).
  • Counter data collected by Performance Logs and Alerts can be viewed during collection as well as after collection has stopped.
  • Because logging runs as a service, data collection occurs regardless of whether any user is logged on to the computer being monitored.
  • You can define start and stop times, file names, file sizes, and other parameters for automatic log generation.
  • You can manage multiple logging sessions from a single console window.
  • You can set an alert on a counter, thereby defining that a message be sent, a program be run, an entry made to the application event log, or a log be started when the selected counter's value exceeds or falls below a specified setting.

Similar to System Monitor, Performance Logs and Alerts supports defining performance objects, performance counters, and performance object instances. It also supports setting sampling intervals for monitoring data about hardware resources and system services. Performance Logs and Alerts also offers other options related to recording performance data:

  • Start and stop logging either manually on demand or automatically based on a user-defined schedule.
  • Configure additional settings for automatic logging, such as automatic file renaming, and set parameters for stopping and starting a log file based on the elapsed time or the file size.
  • Create trace logs. Using the default Windows Server 2003 family data provider or another application provider, trace logs record detailed system application events when certain activities, such as a disk I/O operation or a page fault, occurs. When the event occurs, your operating system logs the system data to a file specified by the Performance Logs and Alerts service. This differs from the operation of counter logs; when counter logs are in use, the service obtains data from the system when the update interval has elapsed, rather than waiting for a specific event. A parsing tool is required to interpret the trace log output. Developers can create such a tool using application programming interfaces (APIs) provided in the MSDN Library on the Microsoft Web site (http://www.microsoft.com/).
  • You can also produce trace analysis reports from trace log output files using the Tracerpt tool. Use this tool to process kernel, Active Directory, and other transactional based trace event logs, and to generate trace analysis reports and .csv files from binary logs.
  • Define a program that runs when a log is stopped.
  • If you want to export log data to Microsoft Excel, the Performance Logs and Alerts service must be stopped because Microsoft Excel requires exclusive access to the log file. Most other programs are not known to require this exclusive access; therefore, in general you can work with data from a log file while the service is collecting data to that file.

For more information about the Performance Logs and Alerts user interface, see Performance Logs and Alerts interface.


Understanding the Performance console

This section describes the design and operation of System Monitor and Performance Logs and Alerts:

  • Performance objects and counters
  • Performance tool architecture


Performance objects and counters

The Windows Server 2003 family of operating systems obtains performance data from components in your computer as those components are utilized. That data is described as a performance object and is typically named for the component generating the data. For example, the Processor object is a collection of performance data about processors on your system.

Performance objects are built into the operating system, typically corresponding to the major hardware components such as memory, processors, and so on. Other programs might install their own performance objects. For example, services such as Windows Internet Name Service (WINS) or server programs such as Microsoft Exchange provide performance objects, and performance graphs and logs can monitor these objects.

Each performance object provides performance counters that represent data on specific aspects of a system or service. For example, the Pages/sec counter provided by the Memory object tracks the rate of memory paging.

Although your system might typically make available many more objects, following are the most frequently used objects:

  • Cache
  • Memory
  • Objects
  • Paging File
  • PhysicalDisk
  • Process
  • Processor
  • Server
  • System
  • Thread

The following table describes the services or features of your operating system that you might be using in your configuration and their corresponding performance objects:

Feature or service to monitor | Performance object available
TCP/IP | ICMP, IP, NBT, TCP, and UDP objects
Browser, Workstation, and Server services | Browser, Redirector, and Server objects
Windows Internet Name Service (WINS) | WINS object
Connection Point Services | PBServer Monitor object
Indexing Service | Indexing Service, Indexing Service Filter, and HTTP Indexing Service objects
Directory service | NTDS object
Print server activity | Print Queue object

For a description of the data provided by a particular counter that is associated with a performance object, click Explain in the Add Counters dialog box. For information about adding counters, see To add counters to System Monitor.

Although some objects (such as Memory and Server) have only a single performance object instance, some performance objects can have multiple instances. If an object has multiple instances, you can add counters to track statistics for each instance or for all instances at once.

Depending on how the counter was defined, its value may be:

  • The most recent measurement of an aspect of resource utilization. These are called instantaneous counters.

    An example is Process\Thread Count, which shows the number of threads for a particular process as of the last time this was measured.

  • The average of the last two measurements over the period between samples.

    An example is Memory\Pages/sec, a rate per second based on the average number of memory pages during the last two samples.

Other types of counters can be defined as described in the Platform Software Development Kit (SDK).

The combination of computer name, object, counter, instance, and instance index is known as the counter path. The counter path is typically shown in the tools as follows:

\\Computer_name\Object_name(Instance_name#Index_Number)\Counter_name

The computer_name is optional. If you do not supply a name, your operating system will use the name of the local computer by default.


Performance tool architecture

Various architectural levels of the Windows Server 2003 family support the operation of System Monitor and Performance Logs and Alerts. For example, these performance tools obtain data by default by means of the registry. You can optionally collect performance data by means of the Windows Management Instrumentation (WMI) interface for hardware resources or applications installed on the system. The Performance Data Helper dynamic-link library (DLL) acts as an intermediary between the WMI and the performance tools to format the data and make calculations, where necessary, to convert raw data for display or reporting. For information about configuring performance tools to collect data using WMI, see To collect performance data using WMI.

DLLs supplied by the operating system provide counters for monitoring the behavior of resources such as memory, processors, disks, and network adapters and protocols. In addition, many services in the Windows Server 2003 family provide their own DLLs that install counters that you can use to monitor their operation.

System Monitor and Performance Logs and Alerts use the Remote Registry service process that manages user logon and logoff operations for remote monitoring connections. The Messenger service in the Windows Server 2003 family sends users alert notification. This service must be running for alert notifications to be received.


Using the Performance console

This section covers the following topics:

  • Setting up a monitoring configuration
  • Quick reference to System Monitor settings
  • System Monitor buttons and keyboard shortcut reference
  • System Monitor interface
  • Performance Logs and Alerts interface
  • Quick reference to log file formats
  • Analyzing performance data
  • Solving performance problems
  • Monitoring performance from the command line


Setting up a monitoring configuration

Setting up a monitoring configuration is the first step in evaluating your system's performance. To monitor your Windows Server 2003 family operating system, you can choose to view data in a graph or collect the data in log files for use in other applications.

Note

  • For best results, read the following sections for setting up your monitoring configuration. To get started quickly, however, you can use the predefined log settings under Counter Logs. These settings, named System Overview, are configured to create a binary log that, after manual startup, updates every 15 seconds and logs continuously until it achieves a maximum size. If you start logging with these settings, data is saved to the Perflogs folder on the root directory and includes the counters: Memory\Pages/sec, PhysicalDisk(_Total)\Avg. Disk Queue Length, and Processor(_Total)\% Processor Time.

Choosing the monitoring method

Graphs are useful for short-term, real-time monitoring of a local or remote computer—for example, when you want to observe a system event while it is happening. Choose the update interval to best capture the type of activity you are interested in. Logs are useful for record-keeping and for extended monitoring, especially of a remote computer; logged data can be exported for report generation and presented as graphs or histograms using System Monitor. Logging is the most practical way to monitor multiple computers.

Choosing how often to monitor

For routine monitoring, start by logging activity over 15-minute intervals. If you are monitoring for a specific problem, you might want to vary the interval. If you are monitoring the activity of a specific process at a specific time, set a frequent update interval; however, if you are monitoring a problem that manifests itself slowly, such as a memory leak, use a longer interval.

Also consider the overall length of time you want to monitor when choosing this interval. Updating every 15 seconds is reasonable if you plan to monitor for no more than four hours. If you plan to monitor a system for eight hours or more, set an interval longer than 300 seconds (five minutes). Setting the update interval to a frequent rate (low value) can cause the system to generate a large amount of data. This can be difficult to work with and can increase the overhead of running Performance Logs and Alerts.

Monitoring a large number of objects and counters can also generate large amounts of data and consume disk space. Try to strike a balance between the number of objects you monitor and the sampling frequency to keep log file size within manageable limits.

Choosing the data to monitor

Start by monitoring the activity of the following components in order:

  1. Memory
  2. Processors
  3. Disks
  4. Network

The following table shows the types of counters recommended for server monitoring. When examining specific resources, you should include other counters for the associated performance object.

Component | Performance aspect being monitored | Counters to monitor
Disk | Usage | Physical Disk\Disk Reads/sec Physical Disk\Disk Writes/sec LogicalDisk\% Free Space Interpret the % Disk Time counter carefully. Because the _Total instance of this counter may not accurately reflect utilization on multiple-disk systems, it is important to use the % Idle Time counter as well. Note that these counters cannot display a value exceeding 100%.
Disk | Bottlenecks | Physical Disk\Avg. Disk Queue Length (all instances)
Memory | Usage | Memory\Available Bytes Memory\Cache Bytes
Memory | Bottlenecks or leaks | Memory\Pages/sec Memory\Page Reads/sec Memory\Transition Faults/sec Memory\Pool Paged Bytes Memory\Pool Nonpaged Bytes Although not specifically Memory object counters, the following are also useful for memory analysis: Paging File\% Usage object (all instances) Cache\Data Map Hits % Server\Pool Paged Bytes and Server\Pool Nonpaged Bytes
Network | Throughput | Protocol transmission counters (varies with networking protocol); for TCP/IP: Network Interface\Bytes total/sec Network Interface\Packets/sec Server\Bytes Total/sec or Server\Bytes Transmitted/sec and Server\Bytes Received/sec
Processor | Usage | Processor\% Processor Time (all instances)
Processor | Bottlenecks | System\Processor Queue Length (all instances) Processor\Interrupts/sec System\Context switches/sec

If some of the counters listed in the preceding table are not available on your computer, verify that you have installed the necessary services or activated the counters.

Choosing the computer to use for monitoring

When monitoring computers remotely, you have some options for collecting data. For example, you can run performance logging on the administrator's computer, drawing data continuously from each remote computer. In another case, you can have each computer running the service to collect data and, at regular intervals, run a batch program to transfer the data to the administrator's computer for analysis and archiving. Note that Performance Logs and Alerts allows you to specify a batch file that will run whenever a given log file is closed for a specified log.

Centralized data collection (that is, collection on a local computer from remote computers that you are monitoring) is simple to implement because only one logging service is running. You can collect data from multiple systems into a single log file. It causes additional network traffic, however, and might be restricted by available memory on the administrator's computer. To do centralized data collection, use the Add Counters dialog box to select a remote computer while running Performance Logs and Alerts on your local computer.

Distributed data collection (that is, data collection that occurs on the remote computers that you are monitoring) does not incur the memory and network traffic problems of centralized collection. It does result in delayed availability of the data, however, requiring that the collected data be transferred to the administrator's computer for review. To do distributed data collection, use the Performance Logs and Alerts node within Computer Management on a local computer to select a remote computer on which to collect data.

Remote monitoring

If you plan to monitor remote computers, you must have the appropriate administrative credentials to gain access to them. In order to monitor remote systems from your computer, you must specify a Run as account that has access to the remote computer. The Run as option sets the account for the specified log or alert, not for the entire Performance Logs and Alerts service. By default, the service is started under the local computer's NTAuthority\NetworkService account, which generally has permission only to access services and resources on the local computer. To start the service under a different account, use the Run as option when configuring data collection, or use Services under Computer Management, and update the properties of the Performance Logs and Alerts service.

Keeping records of performance data

Performance Logs and Alerts provides you with the ability to log performance data to an SQL database. When you retain your logged data in a database, you can query the information and include it in reports. Using database analysis tools, you can query results and examine the results in detail using a variety of parameters. You can also use logs for trend analysis and capacity planning.

Exporting your monitoring configuration

After configuring the performance tools with the counters, update intervals, and other settings you want, you can save those settings on your local computer or for export to another computer. System Monitor settings are saved to the .msc file, while Performance Logs and Alerts settings are stored in the registry. If you save the settings under the name Perfmon.msc, note that you are permanently changing the configuration of the tools on the computer. Therefore, it is recommended that you save the file under another name. You can also save the settings for a single log or alert to an HTML file, which you can later use as a starting point to create new logs or alerts.

In addition to saving monitoring settings, you can add other tools or add multiple copies of System Monitor; for example, if you want to monitor graph and report views simultaneously. For information about adding tools to a console, see To create a custom monitoring console.


Quick reference to System Monitor settings

For all of the following settings, start by right-clicking the System Monitor details pane and clicking Properties.

To add or change this | Use this tab
View type: graph, histogram, or report | General
Objects, counters, and instances (add or delete) Data

Note

  • You can also add counters by right-clicking in the details pane of the System Monitor (as opposed to the System Monitor Properties dialog box) and clicking Add Counters, or by clicking the Add button on the toolbar. You can also delete counters by pressing the DELETE key. This works only if you are using the System Monitor (as opposed to the System Monitor Properties dialog box). To remove all counters and specify new ones, click the New Counter Set button on the toolbar.
Source of data displayed: current data input to the graph, current data input from a log, archived data input from a log Source

Note

  • You can also use the View Log File Data button on the toolbar to use a log file as the data source or the View Current Activity to view real-time data.
Time range for a log and view time range | Source
Update frequency General

Note

  • You can also use the Freeze Display and Update Data buttons on the toolbar to take samples manually.
Report or histogram value type (minimum, maximum, average) | General
Display of counter legend | General
Display of last, minimum, and maximum values for a selected counter (the value bar); allow multiple counter instances | General
Color, width, style, or graph line | Data
Scale of counter data values | Data
Background color of results pane surrounding the graph area, color of graph data-display area | Appearance
Title of graph | Graph
Label on value axis, vertical or horizontal grid lines, and upper and lower limits of graph axes | Graph
Font color in graph display or legend | Appearance
Font type, size, and style | Appearance
Grid color, timer bar color | Appearance
Border style, appearance of graph window | General
Toolbar | General


System Monitor buttons and keyboard shortcut reference

Many commonly used functions can be easily accessed by icons found on the System Monitor toolbar, or by using keystroke combinations. The following table displays these functions and their corresponding buttons or keystroke combinations.

Function | Button | Keyboard Shortcut
New Counter Set | New Counter Set | Ctrl+E
Clear Display | Clear Display | Ctrl+D
View Current Activity | View Current Activity | Ctrl+T
View Log File Data | View Log File Data | Ctrl+L
View Graph | View Graph | Ctrl+G
View Histogram | View Histogram | Ctrl+B
View Report | View Report | Ctrl+R
Add | Add | Ctrl+I
Delete | Delete | Delete Key
Paste Counter List | Paste Counter List | Ctrl+V
Copy Properties | Copy Properties | Ctrl+C
Properties | Properties | Ctrl+Q
Freeze Display | Freeze Display | Ctrl+F
Update Data | Update Data | Ctrl+U
Highlight | Highlight | Ctrl+H
Help | Help | F1


System Monitor interface

When you open Performance, a toolbar appears and the graph view area displays the same set of counters as the system overview query in Performance Logs and Alerts. System Monitor begins charting counter values in this graph area immediately. By default, data is updated automatically. Switch to manual update by using the Freeze Display button in the toolbar. Use the Update Data button to collect each sample on demand. One collection is made per click. To remove all data from the display, click the Clear Display button.

The names and associated information for the counters you select are shown in the legend beneath the graph, as follows:

  • Computer on which System Monitor is running
  • Performance object
  • Performance counter
  • Performance object instance. Note that by default counter instances are listed by name and numerical index. This index appears after the instance name, represented by a number sign (#) and a number. This index makes it easier to monitor multiple instances, for example, when you are monitoring threads of a process.

    To turn off the index display, right-click the graph, click Properties, and clear the Allow duplicate counter instances check box. By default, process and thread instances have a #n appended (where n is an integer). To append the process ID instead, create a DWORD value called ProcessNameFormat under the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfProc\Performance subkey and set its value to 2. Likewise, to append the thread ID instead, create a DWORD value called ThreadNameFormat under the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfProc\Performance subkey and set its value to 2. To turn off any of these options and return to the default, set the value of the appropriate DWORD to 1.

    • Caution

    • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer. For more information, see Registry Editor overview.
  • Graphical properties of each counter.

Note

  • To match a line in a graph with the counter for which it is charting values, select a counter in the legend and double-click a position in the line. When highlighting is in effect, the bar or line representing data for the selected counter changes color to black for most background colors. If chart lines are close together, try to find a point in the graph where they diverge. Otherwise, System Monitor may not be able to pinpoint the value you are interested in.

Above the legend columns is the value bar, where you see the last, minimum, maximum, and average values for the counter that is currently selected. These values are calculated over the time period and number of samples displayed in the graph (reflected by the Duration value), not over the time that has elapsed since monitoring was started. The Duration value in the value bar indicates the total elapsed time displayed in the graph (based on the update interval). The movement of the timer bar across the graph indicates the passing of each update interval. Regardless of the update interval, the view will show up to 100 samples. System Monitor compresses log data as necessary to fit it in the display.

You can define the following attributes of the graph:

  • Type of display, with options for graph, histogram, or report.
  • Background color of the details pane and of the data-display area.
  • Size, type, and style of font used to show text in the display.
  • Color, width, and style of line used to chart data.

Note

  • Default key settings in Microsoft Word may conflict with the CTRL+H combination used for System Monitor highlighting. You may need to change these to support highlighting when the System Monitor control (Sysmon.ocx in the system_root\System32 folder) is used in Microsoft Word.

Clicking Object, Counter, Instance, or Computer in the counter legend sorts entries in ascending or descending order for that category. For example, to sort all counters by name, click Counter.

For more information, see Quick reference to System Monitor settings.


Performance Logs and Alerts interface

In Performance Logs and Alerts you define settings for counter logs, trace logs, and alerts. The details pane of the console window shows logs and alerts that you have created. You can define multiple logs or alerts to run simultaneously. Each log or alert is a saved configuration that you define. If you have configured the log for automatic starting and stopping, a single log can generate many individual log data files. For example, if you were generating a log file for each day's activity, one file would close at 11:59 P.M. today, and a new file would open at 12:00 A.M. tomorrow. The following table explains the query summary information provided by the columns in the details pane.

Column | Description
Name This is the name of the log or alert. It describes the type of data you are collecting or the condition you are monitoring. One log can generate multiple log files.

Note

  • Sample settings, named System Overview, have been predefined for counter logging. You can start logging using these settings or define your own settings, as appropriate.
Comment | This can be any descriptive information about the log or alert.
Log File Type | This is the log-file format you define. For alert, the type will always be alerts. For trace logs, the type can be sequential or circular. For logs, this can be binary, binary circular, text file (comma delimited), text file (tab delimited) or SQL.
Log File Name | This is the path and base file name you defined for the files generated by this log. The base file name is used for automatically naming new files.

To see the parameters defined for each log, double-click the list entry for the log. In the dialog box that appears, you can choose how to name your log files, when logging is scheduled to occur, and what performance objects and counters you want to monitor in your log.

If a log is currently running and collecting data (based on the schedule you defined for the log or alert), a green data icon appears next to the log or alert. If a red icon appears, the log or alert has been defined but is not currently running.

Note

  • You can configure more than one type of log to run at a time. One log can generate multiple log files if the restart option is selected or if the user starts and stops the log multiple times. However, you will not see these individual log files listed in the console window. Use Windows Explorer to view a listing of these files.


Quick reference to log file formats

The following table provides a description of each log file format. For step-by-step guidance on selecting a format, see To set parameters for a log.

Log file format | Description | Applies to
Text File (Comma delimited) | This option defines a comma-delimited log file (with a .csv extension). Use this format, for example, to export the log data into a spreadsheet program. | Counter logs
Text File (Tab delimited) | This option defines a tab-delimited log file (with a .tsv extension). Use this format, for example, to export the log data into a spreadsheet program. | Counter logs
Binary File | This option defines a sequential, binary-format log file (with a .blg extension). Use this file format if you want to be able to record data instances that are intermittent—that is, stopping and resuming after the log has begun running. Only binary file formats can accommodate instances that are not persistent throughout the duration of the log. | Counter logs
Binary Circular File | This option defines a circular, binary-format log file (with a .blg extension). Use this file format to record data continuously to the same log file, overwriting previous records with new data when the file reaches its maximum size. | Counter logs
Circular Trace File | This option defines a circular trace log file (with an .etl extension). Use this file format to record data continuously to the same log file, overwriting previous records with new data when the file reaches its maximum size. | Trace logs
Sequential Trace File | This option defines a sequential trace log file (with an .etl extension) that collects data until it reaches a user-defined limit and then closes and starts a new file. | Trace logs
SQL Database | This option defines the name of an existing SQL database and log set within the database where the performance data will be read or written. Use this file format to collect performance data at an enterprise level rather than a per computer basis. | Counter logs


Analyzing performance data

Analyzing your monitoring data consists of examining counter values that are reported while your system is performing various operations. You should determine which processes are most active and which programs or threads, if any, are monopolizing a resource. Using this type of performance data analysis, you can understand how your system is responding to workload demands.

As a result of this analysis, you may find that your system performs satisfactorily at some times and unsatisfactorily at others. Depending on the causes of these variations and the degree of difference, you may choose to take corrective action or to accept these variations and delay tuning or upgrading resources for a later time.

The level of system performance that you consider acceptable when your system is handling a typical workload and running all required services is its baseline. The baseline performance is a subjective standard that the administrator determines based on the work environment. It may correspond to a range of counter values, including some that are temporarily unacceptable but which generally indicate the best possible performance under the administrator's specific conditions. The baseline can be the measure used for setting performance standards for your users and can be included in any service agreements you put in place.

Determining acceptable values for counters

In general, deciding whether or not performance is acceptable is a subjective judgment that varies significantly with variations in user environments. The following table containing threshold values for specific counters can, however, help you determine whether values reported by your system indicate a problem. If System Monitor consistently reports these values, it is likely that bottlenecks exist on your system and you should take action to tune or upgrade the affected resource. Counters that show usage ratios over an interval are a more informative measurement than averages of instantaneous counter values. In performance data measurements, one or two data points that fall outside normal operating conditions for a brief period of time, for example, during the startup period of a service, can skew the average. This gives a false impression of the overall operating performance during the collection period.

Resource | Object\Counter | Suggested threshold | Comments
Disk Physical Disk\% Free Space
Logical Disk\% Free Space 		15%
Disk Physical Disk\% Disk Time
Logical Disk\% Disk Time 		90%
Disk | Physical Disk\Disk Reads/sec, Physical Disk\Disk Writes/sec | Depends on manufacturer's specifications | Check the specified transfer rate for your disks to verify that this rate does not exceed the specifications. In general, Ultra Wide SCSI disks can handle 50 to 70 I/O operations per second. Note that whether or not the I/O is sequential or random can have a strong impact on values for disk reads/sec and disk writes/sec.
Disk | Physical Disk\Current Disk Queue Length | Number of spindles plus 2 | This is an instantaneous counter; observe its value over several intervals. For an average over time, use Physical Disk\Avg. Disk Queue Length.
Memory | Memory\Available Bytes | For larger memory computers, greater than 4 MB | Research memory usage and add memory if needed.
Memory | Memory\Pages/sec | n pages/sec per pagefile | Research paging activity. Note the amount of I/O going to the disks with pagefiles.
Paging file | Paging File\% Usage | Above 70% | Review this value in conjunction with Available Bytes and Pages/sec to understand paging activity on your computer.
Processor | Processor\% Processor Time | 85% | Find the process that is using a high percentage of processor time. Upgrade to a faster processor or install an additional processor.
Processor | Processor\Interrupts/sec | Depends on processor; 1,000 interrupts per second is a good starting point | A dramatic increase in this counter value without a corresponding increase in system activity indicates a hardware problem. Identify the network adapter, disk, or other hardware causing the interrupts.
Server | Server\Bytes Total/sec | If the sum of Bytes Total/sec for all servers is roughly equal to the maximum transfer rates of your network, you may need to segment the network.
Server Server\Work Item Shortages 3 If the value reaches this threshold, consider adding the DWORD entries InitWorkItems (the number of work items allocated to a processor during startup) or MaxWorkItems (the maximum number of receive buffers that a server can allocate) to the registry (under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters). The entry InitWorkItems can range from 1 to 512 while MaxWorkItems can range from 1 to 65,535. Start with any value for InitWorkItems and a value of 4,096 for MaxWorkItems and keep doubling these values until the Server\Work Item Shortages threshold stays below 3. For information about modifying the registry, see Registry Editor overview.

Caution

  • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.
Server | Server\Pool Paged Peak | Amount of physical RAM | This value is an indicator of the maximum paging file size and the amount of physical memory.
Server | Server Work Queues\Queue Length | 4 | If the value reaches this threshold, there may be a processor bottleneck. This is an instantaneous counter; observe its value over several intervals.
Multiple processors | System\Processor Queue Length | 2 | This is an instantaneous counter; observe its value over several intervals.

For tuning and upgrade suggestions, see Solving performance problems.

For a more detailed discussion of performance-data analysis, see "Part One: Operating System Performance" in the System Performance and Troubleshooting Guide, available at the Microsoft Windows Resource Kits Web site (http://www.microsoft.com/).


Solving performance problems

Analysis of your monitoring data can reveal problems such as excessive demand on certain resources resulting in bottlenecks. This section discusses common causes for bottlenecks and a recommended strategy for tuning and testing.

Causes of bottlenecks

Demand may become extreme enough to cause resource bottlenecks for the following reasons:

  • Resources are insufficient and additional or upgraded components are required.
  • Resources are not sharing workloads evenly and need to be balanced.
  • A resource is malfunctioning and needs to be replaced.
  • A program is monopolizing a particular resource; this might require substituting another program, having a developer rewrite the program, adding or upgrading resources, or running the program during periods of low demand.
  • A resource is incorrectly configured and configuration settings need to be changed.

Strategy for tuning and testing

Insufficient memory is the most common cause of serious performance problems in computer systems. If you suspect other problems, check memory counters to rule out a memory shortage. Poor response time on a workstation is most likely to result from memory and processor problems; servers are more susceptible to disk and network problems.

Before you start tuning, consider the following recommendations:

  • Make one change at a time. In some cases, a problem that appears to relate to a single component might be the result of bottlenecks involving multiple components. For this reason, it is important to address problems individually.

    Making multiple changes simultaneously may make it impossible to assess the impact of each individual change.

  • Repeat monitoring after every change. This is important for understanding the effect of the change and to determine whether additional changes are required. Proceed methodically, making one change to the identified resource at a time and then testing the effects of the changes on performance. Because tuning changes can affect other resources, it is important to keep records of the changes you make and to review after you make a change.
  • In addition to monitoring, review event logs, because some performance problems generate output you can display in Event Viewer. For more information about using Event Viewer, see Event Viewer.
  • To see whether network components are playing a part in performance problems, compare the performance of programs that run over the network with locally run programs.

Tuning and upgrade tips by component

This section lists tuning tips for resources you are monitoring:

    Memory:

    • Increase physical memory above the minimum required.
    • Create multiple paging files when you use multiple disks.
    • Determine the correct size for the paging files. The recommended initial size of the paging file is between 1 and 1.5 times the amount of RAM available, based on your system; the size needed depends on the workload.
    • Ensure that memory settings are properly configured.
    • Run memory-intensive programs on your highest performing computers or when system workload is light.

    Disk:

    • Upgrade to a higher speed disk, or add disks. If possible, upgrade the disk controller and the bus.
    • On servers, use Disk Management to create striped volumes on multiple physical disks. This solution increases throughput because I/O commands can be issued concurrently.
    • Distribute programs among servers. Distributed File System (DFS) can be used to balance workload.
    • Isolate tasks that heavily utilize disk I/O on separate physical disks or disk controllers.
    • Use Disk Defragmenter to consolidate files optimizing data access and disk space.
    • If you want to improve the efficiency of disk access, consider installing the latest driver software for your host adapters or motherboard drivers. Contact your adapter or motherboard manufacturer for information.

    Processor:

    • Add a processor (especially for multithreaded programs). Upgrade to a faster processor, or one with a larger cache.
    • On multiprocessor computers, manage the processor affinity with respect to process threads and interrupts.

    Network:

    • Configure your network so that systems shared by the same group of people are on the same subnet.
    • Unbind infrequently used network adapters. See To modify the protocol bindings order for more information.
    • If you are using more than one protocol, you can set the order in which the workstation and NetBIOS software bind to each protocol. See Network and Dial-up Connections Help for more information. Some reasons for changing the list order are as follows:
      • If the protocol you use most frequently is first in the binding list, average connection time decreases.
      • Some protocols are faster than others for certain network topologies. If you are optimizing a client computer, putting the faster protocol first in the bindings list improves performance. Because the server accepts incoming connections using the protocol chosen by the client computer, there is no reason to reorder server computer bindings.
    • Use multiple network adapters. The Windows Server 2003 family of operating systems supports multiple adapters for a given protocol and multiple protocols for a given adapter. Although this configuration can create distinct networks that cannot communicate with one another, it is a way to increase file sharing throughput.

For information on server reliability, availability, and performance and tuning features in the Windows Server 2003 family, see Features for management, security, and best performance.

For detailed guidance on solving performance problems, see "Part One: Operating System Performance" in the System Performance and Troubleshooting Guide, available at the Microsoft Windows Resource Kits Web site (http://www.microsoft.com/).


Monitoring performance from the command line

In addition to using the Performance graphical interface, you can use the following command line utilities:

  • Logman manages and schedules performance counter and event trace log collections on local and remote systems.
  • Perfmon allows you to open a Performance console configured with the System Monitor ActiveX control and Performance Logs and Alerts Service.
  • Relog extracts performance counters from performance counter logs into other formats, such as text file (tab delimited), text file (comma delimited), binary-BIN, or SQL.
  • Tracerpt processes event trace logs or real-time data from instrumented event trace providers and allows you to generate trace analysis reports and CSV (comma-delimited) files for the events generated.
  • Typeperf writes performance counter data to the command window, or to a supported log file format.
  • Lodctr registers new Performance counter names and Explain text for a service or device driver, and saves and restores counter settings and Explain text.
  • Unlodctr removes Performance counter names and Explain text for a service or device driver from the system registry.

For more information about incorporating these Performance commands into your Windows Management Instrumentation (WMI), see "Part One: Operating System Performance" in the System Performance and Troubleshooting Guide, available at the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/)

For information about other command-line utilities, see Command-line reference. For more information about manageability, see Management strategies and tools.


Resources

  • For a more detailed discussion of performance data and its analysis, and on troubleshooting your computer using performance-monitoring tools, see "Part One: Operating System Performance" in the System Performance and Troubleshooting Guide, available at the Microsoft Windows Resource Kits Web site (http://www.microsoft.com/).
  • For information about optimizing programs or writing performance counters for programs, and about tuning network and service parameters in the registry to optimize performance, see the MSDN library at the Microsoft Web site (http://www.microsoft.com/).


Troubleshooting

What problem are you having?

Counter values consistently equal zero.

Cause: The process being monitored has stopped so there is no data in the performance tools.

Solution: If you stopped the process manually, restart it to see the process in System Monitor. Otherwise, check Event Viewer for concurrent entries. You may find an error associated with this process.

Cause: The counter DLL was disabled after you selected the corresponding counters in a log or display The performance tools will not detect that the counter was removed or disabled but will report the counter data as zeros.

Solution: Enable the corresponding counter DLL.

Cause: You lack the appropriate administrative credentials on the computer being monitored.

Solution: An administrator must ensure that your user account has the appropriate administrative credentials to use the performance tools.

System Monitor shows gaps in its line graphs.

Cause: This could be because data collection was subordinated to a processing activity with a higher priority on a system with a heavy load. When the system has adequate resources to continue with data collection, the graphing will resume as usual. A message appears describing this.

Solution: Reduce the performance overhead of system monitoring.

See also: Best practices

Values recorded in a log do not appear in the graph view.

Cause: The graph is limited to 100 samples.

Solution: Reduce the selected time range. For more information, see To use logged data.

Cause: You did not add counters to the graph view.

See also: For more information, see To add counters to System Monitor.

Objects, counters, or instances seem to be missing or invalid.

Cause: Test routines that run when you open the Performance console have detected a problem with installed counters and have disabled the counters automatically to prevent them from slowing the system. Disabled objects and counters do not appear in the Add Counters dialog box.

Solution #1: You can enable the disabled counters. Using Registry Editor, change the value under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Service_name\Performance\Disable Performance Counters from 1 for disable to 0 for enable. Note that counters that have been disabled after initial testing are likely to contain errors and may cause system problems. For information about debugging problems with counter DLLs, see the Microsoft Web site (http://msdn.microsoft.com/).

Solution #2: You can turn off the automatic testing feature for the counter DLL or adjust the level of testing. Using Registry Editor, locate the Configuration Flags subkey under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Perflib and change the value of the REG_DWORD entry for this subkey:

REG_DWORD value | Performance counter DLL test level
0x00 | Test for buffer alignment errors and report any critical error detected.
0x01 | Do not test for data buffer alignment errors.
0x02 Do not disable DLLs when errors are detected.

Note

  • Your operating system will still write messages to the Event Log if this option is used.
0x04 | Disable all performance counter function testing.
0x08 Enable the disabling of performance objects if they exceed a time-out value.

Note

  • Normally your operating system will merely write a message to the Event Log.
0x10 | Enable the collection of performance and error statistics for each performance object. This is the default setting.

Caution

  • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.

Cause: The process that starts the object counters is not started or installed.

Solution: Use Task Manager to verify that the process is running. If not, use Exctrlst.exe.

See also: Windows Resource Kit Tools Help.

Cause: The counters have not been enabled.

Solution: Make sure that the service or feature that provides the counter has been installed or configured.

Cause: The DLL that installs the counters is generating errors. An example is possible problems with localization functions by the counter.

Solution: Check Event Viewer to see whether the counter DLL or the Performance Data Helper reported any errors. If necessary, you can disable counter DLLs that are causing errors by using Exctrlst.exe.

See also: Windows Resource Kit Tools Help.

Cause: You are trying to monitor a 16-bit or MS-DOS application. Only 32-bit processes appear in the instances list. Active 16-bit processes appear as threads running in a Windows Virtual DOS Machine (NTVDM) process.

Solution: Monitor the application through the NTVDM process.

Cause: The instance you want to monitor is not currently active. If you are configuring System Monitor to collect real-time data, you can only select active instances for data collection. (If you are viewing logged data, you can select inactive instances for which the log contains data.) If you select the process and it stops after you've selected it, it will continue to appear in the list box but the reported data will be zeros.

Solution: Make sure the instance is active.

I sometimes see an extremely high value for one instance and not another while I am monitoring processes of the same name.

Cause: The performance tools sometimes misrepresent data for separate instances of processes with the same name by reporting the combined values of the instances as the value of a single instance.

Solution: Use the instance index and track the Process\ID Process and Process\Creating Process ID counters.

While monitoring several threads, if one thread stops, its data appears to be reported for another.

Cause: This is caused by the way threads are numbered. For example, assume you are monitoring three threads, numbered 0, 1, and 2. If thread 0 stops, the remaining threads get renumbered. The original thread 0 is now gone and the original thread 1 is renamed 0. As a result, data for the stopped thread 0 could be reported along with data for the running thread 1 because the previous thread 1 is now the current thread 0.

Solution: Use the instance index with Thread ID to track these threads.

An error message is displayed if I try to export log data to Microsoft Excel while the Performance Logs and Alerts service is actively collecting data to that log.

Cause: Microsoft Excel requires exclusive access to the log file. Most other programs do not require this exclusive access; therefore, in general, you can work with data from a log file while the service is collecting data to that file.

Solution: Stop the log collection using Performance Logs and Alerts before trying to use the log data with Microsoft Excel.

I lost my connection to a remote computer from which I was logging data and I cannot resume logging.

Cause: Logging data from a remote computer requires the use of Remote Registry Service. If the service stops due to failure, by default the system restarts it automatically only once.

Solution: If Remote Registry service stops more than once, you must restart the service manually on the second and any subsequent failures. To change this default behavior, use Computer Management or Services (on the Administrative Tools menu) to modify the properties for Remote Registry service.

Help for System Monitor does not appear in MMC Help; only Performance Logs and Alerts is displayed.

Cause: Because System Monitor is designed as an ActiveX control, its behavior differs from other Microsoft Management Console (MMC) snap-ins. For example, System Monitor Help is not available when you right-click System Monitor and then click Help on the shortcut menu, or when you click Help Topics on the Help menu.

Solution: Click the Help button on the System Monitor toolbar.

I cannot log performance counters from a remote computer.

Cause: You may not have administrative credentials to view the counters on the remote computer.

Solution: Ask the administrator of the remote computer to give you read access to the remote computer.

Cause: You may not have the correct administrative credentials granted through Group Policy.

Solution: Ask the administrator of the remote computer to grant you access through the following User Rights policies: Profile System Performance and Profile a Single Process.

See also: Group Policy.

Cause: The Performance Logs and Alerts service may not have permission to log on to the remote computer or to create and update the log file.

Solution: Use the Run as text box and Password button to specify the logon account name with the necessary permissions for the Performance Logs and Alerts service. You can access these features from the General tab.

Cause: The Remote Registry service is not running on the remote computer.

Solution: Ensure that the Remote Registry service is started on the remote computer. You need appropriate permissions on the remote computer to start the service.

Note

  • You might also receive this error message if the remote computer is running Windows 95. Computer Management does not support remote access to computers that are running Windows 95.

See also: To start, stop, pause, resume, or restart a service.

Cause: The size limit of the log file may not be large enough to collect your requested data.

Solution: Increase the limit of the log file size or set the file size to the maximum limit allowed.

See also: To set file parameters for a log.

Cause: The log update interval may be too short to allow the server to respond to each periodic data request.

Solution: Increase the log update interval.

See also: To view or change properties of a log or alert.

My counters used to work, but since I installed a new application they do not work. Is there a way to restore the old counter settings?

Cause: Whenever you install a new application that installs performance counters on your operating system, the operating system creates a backup copy of the performance counter registry entries taken prior to the addition of the new application's performance counters file. This backup is saved as a file named PerfStringBackup.ini. If your operating system successfully adds the new application's performance counters file, it then replaces the previous version of the PerfStringBackup.ini file with the file that it just created.

Solution: Restore the performance counter registry to the state described in the uncorrupted backup file by using the following command:

LODCTR /R:filename

where filename is the name of the backup file of the performance counter registry entries.

Note

  • To make a backup copy at any time of the performance counter registry settings, use the following command:

    LODCTR /S:filename

    where filename is any name. You can save these backup files anywhere on your computer.


Finding memory bottlenecks

Use the following counters to identify bottlenecked memory resources:
  • Memory\Available Bytes
  • Memory\Pages/sec

See Analyzing performance for counter threshold values that should not be exceeded and see Solving performance problems for tuning techniques that may alleviate performance problems.


Finding processor bottlenecks

Use the following counters to identify bottlenecked processor resources:

  • Processor\ Interrupts/sec
  • Processor\ % Processor Time
  • Process(process)\ % Processor Time
  • System\ Processor Queue Length

See Analyzing performance for counter threshold values that should not be exceeded and see Solving performance problems for tuning techniques that may alleviate performance problems.


Finding disk bottlenecks

Use the following counters to identify bottlenecked disk resources:

  • PhysicalDisk\ % Disk Time and % Idle Time
  • PhysicalDisk\ Disk Reads/sec and Disk Writes/sec
  • PhysicalDisk\ Avg. Disk Queue Length
  • LogicalDisk\ % Free Space

Also monitor memory counters to determine whether excessive paging is putting a strain on the disk.

See Analyzing performance for counter threshold values that should not be exceeded and see Solving performance problems for tuning techniques that may alleviate performance problems.


Finding network bottlenecks

Use the following counters to identify bottlenecked network resources:

  • Network Interface\ Bytes Total/sec, Bytes Sent/sec, and Bytes Received/sec
  • Protocol_layer_object\ Segments Received/sec, Segments Sent/sec, Frames Sent/sec, and Frames Received/sec

    • For NWLink performance objects, frame-related counters report only zeroes. Use datagram-based counters for these objects.

  • Server\ Bytes Total/sec, Bytes Received/sec, and Bytes Sent/sec

See Analyzing performance for counter threshold values that should not be exceeded and see Solving performance problems for tuning techniques that may alleviate performance problems.


Finding printer bottlenecks

Use the following counters to identify overburdened printer resources:

  • Print Queue\ Bytes Printed/sec
  • Print Queue\ Job Errors

Low values for Bytes Printed/sec can indicate a printer throughput problem. Note that this value varies based on the type of printer. Consult your printer documentation for acceptable values for printer throughput.

Job errors are typically caused by improper port configuration. Check your port configuration for invalid settings.


Configure memory-related settings on your computer

Microsoft Windows graphic

To configure memory-related settings on your computer

  1. Open Network Connections.
  2. Right-click Local Area Connection and click Properties.
  3. In This connection uses the following items, double-click File and Printer Sharing for Microsoft Networks.
  4. Under Optimization, notice that Maximize data throughput for file is selected by default. To turn this option off to reduce paging activity, click Maximize data throughput for network.

Note

  • XOX


Determine the amount of RAM on your computer

Microsoft Windows graphic

To determine the amount of RAM on your computer

  1. Open My Computer and click Properties.
  2. On the General tab, the amount of memory in kilobytes (KB) appears beneath the Computer information.

Note

  • XOX