Windows 2000 Performance Tools: Leverage Native Tools for Performance Monitoring and Tuning

Like this article? We recommend 

Performance Monitor

Performance Monitor is a Microsoft Management Console (MMC) snap-in. To invoke this tool, select Start, Programs, Administrative Tools, Performance. Alternatively, you can invoke Performance Monitor by selecting Start, Run and inputting Performance Monitor in the Open text box, and then pressing Enter. Win2K's Performance Monitor provides the following features to monitor and analyze your server's performance:

• Real-time performance monitoring in chart, reporting, or histogram mode lets you highlight a counter on the Performance Monitor screen and press Ctrl+H, which highlights the current counter selection on your screen. After you perform this action, as you scroll through the counters, Performance Monitor highlights in the associated graph each counter as you select it. When you're displaying multiple counters on the GUI, this feature helps denote which counter is doing what. (The Backspace key doesn't provide this functionality as it did in NT 4.0.)

• Trace logs provide an advanced mechanism to analyze your system. Third-party tools usually leverage this feature.

• Counter logs let you log performance data at a designated interval for local or remote Win2K systems.

In addition to these monitoring tools, Performance Monitor provides enhanced functionality: Alerts let you generate an action (for example, run a command or script) based on the counter value thresholds that you set in Performance Monitor. In addition, all your settings move with you from one reporting mode to another reporting mode. When you start Performance Monitor, the tool recalls your last settings. Thus, you don't have to save your default settings to a .pwm file and recall them to begin analyzing your system. These setting are system-based, so the next person who logs in will see the view that you left. The new tool offers more flexibility in how you store the data that Performance Monitor generates (for example, you can store data as HTML, binary, .csv, .tsv, and binary circular) than previous versions offered. You can start and stop performance logging based on a date/time group. You can automatically start another copy of the tools based on Performance Monitor events that you configure on your system. Finally, the new tool has a friendlier mechanism to simultaneously collect performance data from multiple servers.

Although NT 4.0 provides some of this functionality (if you install tools from the Microsoft Windows NT Server 4.0 Resource Kit), Win2K provides these features in an integrated, friendlier tool that saves you the extra step of loading additional resource kit tools. In addition, Win2K's Performance Monitor can't read performance logs that you generate with NT's Performance Monitor.

Performance Monitor in the Real World

To find details about the basic mechanics of using Win2K's Performance Monitor, click About Performance Monitor in the tool's Help menu. This file provides helpful information and useful directions.

The following scenarios show you how to leverage Performance Monitor's capabilities. To take full advantage of Performance Monitor's functionality, you must activate all your system's performance counters. For information about how to activate these counters in Win2K, see the sidebar at the end of this article, "Activating All Performance Counters."

By default, Windows 2000 (Win2K) doesn't activate two of the core performance counters-network and logical disk monitoring. If you don't activate these counters, half of your performance tuning and sizing puzzle will be missing, which makes analyzing your system's performance extra challenging. If you're concerned about a performance-related problem, you need all the help you can get!

To activate Win2K Performance Monitor's network counters, install SNMP and Network Monitor services by clicking Add Networking Components in the Network and Dial-Up Services Control Panel applet. Next, select Management and Monitoring Tools.

By default, Win2K starts the physical hard disk counters. You can use the Diskperf command at a command prompt to control which disk counters are on or off. For more information about the Diskperf command options, type

diskperf -?

at the command prompt. If you want to activate both the logical and physical hard disk counters, run

diskperf -y

from the command line. You must reboot your system to activate these counters. In addition, you can use the Diskperf commands to start disk counters on remote systems, if you have the proper administrative privileges.

General performance monitoring. When you start Performance Monitor, the tool presents you with the default Performance window, which Figure 1 shows. 

Figure 1

To add any combination of counters to the right display pane, click the plus (+) button in the toolbar at the top of the right display pane. Table 1 outlines the minimum counters that you should monitor for general performance monitoring. When you're examining specific resources, include the appropriate counters for analyzing that area.

Table 1 Key Performance Metrics to Monitor

Object	Counter	Reason to Monitor
PhysicalDisk and LogicalDisk	Disk Transfers/sec (all instances)	On average, a modern SCSI hard disk can support about 80 to 100 transfers per second before its response time erodes past an acceptable limit.
	Avg. Disk sec/Transfer (all instances)	These counters measure the time required to complete a read or write transaction. Developing your performance baseline and comparing it with this value shows whether your disk subsystem is running faster or slower than usual.
	Avg. Disk Queue Length (all instances)	If these counters' values are greater than 2 on one drive, you might have a disk-bottleneck problem. For RAID arrays, if the LogicalDisk Average Disk Queue Length is greater than twice the number of disks in the array, you have a disk bottleneck.
Memory	Pages/sec	If this value is high (that is, a high value for Pages/sec is relative to your system) for consistent periods of time (longer than 5 minutes), and if the physical disk where your pagefile resides is experiencing a high workload, you have a memory bottleneck. On a lightly loaded server, a Pages/sec value of 20 is high. On a workstation, a value of 4 might be high. Baseline your environment, and watch closely for a dramatic increase in this counter, increased disk activity on the disk that contains your pagefile, the pagefile usage size, and low available memory bytes.
	Available Bytes	This counter shows the amount of RAM still available. You want your system to use all its RAM, but if this counter consistently drops below 4MB, you need more RAM.
Paging File	% Usage (all instances)	These values are helpful in assessing whether you have a memory problem. If Pages/sec increases and the pagefile grows, your system is running low on memory.
Processor	% Processor Time	This counter tracks CPU usage. If this value is consistently greater than 90 percent and the system work queue is greater than 2 overtime, you have a CPU bottleneck.
System	Processor Queue Length	One queue exists for processor time even on systems with multiple CPUs. This counter measures the number of threads in the queue that are ready for execution. If this value is greater than 2 for a single-CPU system (or twice the number of CPUs in a multi-CPU system) and the processor usage is greater than 90 percent, you probably have a CPU bottleneck.
Network Interface	Bytes Total/sec	This counter lets you isolate performance-related network problems. If this value is greater than 50 percent of its network medium, a network bottleneck is forming.

In the Performance window, you can quickly change from among chart, report, or histogram views by selecting the appropriate icon below the Performance Monitor's menu bar. Figure 1 shows an example of the report view. You can view the performance of a remote server by clicking the + button, selecting the Select Counters from Computer option, and entering the remote computer's name using the Uniform Naming Convention (UNC) format. (Performance Monitor enters the name of the local computer, by default.) You must have administrative rights on the remote system that you want to monitor.

Long-term performance analysis. What if you want to collect performance information over time to develop a baseline? With NT 4.0, your biggest hurdle is the physical size that the performance logs might grow to. To work around this limitation, Win2K's Performance Monitor lets you schedule log collection by time or date. This enhancement lets you isolate the collection of data to times of interest, thus lowering the amount of data that Performance Monitor collects. To set a schedule, expand the Performance Logs and Alerts object in the left pane of the Performance window, right-click a log, and select the Schedule tab. On the Schedule tab, you can configure start and stop times. Collecting performance data during typical operations (such as from 8:00 a.m. to 6:00 p.m.) is common.

Depending on your environment, you might want to collect data for several weeks at a time for trend analysis. To avoid having to perform maintenance on these files as they grow, select Counter Logs, right-click the file that you want to manage, select Properties, click the Log Files tab, select Binary Circular File from the Log File Type drop-down list, and input a limit in the Limit of text box, as Figure 2 shows. Leveraging this performance-collection strategy lets you limit the amount of disk space that a performance file uses. If you match the sampling rate to the amount of disk that you want to use for performance collection, you can monitor and access several weeks worth of performance data without worrying about performance log size maintenance.

Figure 2

Sampling rates. How often do you need to sample your system for performance data? The answer depends on your goals. If you sample more often than every 5 seconds, you place a slightly higher load on your system (about 1 to 3 percent), and your performance log files require more disk space than if you sample at a usual rate (less often than every 5 seconds). If you don't sample often enough, you risk not monitoring the system when it experiences a problem.

Win2K provides a much broader range of objects and counters than previously available. If you collect all possible performance data on a system with one disk and one network connection, each sample that you collect requires more than 200Kb per sample. Most administrators don't need to monitor every possible performance object and its associated counters. If you collect performance data from the counters that Table 1 list, each sample consumes approximately 2Kb. Using this information as a baseline, Table 2 provides general guidelines about performance collection rates.

Table 2 Sample Performance Rate Guidelines

Goal	Sampling Rate	Counters	Disk Space Required Per Hour (Kb)
Detailed Troubleshooting	Sample once per second	All possible key counters	720,000
Short-term Analysis	Sample once per 5 seconds	All possible key counters	144,000
Long-term Analysis	Sample once every 10 minutes	All possible key counters	1200

Which Process Is the Bottleneck?

Has a customer complained about poor system performance, but when you investigated everything looked fine? Performance Monitor's alert feature comes to the rescue in this type of situation. First, monitor using the counters that Table 1 lists and set performance thresholds on each counter. This setup will provide you with your system's general performance baseline, but you'll need more data to determine which application or process is swamping your system. To obtain this information, use Performance Monitor's alert feature to start any action based on an event that you define (such as when your counters reach their maximum performance thresholds).

For this example, set an alert to start a copy of the Performance Monitor counter logs when CPU usage exceeds 98 percent. (Occasional peaks in CPU usage might trigger this alert even when a problem doesn't exist. You can use third-party tools to start additional performance collection based on more advanced logical sequences—for example, when CPU usage exceeds 90 percent for 5 minutes, start additional performance data collection. For more information about these tools, see the sidebar "Third-Party Monitoring Tools" at the end of this article.) To configure this alert, start Performance Monitor, expand Performance Logs and Alerts, and select Alerts. Right-click in the right pane, and select New, Create New Alert Settings, and then insert a name. Add the counters that you want to monitor and their threshold for triggering an action; select the Action tab, the Start Performance log option, a counter log to start, and the Schedule tab; and fill in the times that you want to run the monitor. Use a counter log that collects data from at least the counters that Table 1 lists and all the counters and instances under the Process object.

With this setup, Performance Monitor will alert you when your system has a performance problem, and the software will provide you with quantifiable and empirical data that illustrates which process is causing the problem. (Performance Monitor will provide this information in the detailed counter logs that the tool started only after your system reached a certain threshold.)

Performance Monitor's alert feature is flexible. You can tell the alert function to start any script or application. You can have the system send you an email message or start a batch file that pings (for example, ping.exe), and then trace routes (for example, using tracert.exe) the network path to a distant system with which you want to interact. In this manner, you can measure the network response time to determine whether your network has problems.