11 MAINTAINING A NETWORK INFRASTRUCTURE Chapter 11

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE2 OVERVIEW  Use System Monitor to view computer performance statistics in real time.  Use Performance Logs And Alerts to capture counter information to log files.  Use Network Monitor to capture and analyze network traffic.  Describe the elements of a backup strategy and their functions.  Use System Monitor to view computer performance statistics in real time.  Use Performance Logs And Alerts to capture counter information to log files.  Use Network Monitor to capture and analyze network traffic.  Describe the elements of a backup strategy and their functions.

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE3 OVERVIEW (continued)  Understand the difference between full, incremental, and differential backup jobs.  List the steps involved in creating a backup plan.  Configure Windows Server 2003 Remote Assistance.  List the security features protecting computers that use Remote Assistance.  Configure Windows Server 2003 Remote Desktops.  Understand the difference between full, incremental, and differential backup jobs.  List the steps involved in creating a backup plan.  Configure Windows Server 2003 Remote Assistance.  List the security features protecting computers that use Remote Assistance.  Configure Windows Server 2003 Remote Desktops.

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE4 USING THE PERFORMANCE CONSOLE  System Monitor  Displays real-time performance data collected from performance counters  Performance Logs And Alerts  Records data from performance counters over a period of time and executes specific actions when counters reach a certain value  System Monitor  Displays real-time performance data collected from performance counters  Performance Logs And Alerts  Records data from performance counters over a period of time and executes specific actions when counters reach a certain value

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE5 USING SYSTEM MONITOR

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE6 MODIFYING THE GRAPH VIEW

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE7 USING THE HISTOGRAM AND REPORT VIEWS

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE8 ADDING COUNTERS

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE9 CREATING AN EFFECTIVE GRAPH DISPLAY  Limit the number of counters.  Modify the counter display properties.  Choose counters with comparable values.  Adjust the vertical scale.  Limit the number of counters.  Modify the counter display properties.  Choose counters with comparable values.  Adjust the vertical scale.

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE10 USING PERFORMANCE LOGS AND ALERTS  Counter log Captures statistics for specific counters to a log file  Trace log Records information about system applications when certain events occur  Alert Performs an action when the counter reaches a specified value  Counter log Captures statistics for specific counters to a log file  Trace log Records information about system applications when certain events occur  Alert Performs an action when the counter reaches a specified value

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE11 CREATING A COUNTER LOG

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE12 CREATING A TRACE LOG

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE13 VIEWING A COUNTER LOG

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE14 CREATING ALERTS

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE15 NETWORK TRAFFIC MONITORING  The Performance console can measure all network traffic on a specific interface or on a per-protocol basis for the following:  IPv4  ICMP  TCPv4  UDPv4  The Performance console can measure all network traffic on a specific interface or on a per-protocol basis for the following:  IPv4  ICMP  TCPv4  UDPv4

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE16 LOCATING SYSTEM BOTTLENECKS  A bottleneck is a component that is not providing an acceptable level of performance compared with the other components in the system.  Bottlenecks can appear for a variety of reasons, including:  Increased server load  Hardware failure  Changed server roles  A bottleneck is a component that is not providing an acceptable level of performance compared with the other components in the system.  Bottlenecks can appear for a variety of reasons, including:  Increased server load  Hardware failure  Changed server roles

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE17 MONITORING PROCESSOR PERFORMANCE  Processor: % Processor Time—Should be <85%  System: Processor Queue Length—Should be <10  Server Work Queues: Queue Length—Should be <4  Processor: Interrupts/Sec—Will vary, depending on configuration  Processor: % Processor Time—Should be <85%  System: Processor Queue Length—Should be <10  Server Work Queues: Queue Length—Should be <4  Processor: Interrupts/Sec—Will vary, depending on configuration

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE18 MONITORING MEMORY PERFORMANCE  Memory: Page Faults/Sec—Should be <5  Memory: Pages/Sec—Should be <20  Memory: Available Bytes—Should not fall below 5% of the system’s total physical memory  Memory: Committed Bytes—Should always be less than the physical RAM in the computer  Memory: Pool Non-Paged Bytes—Should be a stable number that does not grow without a corresponding growth in server activity  Memory: Page Faults/Sec—Should be <5  Memory: Pages/Sec—Should be <20  Memory: Available Bytes—Should not fall below 5% of the system’s total physical memory  Memory: Committed Bytes—Should always be less than the physical RAM in the computer  Memory: Pool Non-Paged Bytes—Should be a stable number that does not grow without a corresponding growth in server activity

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE19 MONITORING DISK PERFORMANCE  PhysicalDisk: Disk Bytes/Sec—Should be equivalent to the levels established in the original baseline readings or higher  PhysicalDisk: Avg. Disk Bytes/Transfer—Should be equivalent to the levels established in the original baseline readings or higher  PhysicalDisk: Current Disk Queue Length—Should be <2 per disk spindle installed in the storage subsystem  PhysicalDisk: % Disk Time—Should be <80%  LogicalDisk: % Free Space—Should be >20%  PhysicalDisk: Disk Bytes/Sec—Should be equivalent to the levels established in the original baseline readings or higher  PhysicalDisk: Avg. Disk Bytes/Transfer—Should be equivalent to the levels established in the original baseline readings or higher  PhysicalDisk: Current Disk Queue Length—Should be <2 per disk spindle installed in the storage subsystem  PhysicalDisk: % Disk Time—Should be <80%  LogicalDisk: % Free Space—Should be >20%

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE20 MONITORING NETWORK PERFORMANCE  Network Interface: Bytes Total/Sec—Should be equal to baseline readings or higher  Network Interface: Output Queue Length—Preferably 0, <2 acceptable  Server: Bytes Total/Sec—Should be <50% of the total bandwidth capacity  Network Interface: Bytes Total/Sec—Should be equal to baseline readings or higher  Network Interface: Output Queue Length—Preferably 0, <2 acceptable  Server: Bytes Total/Sec—Should be <50% of the total bandwidth capacity

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE21 USING NETWORK MONITOR  Protocol analyzer application included with Windows Server 2003  Provides the ability to view header and payload data for common network protocols  Installed through Add Or Remove Programs tool in Control Panel.  Protocol analyzer application included with Windows Server 2003  Provides the ability to view header and payload data for common network protocols  Installed through Add Or Remove Programs tool in Control Panel.

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE22 NETWORK MONITOR VERSIONS  The version of Network Monitor included with Windows Server 2003:  Can only view information sent to and from the system on which it is installed  Is limited in the statistical information it can report  The version of Network Monitor included with Windows Server 2003:  Can only view information sent to and from the system on which it is installed  Is limited in the statistical information it can report

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE23 CAPTURING NETWORK TRAFFIC

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE24 USING CAPTURE AND DISPLAY FILTERS

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE25 PLANNING A BACKUP STRATEGY  Performing regular backups is one of the most important functions of the system or network administrator.  When developing a backup strategy, ask and answer two questions:  Why do we back up data?  Why do we need to back up data?  Performing regular backups is one of the most important functions of the system or network administrator.  When developing a backup strategy, ask and answer two questions:  Why do we back up data?  Why do we need to back up data?

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE26 BACKUP HARDWARE  Capacity  Speed  Cost  Capacity  Speed  Cost

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE27 UNDERSTANDING MAGNETIC TAPE COMPRESSION  Most backup hardware and software support compression to increase the capacity of a medium.  Most manufacturers quote uncompressed/ compressed statistics at a ratio of 2:1.  With some types of files, compression rates of up to 8:1 are possible.  Files that are already compressed will yield little or no further compression.  Most backup hardware and software support compression to increase the capacity of a medium.  Most manufacturers quote uncompressed/ compressed statistics at a ratio of 2:1.  With some types of files, compression rates of up to 8:1 are possible.  Files that are already compressed will yield little or no further compression.

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE28 USING AUTOCHANGERS  Reduce the need for manual intervention in backups  Allow you to back up more data  Preserve investment in media  Reduce the need for manual intervention in backups  Allow you to back up more data  Preserve investment in media

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE29 MEDIA COSTS  When evaluating backup hardware, consider the cost of media.  Media costs can sometimes be greater than the cost of the actual drive.  Media costs are ongoing: tapes must be periodically replaced.  Costs can be computed on a per-megabyte or per-gigabyte basis.  When evaluating backup hardware, consider the cost of media.  Media costs can sometimes be greater than the cost of the actual drive.  Media costs are ongoing: tapes must be periodically replaced.  Costs can be computed on a per-megabyte or per-gigabyte basis.

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE30 BACKUP SOFTWARE  Backup software provides mechanisms and features that allow backup tasks and routines to be configured and performed.  Backup software for Windows Server 2003 includes:  Windows Server 2003 Backup  Third-party software, such as Veritas Backup Exec and BrightStor ARCserve Backup  Backup software provides mechanisms and features that allow backup tasks and routines to be configured and performed.  Backup software for Windows Server 2003 includes:  Windows Server 2003 Backup  Third-party software, such as Veritas Backup Exec and BrightStor ARCserve Backup

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE31 CREATING A BACKUP PLAN  What data will be backed up  When backups will occur  Which tapes will be used and when  What data will be backed up  When backups will occur  Which tapes will be used and when

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE32 SELECTING BACKUP TARGETS

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE33 UNDERSTANDING BACKUP JOB TYPES  Full backup  Copies all the selected files to the backup medium and resets the archive bits for all the copied files  Incremental backup  Copies only the selected files that have archive bits and resets those archive bits  Differential backup  Copies only the selected files that have archive bits without resetting those archive bits  Full backup  Copies all the selected files to the backup medium and resets the archive bits for all the copied files  Incremental backup  Copies only the selected files that have archive bits and resets those archive bits  Differential backup  Copies only the selected files that have archive bits without resetting those archive bits

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE34 SCHEDULING BACKUP JOBS  Scheduling allows backups to be performed during off-hours.  Scheduling reduces potential for administrative error.  Media rotations use a specified number of tapes, telling you which tape to insert in the drive each day.  Scheduling allows backups to be performed during off-hours.  Scheduling reduces potential for administrative error.  Media rotations use a specified number of tapes, telling you which tape to insert in the drive each day.

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE35 PERFORMING RESTORES  Backup software should provide the following basic restoration options:  File selection  Restore location selection  Overwrite options  Backup software should provide the following basic restoration options:  File selection  Restore location selection  Overwrite options

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE36 USING VOLUME SHADOW COPY

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE37 PROVIDING SECURE NETWORK ADMINISTRATION  Remote Assistance  Remote Desktops  Remote Assistance  Remote Desktops

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE38 USING REMOTE ASSISTANCE  Remote Assistance allows administrative personnel to connect to a remote system in order to provide help to a user.  Experts can be restricted to viewing the remote system or be granted full access.  Remote Assistance can be enabled on a single system by accessing Control Panel, selecting System, and then Remote, or on multiple systems via group policy.  Remote Assistance allows administrative personnel to connect to a remote system in order to provide help to a user.  Experts can be restricted to viewing the remote system or be granted full access.  Remote Assistance can be enabled on a single system by accessing Control Panel, selecting System, and then Remote, or on multiple systems via group policy.

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE39 CREATING AN INVITATION

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE40 SECURING REMOTE ASSISTANCE  Invitations must be issued before a remote assistance session can be established.  The user must be present to accept a remote assistance session.  Clients can break the Remote Assistance connection at any time by pressing ESC.  Experts can be granted permission to view only the user’s desktop, or to take control of the system.  Firewalls should be configured to block port  Invitations must be issued before a remote assistance session can be established.  The user must be present to accept a remote assistance session.  Clients can break the Remote Assistance connection at any time by pressing ESC.  Experts can be granted permission to view only the user’s desktop, or to take control of the system.  Firewalls should be configured to block port 3389.

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE41 USING REMOTE DESKTOPS  Enables users to access computers from remote locations with no interaction required at the remote site  Allows you to operate the remote computer as though you were sitting at the console  Allows up to two simultaneous Remote Desktops connections on Windows Server 2003 without the need for a separate license  Enables users to access computers from remote locations with no interaction required at the remote site  Allows you to operate the remote computer as though you were sitting at the console  Allows up to two simultaneous Remote Desktops connections on Windows Server 2003 without the need for a separate license

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE42 ACTIVATING REMOTE DESKTOPS

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE43 USING THE REMOTE DESKTOPS CLIENT

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE44 CHAPTER SUMMARY  System Monitor is an MMC snap-in that monitors specific computer resources in real time.  Performance Logs And Alerts is an MMC snap-in that uses System Monitor’s performance counters to capture information to log files over a period of time.  Network Monitor is a protocol analyzer that can capture packets from the network and analyze their contents in detail.  System Monitor is an MMC snap-in that monitors specific computer resources in real time.  Performance Logs And Alerts is an MMC snap-in that uses System Monitor’s performance counters to capture information to log files over a period of time.  Network Monitor is a protocol analyzer that can capture packets from the network and analyze their contents in detail.

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE45 CHAPTER SUMMARY (continued)  Server performance degradations are often caused by a bottleneck, that is, a slowdown of a component that prevents the system from performing to its potential.  A network backup solution consists of backup drives, backup software, and a backup plan.  Server performance degradations are often caused by a bottleneck, that is, a slowdown of a component that prevents the system from performing to its potential.  A network backup solution consists of backup drives, backup software, and a backup plan.

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE46 CHAPTER SUMMARY (continued)  Automated System Recovery enables you to restore an entire computer without reinstalling the operating system.  Volume shadow copy is a Window Server 2003 feature that enables users to access multiple copies of files they have accidentally deleted or damaged.  Remote Assistance is a Windows Server 2003 and Windows XP feature that enables users to request assistance from an expert at another location.  Automated System Recovery enables you to restore an entire computer without reinstalling the operating system.  Volume shadow copy is a Window Server 2003 feature that enables users to access multiple copies of files they have accidentally deleted or damaged.  Remote Assistance is a Windows Server 2003 and Windows XP feature that enables users to request assistance from an expert at another location.

Chapter 11: MAINTAINING A NETWORK INFRASTRUCTURE47 CHAPTER SUMMARY (continued)  Remote Assistance cannot easily be abused because users must request help before experts can connect to their computers.  Remote Desktops enables administrators to connect to distant computers that are unattended, and to work with them as though they were seated at the system console.  Remote Assistance cannot easily be abused because users must request help before experts can connect to their computers.  Remote Desktops enables administrators to connect to distant computers that are unattended, and to work with them as though they were seated at the system console.