WINDOWS 1002000 PROFESSIONAL RESOURCE KIT [Electronic resources] نسخه متنی

Monitoring Tools

The primary monitoring tools in Windows 2000 are the Performance console and Task Manager. Task Manager offers an immediate overview of system activity and performance, and the Performance console provides detailed information that can be used for troubleshooting and bottleneck analysis. The Performance console hosts two tools: System Monitor, and Performance Logs and Alerts. The chapters in the Performance Monitoring section of the Windows 2000 Resource Kit concentrate on using the Performance console. The following sections describe the tools that are installed with the operating system.

You can start the Performance console from the Administrative Tools menu. To use the Administrative Tools menu in Windows 2000 Professional:

Add the Administrative Tools menu to the Programs menu.

- Or -

Use the Administrative Tools menu in Control Panel.

To add the Administrative Tools menu to the Programs menu on a computer running Windows 2000 Professional

On the Start menu, point to Settings, and then click Taskbar & Start Menu.

Click the Start Menu Options tab. Under Start Menu Settings, select the Display Administrative Tools check box, and then click OK.

Click the Start button again, point to Programs, and then click Administrative Tools.

To use the Administrative Tools menu in Control Panel

Double-click My Computer on the Windows 2000 desktop.

Under My Computer, double-click Control Panel.

In Control Panel, double-click Administrative Tools.

System Monitor in Windows 2000 extends the functionality provided by Performance Monitor, which shipped in Microsoft Windows NT 4.0 and Windows NT 3.51. Features of System Monitor include the following:

The graph display is much more flexible and configurable. You can modify many attributes of the display, including changing font and color, adding borders, and so on.

Counter configuration is simplified. You can now copy counter paths and settings from the System Monitor display to the Clipboard and paste counter paths from Web pages or other sources into the System Monitor display.

Graphs can be printed when performance displays are saved as HTML files using the Save As command on the shortcut menu. In addition, you can save reports as tab-separated files (for use with Microsoft® Excel) by means of the Save As command. To use the shortcut menu, right-click the details pane of System Monitor.

System Monitor is portable. Because System Monitor is hosted in Microsoft Management Console (MMC), you can save a console file containing a group of counters that you want to monitor-you can install it on any other computer and be able to monitor the same types of data on that computer. This is useful in monitoring other systems that you administer.

The functionality of System Monitor chart, histogram, and report views is provided by an ActiveX control (Sysmon.ocx). This design gives a user the flexibility of including the control in an HTML page or of programming the control into a Microsoft Office or Microsoft® Visual Basic® application, as described in "Integrating the System Monitor Control into Office and Other Applications" later in this chapter. In most cases, you work with the control's functionality in the form it is presented in Perfmon.msc, the Microsoft Management Console component that hosts the performance tools.

For information about logging and alert capabilities of the Performance console, see "Performance Logs and Alerts" later in this chapter. Windows NT 4.0 Performance Monitor is provided under the name Perfmon4.exe on the Windows 2000 Resource Kit companion CD. Typing perfmon.exe at the command prompt causes the system to start System Monitor, not Performance Monitor.

Starting System Monitor

If you are running Windows 2000 Professional, you can start the Performance console as follows:

On the Administrative Tools menu, click Performance.

- Or -

On the Start menu, click Run, type perfmon.msc, and then click OK.

- Or -

Type perfmon.msc at the Windows command prompt.

When you start the Performance console, a blank System Monitor graph appears. Performance Logs and Alerts appears beneath System Monitor in the console tree, as shown in Figure 27.2.

Figure 27.2 Performance Console

The following section describes the user interface for System Monitor and provides tips on how to use it.

Working with System Monitor

With System Monitor you can create graphs, bar charts (histograms), and text reports of performance counter data. System Monitor is designed for short-term viewing of data, troubleshooting, and diagnosis.

The System Monitor display consists of the following elements:

An optional toolbar with capabilities such as copying and pasting counters, clearing counters, adding counters, and so on. The toolbar buttons provide the quickest way of configuring the monitoring display, but you can also use a shortcut menu to add counters and configure properties.

The area where counter values are displayed. You can vary the line style, width, and color of these lines. You can also change the color of the window and of the chart within the window.

A legend showing the selected counters and associated data such as the computer name, parent object, and instances.

A value bar, where you see the last, minimum, maximum, and average values for the counter that is currently selected. The value bar also shows a Duration value that indicates the total elapsed time displayed in the graph (based on the update interval).

A timer bar that moves across the graph indicates the passing of each update interval. Regardless of the update interval, the view shows up to 100 samples. System Monitor compresses log data as necessary to fit it in the display. For example, if there are 1,000 samples, the display might show every tenth sample.

You can configure System Monitor using either the toolbar or a shortcut menu. Using the shortcut menu offers more control and flexibility in configuring the display. The following sections describe these different configuration methods. To see procedures and a brief overview of System Monitor, click Help on the System Monitor toolbar.

Using the Toolbar

The toolbar is displayed by default. Using the toolbar, you can configure the following options:

Type of display. Use the View Chart, View Histogram, or View Report button.

Figure 27.3 shows the different display options.










Figure 27.3 Display Options for System Monitor


Histograms and reports are useful for simplifying graphs with multiple counters. However, they display only a single value, so they are recommended only when you are charting current activity and watching the graphs as they change. When you are reviewing data logged over time, line graphs are much more informative so that trends can be identified.

Data source. Click the View Current Activity button for real-time data or the View Log File Data button for data from either a completed or a currently running log.

Counters. Use the Add or Delete buttons as needed. You can also use the New Counter Set button to reset the display and select new counters. Clicking the Add button displays the Add Counters dialog box, as shown in Figure 27.4. You can also press the DEL key to delete a counter that is selected in the legend.




Figure 27.4 Add Counters Dialog Box


Data updates. Click Clear Display to clear the displayed data and obtain a fresh data sample for existing counters. To suspend data collection, click Freeze Display. Use the Update Data button to resume collection.

Highlighting chart or histogram data. To accentuate the line or bar for a selected counter with white (default) or black (for light backgrounds), click Highlight on the toolbar.

Importing or exporting counter settings. To save the displayed configuration to the Clipboard for insertion into a Web page, click Copy Properties. To import counter settings from the Clipboard into the current System Monitor display, click Paste Counter List.

Configuring other System Monitor properties. To access colors, fonts, or other settings that have no corresponding button on the toolbar, click Properties.

Using the Shortcut Menu

When you right-click the System Monitor display, a shortcut menu appears with the following options:

Add Counters. Use this option in the same way you use the Add button in the toolbar.

Save As. Use this if you want to save the current display configuration under a new name. If you click Save on the Console menu, the current settings are stored, overwriting the blank version of Perfmon.msc installed by Windows 2000 Setup and altering the default appearance of the tool.

Properties. Click this button to access the five properties tabs that provide options for controlling all aspects of System Monitor data collection and display. The General properties tab appears by default, as shown in Figure 27.5.




Figure 27.5 General Tab in the System Monitor Properties Dialog Box


Many properties can be configured from the toolbar, but some are only configurable using System Monitor Properties. Table 27.2 lists property tabs alphabetically by name, along with the attributes they control.

Table 27.2 System Monitor Properties

Getting the Most from System Monitor

Windows 2000 Professional online Help for System Monitor explains how to perform common tasks. The following list supplements the information provided in online Help to enable you to use System Monitor more effectively.

Print data. You can print performance data in several ways:




Copy the current view to the Clipboard (by pressing ALT+PRINT SCREEN), start a paint program, paste in the image from the Clipboard, and then print it.

Add the System Monitor control to a Microsoft Office application such as Microsoft Word or Microsoft Excel, configure it to display data, and then print from that program. For information about this process, see "Integrating the System Monitor Control into Office and Other Applications" later in this chapter.

Save the System Monitor control as an HTML file by right-clicking the details pane of System Monitor and typing a file name for the HTML file to be created. You can then open the HTML file and print it from Microsoft® Internet Explorer or another program.

Import a log file in comma-separated (.csv) or tab-separated (.tsv) format into an Excel spreadsheet and print from that application.




Learn about individual counters. When adding counters, if you click Explain in the Add Counters dialog box for System Monitor or Performance Logs and Alerts, you can view counter descriptions.

Vary the data displayed in a report. By default, reports display only one value for each counter. This is current data if the data source is real-time activity, or averaged data if the source is a log. However, using the General properties tab, you can configure the report display to show different values, such as the maximum, minimum, and so on. Notice that monitoring the nondefault value for a report can increase performance-monitoring overhead.

Arrange items in the legend. To sort entries in ascending or descending order for that category, click Object, Counter, Instance, or Computer in the counter legend. For example, to sort all counters by name, click Counter.

Select a group of counters or counter instances to monitor.




To select all counters or instances, click All counters or All instances.

To select specific counters or instances, click Select counters from the list or Select instances from the list.

To monitor a group of consecutive counters or instances in a list box, hold down the SHIFT key and scroll down through the items in the list box.

To select multiple, nonconsecutive counters or instances, select the item and press CTRL.

IMPORTANT

---

Monitoring large numbers of counters can incur a high amount of overhead, even to the point of making the system unresponsive to keyboard or mouse input. To reduce this burden, display data in report view when collecting from large numbers of counters or direct data to a binary log, and view the data in System Monitor as it is being written to the log.

Simplify detailed graphs. You can maintain two separate instances of System Monitor if you want to monitor a large number of counters while keeping each graph relatively simple and uncluttered. It is also a good way to compare data from different sources.

Track totals for all instances of a counter. Instead of monitoring individual instances for a selected counter, you can instead use the Total instance, which sums all instances' values and reports them in System Monitor.

Pinpoint a specific counter from lines in a graph. To match a line in a graph with the counter for which it is charting values, double-click a position in the line. If chart lines are close together, try to find a point in the graph where they diverge.

Accentuate a specific counter's data. To draw attention to a particular counter's data, use the highlighting feature. To do so, press CTRL+H or click Highlight on the toolbar. For the counter selected, a thick line replaces the colored chart line. For white or light-colored backgrounds (defined by the BackColor property), this line is black; for other backgrounds, this line is white.

View data from a running log. If you are working with a log file that is currently collecting data, you need to click the Select Time Range button and keep moving the Time Range bar to the right to update the display with new samples.

Use Windows NT 4.0 settings files. You can display legacy alert, report, chart, and log settings files in System Monitor by using the following command at the command prompt:

perfmon.exe settings_file_name

When you open one of these settings files, the system temporarily converts the file for use with System Monitor but discards the converted version after the console starts. If you want to save the settings file for permanent use with System Monitor, type the following command:

perfmon.exe /HTMLFILE:new_file_name settings_file_name

Performance Logs and Alerts, a service in Windows 2000, improves the logging and alert capabilities that were provided in Windows NT 4.0. Logging is used for detailed analysis and record-keeping purposes. Retaining and analyzing log data collected over a period of several months can be helpful for capacity and upgrade planning.

Windows 2000 provides two types of performance-related logs-counter logs and trace logs-and an alerting function. The following list describes these new or enhanced tools:

Performance Logs and Alerts replaces Performance Data Log in the Microsoft® Windows NT® Server 4.0 Resource Kit. As a result, data collection occurs regardless of whether any user is logged on to the computer.

In Windows 2000, counter logs record sampled data about hardware resources and system services based on performance objects and counters in the same manner as System Monitor. When a counter log has been started, the Performance Logs and Alerts service obtains data from the system when the update interval has elapsed.

Trace logs collect event traces that measure performance statistics associated with events such as disk and file I/O, page faults, or thread activity. When the event occurs, a data provider designed to track these events sends the data to the Performance Logs and Alerts service. The data is measured from start to finish, rather than sampled in the manner of System Monitor. The built-in Windows 2000 kernel trace data provider supports tracing system data; if other data providers are available, developers can configure logs with those providers as appropriate. A parsing tool is required to interpret the trace log output. Developers can create such a tool using APIs provided in the Platform Software Development Kit.

With the alerting function, you can define a counter value that will trigger actions such as sending a network message, running a program, or starting a log. Alerts are useful if you are not actively monitoring a particular counter threshold value but want to be notified when it exceeds or falls below a specified value so that you can investigate and determine the cause of the change. You might want to set alerts based on established performance baseline values for your system. For information about establishing a baseline, see "Starting Your Monitoring Routine" later in this chapter.

Viewing logged data is easier and more convenient. Counter logs can be viewed in System Monitor as they are collecting data as well as after data collection has stopped. Data in counter logs can be saved as comma-separated or tab-separated files that are easily viewed with Excel.

Logs can be circular—that is, recording data until they achieve a user-defined size limit and then starting over. Alternatively, linear logs collect data according to user-defined parameters such as: run for a specified length of time, stop when that parameter is met, and start a new log. A binary file format can also be defined for logging intermittent data (such as for a process that is not running when you start the log but that begins and ends during the logged interval).

You can save log settings to an HTML file or you can import settings from an HTML page to create new logs. When exported, the resulting HTML page hosts the System Monitor control, an ActiveX control that provides the performance monitoring user interface. If you open this page, you can dynamically observe, from a System Monitor view, the same counters you configured in the log. When imported, a new log or alert is created, based on the settings in the HTML page. This is a convenient way to insert the same settings into both a log and an alert, if appropriate.

Configuring logs and alerts is flexible and easy to manage. Users can manage multiple logging sessions from a single console window. For each log, users can start and stop logging either manually, on demand, or automatically, at scheduled times or based on the elapsed time or the current file size. Users can also specify automatic naming schemes and stipulate that a program be run when a log is stopped.

In Windows 2000 Professional, the Performance Logs and Alerts component is available in the Performance console and in the Computer Management console. The following procedure describes how to open the component from these locations.

NOTE

---

This procedure assumes that you have added the Administrative Tools option to your Programs menu as described in "System Monitor" earlier in this chapter.

To start Performance Logs and Alerts from the Performance console

Click Start, point to Programs, and then click Administrative Tools.

Click Performance.

Double-click Performance Logs and Alerts to display the available tools.

Figure 27.6 shows the Performance Logs and Alerts console tree.

Figure 27.6 Performance Logs and Alerts Console Tree

Working with Logs and Alerts

To begin configuring logs and alerts, click the name of the tool to select it. If any logs or alerts have previously been defined, they will appear in the appropriate node of the details pane. A sample settings file for a counter log named System Overview is included with Windows 2000. You can use this file to see some basic system data such as memory, disk, and processor activity. For information about the types of data to monitor in your own configuration, see "Starting Your Monitoring Routine" later in this chapter.

Right-click in the details pane to create a new log or alert. You can do this in a new file or you can use settings from an existing HTML file as a template.

NOTE

---

You must have Full Control access to a subkey in the registry in order to create or modify a log configuration. (The subkey is HKEY_CURRENT_MACHINESYSTEMCurrentControlSetServicesSysmonLogLog_Queries.) In general, administrators have this access by default. Administrators can grant access to users by using the Security menu in Regedt32.exe. To run the Performance Logs and Alerts service, you must have the right to start or otherwise configure services on the system. Administrators have this right by default and can grant it to users by using Group Policy. For information about starting and using Group Policy, see Windows 2000 Help.

You are prompted to name your log or alert and then to define properties. Figure 27.7 is an illustration of the General properties tab for a counter log.

Figure 27.7 General Properties Tab for a Counter Log

If you are configuring a counter log or an alert, use the Add Counters dialog box to specify objects, counters, instances, and updating. If you are configuring a trace log, use the General properties tab shown in Figure 27.8.

Figure 27.8 General Properties Tab for a Trace Log

Each tool offers some unique properties. The ability to configure scheduling is common to logs and alerts, but some options might not be available for all tools. Table 27.3 describes the options available in each tool and the property tab to use to configure it.

Table 27.3 Summary of Log and Alert Properties

To start or stop a log or alert, right-click the name in the Performance Logs and Alerts window, point to All Tasks, and then click Start or Stop.

Getting the Most from Performance Logs and Alerts

Windows 2000 Professional online Help for Performance Logs and Alerts describes performing the most common tasks with logs and alerts. The following list provides some additional hints about using the tools effectively:

Export log data to a spreadsheet for reporting purposes. Importing log data into a spreadsheet program such as Excel offers benefits, such as easy sorting and filtering of data. To format the data for easy export, configure the log file type as Text File-CSV or Text File-TSV on the Log Files properties tab.

Record transient data in a log. Not all counter log file formats can accommodate data that is not persistent throughout the duration of the log. If you want to record intermittent data such as a process that starts after you start the log, select the binary linear or circular file format on the Log Files tab.

Limit log file size to avoid disk-space problems. If you choose automated counter logging with no scheduled stop time, the file will grow to the maximum size allowed based on available space on your disk up to 1 gigabyte (the largest log file that System Monitor can read). Trace logs have no file-size limit. When setting this option, take into consideration your available disk space and any disk quotas that are in place. Change the file path from the default (the Perflogs folder on the local computer) to a location with adequate space if appropriate. An error might occur if your disk runs out of disk space due to logging.

Name files for easy identification. Use File name and End file names with on the Files properties tab to make it easy to find specific log files. For example, if you set up periodic logging, such as a log for every day of the week, you can develop different naming schemes with the base name being the computer where the log was run, or the type of data being logged, followed by the date as the suffix. For example, you could have a scheme that generates a file named Workstation1_050212.blg, meaning it was created on a computer named Workstation1 at noon, assuming the End file name with entry was set at mmddhh.

Determine what trace data providers are available for trace logging. On the General properties tab, click Provider Status to see all data providers that have been installed. To see only enabled (running) data providers, click the Show only enabled providers check box in the Provider Status dialog box. For more information about WMI data providers, see the WMI SDK documentation in the MSDN Library at http://windows.microsoft.com/windows2000/reskit/webresources. You can have only one instance of each provider running at the same time.

Task Manager provides information about applications currently running on your system, the processes and memory usage or other data about those processes, and statistics about memory and processor performance.

Comparison with System Monitor

Although useful as a quick reference to system operation and performance, Task Manager lacks the logging and alert capabilities of the Performance console. In addition, although the data displayed by Task Manager comes from the same source as some performance counters, Task Manager does not have access to the breadth of information available from all installed counters. However, Task Manager provides capabilities not available with the Performance console, as described in Table 27.4. For information about these capabilities, see online Help for Task Manager and the chapters identified in Table 27.4.

Table 27.4 Other Chapters on Task Manager

Starting Task Manager

To start Task Manager, use any of these methods:

Press CTRL+SHIFT+ESC.

Right-click the taskbar, and then click Task Manager.

Press CTRL+ALT+DEL, and then click Task Manager.

You can also start Task Manager at the command prompt or the Run dialog box.

Working with Task Manager

Task Manager has three tabs: Applications, Processes, and Performance. While Task Manager is running, the status bar always displays the total number of processes, CPU use, and virtual memory use for the system. Note the following display possibilities:

All Task Manager columns can be resized.

Clicking a column sorts its entries in ascending or descending order.

Select Always on Top from the Options menu to keep the window in view as you switch between applications.

Press CTRL+TAB to toggle between tabs, or click the tab.

When Task Manager is running, an accurate miniature CPU usage gauge appears on the taskbar on the end opposite the Start button. When you place the mouse pointer over this icon, it displays the percentage of processor use in text format. The miniature gauge always matches the CPU Usage History chart on the Performance tab, as shown in Figure 27.9.

Figure 27.9 Task Manager CPU Gauge Shown on the Taskbar

To make Task Manager the top window, double-click the gauge, or right-click the gauge and then select Task Manager from the menu that appears.

If you run Task Manager frequently and do not want to see its button on the taskbar, click Hide When Minimized on the Options menu. To open an instance of Task Manager when it is hidden, click the Task Manager CPU gauge on the taskbar.

You can control the rate at which Task Manager updates its counts by setting the Update Speed option on the View menu.

High. Updates every half-second.

Normal. Updates once per second.

Low. Updates every four seconds.

Paused. Does not update automatically. Press F5 to update.

This will reduce Task Manager overhead, but might cause you to miss some data. You can force an update at any time by clicking Refresh Now on the View menu or by pressing F5.

Monitoring Processes

In Task Manager, click the Processes tab to see a list of running processes and measures of their performance. The Task Manager process table includes all processes that run in their own address space, including all applications and system services.

To include those in the display, on the Options menu, click Show 16-bit Tasks. Figure 27.10 shows an example of how Task Manager displays process information.

Figure 27.10 Processes Tab in Task Manager

NOTE

---

System Monitor displays its values in bytes, whereas Task Manager displays its values in kilobytes, which are units of 1,024 bytes. When you compare System Monitor and Task Manager values, multiply Task Manager values by 1,024.

To add to or remove performance measures from the display for the processes listed, on the View menu, click Select Columns. Table 27.5 briefly describes the measures and their System Monitor counterparts, if any.

Table 27.5 Comparison of Process Data Supplied by Task Manager and System Monitor

For more information about Task Manager and its use in monitoring processor and memory performance, see the following chapters in this book:

"Evaluating Memory and Cache Usage" in this Resource Kit

"Analyzing Processor Activity"in this Resource Kit

For multiprocessor systems, also see "Measuring Multiprocessor System Activity" in the Server Operations Guide.

Monitoring the System

To see a dynamic overview of system performance, including a graph and numeric display of processor and memory usage, click the Task Manager Performance tab, as shown in Figure 27.11.

Figure 27.11 Task Manager Performance Tab

To graph the percentage of processor time in privileged or kernel mode, click Show Kernel Times on the View menu. This is a measure of the time that applications are using operating system services. The remaining time, known as user mode, is spent running threads within the application code.

Users of multiple-processor computers can click CPU History on the View menu and then graph the non-idle time of each processor in a single graph or in separate graphs.

The following table briefly describes the counts on the Performance tab and their System Monitor counterparts, if any.

Table 27.6 Comparison of System Data Provided by Task Manager and System Monitor

Resource Kit Performance Tools

The Windows 2000 Resource Kit companion CD contains other performance-related tools, such as the following:

Ctrlist.exe. This prints counter descriptions to a file or to the screen.

Extctrlst.exe. This lists all counter DLLs that are running and provides the capability of disabling them. For more information about disabling counters, see "Troubleshooting Problems with Performance Tools" later in this chapter.

Perfmtr.exe. This command-line tool is useful for dynamically monitoring performance statistics relating to memory, processor, and I/O activity.

Showperf.exe. This program is useful for developers who want to see the counter type, index, and the contents of the Performance Data block so they can view and debug the counter's raw data structure.

Typeperf.exe. This is a command-line tool for displaying performance information from individual performance counters.

For information about the tools listed, see the Windows 2000 Resource Kit Tools Help. Programs used in specific bottleneck analysis contexts are described in the chapters to which they apply.