1. 11 MONITORING MICROSOFT WINDOWS SERVER 2003 Chapter 3

2. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20032 CHAPTER OVERVIEW  Use Event Viewer to monitor system logs.  Configure Task Manager to display performance data.  Use System Monitor to display real-time performance data.  Create counter logs and alerts.  Use Event Viewer to monitor system logs.  Configure Task Manager to display performance data.  Use System Monitor to display real-time performance data.  Create counter logs and alerts.

3. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20033 SERVER MONITORING PRACTICES Real-time monitoring  Uses tools that display a continuous stream of statistics about what the system is doing right now Logged monitoring  Enables administrators to observe trends that develop over longer periods of time than those observed in a typical real-time monitoring session Real-time monitoring  Uses tools that display a continuous stream of statistics about what the system is doing right now Logged monitoring  Enables administrators to observe trends that develop over longer periods of time than those observed in a typical real-time monitoring session

4. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20034 MONITORING SUBSYSTEMS  Processor  Disk  Memory  Network  Processor  Disk  Memory  Network

5. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20035 WHAT IS A BASELINE?

6. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20036 USING EVENT VIEWER

7. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20037 EVENT VIEWER LOGS Application  Information about specific programs running on the computer System  Events generated by components such as services and device drivers Security  Security-related events such as failed logons and attempts to access resources Application  Information about specific programs running on the computer System  Events generated by components such as services and device drivers Security  Security-related events such as failed logons and attempts to access resources

8. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20038 UNDERSTANDING EVENT TYPES

9. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20039 VIEWING EVENTS

10. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200310 EVENT LOG RETENTION SETTINGS

11. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200311 USING FILTERS

12. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200312 FINDING SPECIFIC EVENTS

13. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200313 ACCESSING REMOTE EVENT LOGS  Allows you to view event logs on another system.  Select Connect To Another Computer from the Action menu.  Allows you to view event logs on another system.  Select Connect To Another Computer from the Action menu.

14. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200314 ARCHIVING EVENT LOGS  Might be required in certain environments.  Reduces space used by log files.  Save as.evt files in order to view in Event Viewer.  Save as.txt or.csv files to import into other applications.  Might be required in certain environments.  Reduces space used by log files.  Save as.evt files in order to view in Event Viewer.  Save as.txt or.csv files to import into other applications.

15. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200315 USING TASK MANAGER  Real-time monitoring tool  Displays information on:  Processor and memory performance  Applications and processes  Network utilization  Users connected to the system  Real-time monitoring tool  Displays information on:  Processor and memory performance  Applications and processes  Network utilization  Users connected to the system

16. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200316 WORKING WITH APPLICATIONS

17. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200317 MONITORING PROCESSES

18. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200318 MONITORING PERFORMANCE LEVELS

19. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200319 MONITORING NETWORK ACTIVITY

20. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200320 MONITORING USERS

21. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200321 USING THE PERFORMANCE CONSOLE System Monitor  Displays real-time performance data collected from performance counters Performance Logs and Alerts  Records data from performance counters over a period of time and executes specific actions when counters reach a certain value System Monitor  Displays real-time performance data collected from performance counters Performance Logs and Alerts  Records data from performance counters over a period of time and executes specific actions when counters reach a certain value

22. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200322 USING SYSTEM MONITOR

23. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200323 MODIFYING THE GRAPH VIEW

24. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200324 HISTOGRAM VIEW

25. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200325 REPORT VIEW

26. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200326 ADDING COUNTERS

27. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200327 CREATING AN EFFECTIVE DISPLAY  Limit the number of counters.  Modify the counter display properties.  Choose counters with comparable values.  Limit the number of counters.  Modify the counter display properties.  Choose counters with comparable values.

28. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200328 SAVING A SYSTEM MONITOR CONSOLE  Allows you to access commonly used counters more easily  Reduces time needed to monitor critical components  Can allow you to develop an eye for issues  Allows you to access commonly used counters more easily  Reduces time needed to monitor critical components  Can allow you to develop an eye for issues

29. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200329 WHAT IS A BOT TLENECK?

30. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200330 MONITORING PROCESSOR PERFORMANCE Processor: % Processor Time  Should be < 85% System: Processor Queue Length  Should be < 10 Server Work Queues: Queue Length  Should be < 4 Processor: Interrupts/sec  Varies depending on configuration Processor: % Processor Time  Should be < 85% System: Processor Queue Length  Should be < 10 Server Work Queues: Queue Length  Should be < 4 Processor: Interrupts/sec  Varies depending on configuration

31. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200331 MONITORING MEMORY PERFORMANCE Memory: Page Faults/Sec  Should be < 5 Memory: Pages/Sec  Should be < 20 Memory: Available Bytes  Should not fall below 5 percent of the system’s total physical memory Memory: Committed Bytes  Should always be less than the physical RAM in the computer Memory: Pool Non-Paged Bytes  Should be a stable number that does not grow without a corresponding growth in server activity Memory: Page Faults/Sec  Should be < 5 Memory: Pages/Sec  Should be < 20 Memory: Available Bytes  Should not fall below 5 percent of the system’s total physical memory Memory: Committed Bytes  Should always be less than the physical RAM in the computer Memory: Pool Non-Paged Bytes  Should be a stable number that does not grow without a corresponding growth in server activity

32. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200332 MONITORING DISK PERFORMANCE PhysicalDisk: Disk Bytes/sec  Should be equivalent to the levels established in the original baseline readings or higher PhysicalDisk: Avg. Disk Bytes/Transfer  Should be equivalent to the levels established in the original baseline readings or higher PhysicalDisk: Current Disk Queue Length  Should be < 2 PhysicalDisk: % Disk Time  Should be < 80% LogicalDisk: % Free Space  Should be > 20% PhysicalDisk: Disk Bytes/sec  Should be equivalent to the levels established in the original baseline readings or higher PhysicalDisk: Avg. Disk Bytes/Transfer  Should be equivalent to the levels established in the original baseline readings or higher PhysicalDisk: Current Disk Queue Length  Should be < 2 PhysicalDisk: % Disk Time  Should be < 80% LogicalDisk: % Free Space  Should be > 20%

33. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200333 MONITORING NETWORK PERFORMANCE Network Interface: Bytes Total/sec  Should be equal to baseline readings or higher Network Interface: Output Queue Length  Preferably 0, < 2 acceptable Server: Bytes Total/sec  Should be < 50 percent of the total bandwidth capacity Network Interface: Bytes Total/sec  Should be equal to baseline readings or higher Network Interface: Output Queue Length  Preferably 0, < 2 acceptable Server: Bytes Total/sec  Should be < 50 percent of the total bandwidth capacity

34. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200334 MONITORING SERVER ROLES  Different server roles place different demands on underlying hardware.  Different server roles require different components to be monitored.  Be aware of overmonitoring.  Table 3-3  Different server roles place different demands on underlying hardware.  Different server roles require different components to be monitored.  Be aware of overmonitoring.  Table 3-3

35. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200335 USING PERFORMANCE LOGS AND ALERTS Counter logs  Captures statistics for specific counters to a log file Trace logs  Records information about system applications when certain events occur Alerts  Performs an action when the counter reaches a specified value Counter logs  Captures statistics for specific counters to a log file Trace logs  Records information about system applications when certain events occur Alerts  Performs an action when the counter reaches a specified value

36. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200336 CREATING A COUNTER LOG

37. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200337 CREATING A TRACE LOG

38. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200338 VIEWING A COUNTER LOG

39. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200339 CREATING ALERTS

40. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 200340 CHAPTER SUMMARY  Event Viewer is an MMC snap-in that displays logs maintained by the computer.  Task Manager displays real-time performance data for the computer.  The Performance console consists of two snap-ins: System Monitor and Performance Logs and Alerts.  System Monitor shows real-time performance data for system hardware and software components using graph, histogram, and report views.  Performance Logs and Alerts records performance counter information to counter logs and operating system events to trace logs over scheduled periods of time, enabling you to capture large data samples for later examination.  Event Viewer is an MMC snap-in that displays logs maintained by the computer.  Task Manager displays real-time performance data for the computer.  The Performance console consists of two snap-ins: System Monitor and Performance Logs and Alerts.  System Monitor shows real-time performance data for system hardware and software components using graph, histogram, and report views.  Performance Logs and Alerts records performance counter information to counter logs and operating system events to trace logs over scheduled periods of time, enabling you to capture large data samples for later examination.