Window Server Monitoring
Content
Window Server Monitors
About Server Monitoring
• Server Monitoring
• Process to monitor server's system.
• Fundamentally concerned with observing how a
server reacts to the operating load placed upon
it or during various types of performance
testing
Purpose of Server
Monitoring
•
Server Health Check
• Bottleneck Identification
• Capacity Planning
Tools Used
• Multiple licensed and open source tool exist to
generate load and retrieve server statistics.
• Below tools are used by us for the monitoring
purpose
• HP Load Runner
• IBM RPT
• Both LR and RPT in turn draws information from
windows native tool performance monitor and
represent data / measurements in their own
manner
Windows Built-In Tools
• Windows has two built-in tools to keep tab of system
resources:
• Resource Monitor
• See which programs and/or services are consuming windows system
resources.
• Builds on Task Manager by adding more detail in one easy-to-use
interface.
• Provides quick summary of overall CPU, disk, network and memory
utilization
• Performance Monitor
• lets you examine a large number of counters for system
processes/services
• Presents performance data in real time or through the collection of
data inside log files that can be reviewed as needed.
• Collects performance data based on counters, which are
measurements of system activity or the current system state.
What’s there in Server
• Hardware Components
•
•
•
•
CPU
Hard Disk
RAM
Network Interface Controller
• Window server performance can be altered by altering
these hardware components
• OS
• Software that manages computer hardware and
software resources and provides common services for
computer programs.
• Windows separates application-oriented software
from OS software.
OS
Know First
• Kernel
• Kernel & Hardware
• Modes
Kernel
• Kernel
• Most used and most fundamental components of the OS.
• Computer program that manages input/output requests
from software, and translates them into data processing
instructions for the central processing unit and other
electronic components of a computer.
• Privileged mode or kernel mode.
• OS software runs in this mode
• software has access to system data and to the hardware.
• User Mode
• The remaining software, runs in user mode, has limited
access to system data.
Kernel & Hardware
• The kernel's primary function is to mediate access
to the computer's resources
Agenda
• Basics of server monitored components
•
•
•
•
Memory
CPU
DISK
Network Interface
• Different counters related to each component
Memory
Know First
• Virtual Memory
• Paging
• Page Faults
• Page Pooling
Virtual Memory
• Optimization technique implemented by the
operating system
• Unlike RAM, doesn’t physically exist on
memory chip
• Functions with the help of paging
• Allows an application program the impression
that it has more memory than actually exists.
• Hence allows the use of programs that are
too big to physically fit in memory.
• Allow for multitasking – multiple programs
running at once.
Virtual Memory-Includes
Reserved
Memory
Committed
memory
Available
Memory
• Set of contiguous
addresses that
the VMM set
aside for a
process
• Not count against
the process's
memory quota
until it is used.
• VMM saves space
for process in
Pagefile.sys in
case it needs to
be written to
disk.
• Commit limit is
the amount of
memory that can
be committed
without
expanding the
paging file.
• If disk space is
available, the
paging file can
expand, and the
commit limit will
be increased.
• Available
memory includes
free memory,
zeroed memory
and memory on
the standby list,
which has been
removed from a
process's working
set but might be
reclaimed.
Paging
Paging
• Whenever the O.S. needs a ‘block’ of memory that’s not in RAM, the VMM
takes a block from the real memory that hasn’t been used recently, writes
it to the paging file, and then reads the block of memory that the O.S.
needs from the paging file. The VMM then takes the block of memory from
the paging file, and moves it into the real memory – in place of the old
block.
• Data can be stored in the paging file on the hard disk, but it is not usable
until that data is brought into the RAM.
Paging
•Paging File
•VMM creates a file on the hard disk
that holds the extra memory that is
needed by the O.S
•The paging file combined with the
RAM accounts for all of the memory.
•Pages
•Blocks of memory that are swapped
are called pages.
Page Fault
• Page fault occurs when a program requests a
page of code or data is not in its working set
• A hard page fault occurs when the requested page
must be retrieved from disk.
• Hard faults cause paging(excessive is called thrashing),
which can degrade performance as accessing the
hard disk is slow and takes time
• A soft page fault occurs when then the requested
page is found elsewhere in physical memory.
• Soft page faults can be satisfied quickly and relatively
easily by the Virtual Memory Manager,
Page Pooling
• Pool Resources
• When a machine boots up, the Memory Manager
creates two dynamically sized memory pools that
kernel-mode components use to allocate system
memory.
• Paged Pool
• Paged Pool is exactly what its name implies - it can be
paged out
• Non Paged Pool
• The Non Paged Pool cannot be paged out.
• Drivers use the Non Paged Pool for many of their
requirements because they can be accessed at any
Interrupt Request Level (IRQL).
Memory Counters
MemoryCounters
Processor
Know First
• Processor
• Process & Threads
• Some More Terms
Processor
• Chip/ logic circuitry that responds to and
processes the basic instructions that drive a
computer.
• Basic system instructions may include processing
mouse and keyboard input and running
applications.
• Processors are associated with the operating
system and user programs support at least two
modes of execution -privileged & user mode
Process & Threads
• Process
• Executing instance of an application.
• A collection of one or more threads and associated system
resources such as memory, open files and devices.
• A process has a virtual address space, executable code,
open handles to system objects, a security context, a
unique process identifier, environment variables, a priority
class, minimum and maximum working set sizes, and at
least one thread of execution.
Process & Threads
• Thread
• Entity within a process that can be scheduled for
execution.
• All threads of a process share its virtual address space and
system resources.
• Each thread maintains exception handlers, a scheduling
priority, thread local storage, a unique thread identifier,
and a set of structures the system will use to save the
thread context until it is scheduled.
• The Idle Process
• When not executing the thread of an active user or system
process, processor execute a thread of a process
called Idle.
• It has such a low base priority that it runs only when
nothing else is scheduled to run.
Multithreading
• Ability of a program to manage its use by
more than one user at a time and to even
manage multiple requests by the same user
without having to have multiple copies of the
programming running in the computer.
• For example, word processor that prints a document
using a background thread, but at the same time
another thread is running that accepts user input, so
that you can type up a new document.
Some more Terms
• Multitasking
• Threads aren't allowed to run until done.
Instead, precious time with the processor is
allowed for a pre-set amount of time, called
a time slice, and then the thread is "preempted" to allow other threads to run.
• Scheduling
• The system scheduler controls multitasking
by determining which of the competing
threads receives the next processor time
slice. The scheduler determines which
thread runs next using scheduling priorities.
Thread Priority
• Threads are scheduled to run based on
their scheduling priority. Each thread is assigned a
scheduling priority. The priority levels range from zero
(lowest priority) to 31 (highest priority).
• As time passes and a thread doesn't get CPU time then
its priority will be dynamically adjusted upward to
ensure that eventually it will get time on the processor
Context Switches
• The scheduler maintains a queue of executable
threads for each priority level. These are known
as ready threads.
• When a processor becomes available, the system performs
a context switch as below:
• Save the context of the thread that just finished executing.
• Place the thread that just finished executing at the end of
the queue for its priority.
• Find the highest priority queue that contains ready threads.
• The most common reasons for a context switch are:
• The time slice has elapsed.
• A thread with a higher priority has become ready to run.
• A running thread needs to wait.
Privileged Mode Vs User
Mode
• Privileged or kernel mode
• Processing mode that allows code to have direct
access to all hardware and memory in the
system.
• I/O operations and other system services run in
privileged (kernel) mode
• User mode
• User applications run in user mode.
• Unless they are graphics-intensive or I/Ointensive (such as file and print services), most
applications should not be processing much
work in kernel mode.
Processor Counters
• % Processor Time_Total Instance
• Percentage of elapsed time a CPU is busy executing a non idle
thread (An indicator or processor activity).
• Processor % Time of sustained at or over 85% may indicate that
processor performance (for that load) is the limiting factor.
• % Privilege Time
• Percent of threads running in privileged mode (file or network I/O,
or allocate memory)
• Processor % Privilege Time consistently over 75 percent indicates a
bottleneck.
• Processor Queue Length
•
Number of tasks ready to run than the processors can get to.
•
High values many not necessarily be bad for % Processor Time. However, if the other
processor-related counters are increasing linearly such as % Privileged Time or Processor
Queue Length, high CPU utilization may be worth investigating.
• Less than 60% consumed = Healthy
• 51% – 90% consumed = Monitor or Caution
• 91% – 100% consumed = Critical or Out of Spec
Processor Counters
• System\Context Switches /sec.
• Occurs when higher priority threads preempts lower priority
threads that are currently running, and can indicate when too
many threads are competing for processor time.
• If much processor utilization is not seen and very low levels of context
switching are seen, it could indicate that threads are blocked
• As a general rule, context switching rates of less than 5,000 per
second per processor are not worth worrying about. If context
switching rates exceed 15,000 per second per processor, then there
is a constraint.
DISK
Know First
• Disk storage is a general category of storage
mechanisms where data are recorded by various
electronic, magnetic, optical, or mechanical
changes to a surface layer of one or more rotating
disks.
• Disk drive is a device implementing such a
storage mechanism and is usually distinguished
from the disk medium
• Different types like HDD, FDD
Know First
• Physical Disk
• Actual physical HDD
• Collection of disk partitions used to store all server
data
• Logical Volume
• Logical Disk refers to a Volume that has been
created on that disk.
• Presents a user with a contiguous address space;
that is, a logical volume simulates one large
contiguous storage space by using regions of
different disks
• A logical volume manages physical volumes by
Disk Counters
• Perfmon has two objects related to disk
performance:
• The Physical Disk performance object
• Monitors disk drives on the computer.
• Identifies the instances representing the physical
hardware
• Counters are the sum of the access to all
partitions on the physical instance.
• The Logical Disk Performance object
• Monitors logical partitions.
• Performance monitor identifies logical disks by
their drive letter or mount point.
Disk Counters
Disk Counter
Quiz Time
References
• http://blogs.technet.com/
• http://www.tenouk.com/ModuleT.html
• http://msdn.microsoft.com/
About Server Monitoring
• Server Monitoring
• Process to monitor server's system.
• Fundamentally concerned with observing how a
server reacts to the operating load placed upon
it or during various types of performance
testing
Purpose of Server
Monitoring
•
Server Health Check
• Bottleneck Identification
• Capacity Planning
Tools Used
• Multiple licensed and open source tool exist to
generate load and retrieve server statistics.
• Below tools are used by us for the monitoring
purpose
• HP Load Runner
• IBM RPT
• Both LR and RPT in turn draws information from
windows native tool performance monitor and
represent data / measurements in their own
manner
Windows Built-In Tools
• Windows has two built-in tools to keep tab of system
resources:
• Resource Monitor
• See which programs and/or services are consuming windows system
resources.
• Builds on Task Manager by adding more detail in one easy-to-use
interface.
• Provides quick summary of overall CPU, disk, network and memory
utilization
• Performance Monitor
• lets you examine a large number of counters for system
processes/services
• Presents performance data in real time or through the collection of
data inside log files that can be reviewed as needed.
• Collects performance data based on counters, which are
measurements of system activity or the current system state.
What’s there in Server
• Hardware Components
•
•
•
•
CPU
Hard Disk
RAM
Network Interface Controller
• Window server performance can be altered by altering
these hardware components
• OS
• Software that manages computer hardware and
software resources and provides common services for
computer programs.
• Windows separates application-oriented software
from OS software.
OS
Know First
• Kernel
• Kernel & Hardware
• Modes
Kernel
• Kernel
• Most used and most fundamental components of the OS.
• Computer program that manages input/output requests
from software, and translates them into data processing
instructions for the central processing unit and other
electronic components of a computer.
• Privileged mode or kernel mode.
• OS software runs in this mode
• software has access to system data and to the hardware.
• User Mode
• The remaining software, runs in user mode, has limited
access to system data.
Kernel & Hardware
• The kernel's primary function is to mediate access
to the computer's resources
Agenda
• Basics of server monitored components
•
•
•
•
Memory
CPU
DISK
Network Interface
• Different counters related to each component
Memory
Know First
• Virtual Memory
• Paging
• Page Faults
• Page Pooling
Virtual Memory
• Optimization technique implemented by the
operating system
• Unlike RAM, doesn’t physically exist on
memory chip
• Functions with the help of paging
• Allows an application program the impression
that it has more memory than actually exists.
• Hence allows the use of programs that are
too big to physically fit in memory.
• Allow for multitasking – multiple programs
running at once.
Virtual Memory-Includes
Reserved
Memory
Committed
memory
Available
Memory
• Set of contiguous
addresses that
the VMM set
aside for a
process
• Not count against
the process's
memory quota
until it is used.
• VMM saves space
for process in
Pagefile.sys in
case it needs to
be written to
disk.
• Commit limit is
the amount of
memory that can
be committed
without
expanding the
paging file.
• If disk space is
available, the
paging file can
expand, and the
commit limit will
be increased.
• Available
memory includes
free memory,
zeroed memory
and memory on
the standby list,
which has been
removed from a
process's working
set but might be
reclaimed.
Paging
Paging
• Whenever the O.S. needs a ‘block’ of memory that’s not in RAM, the VMM
takes a block from the real memory that hasn’t been used recently, writes
it to the paging file, and then reads the block of memory that the O.S.
needs from the paging file. The VMM then takes the block of memory from
the paging file, and moves it into the real memory – in place of the old
block.
• Data can be stored in the paging file on the hard disk, but it is not usable
until that data is brought into the RAM.
Paging
•Paging File
•VMM creates a file on the hard disk
that holds the extra memory that is
needed by the O.S
•The paging file combined with the
RAM accounts for all of the memory.
•Pages
•Blocks of memory that are swapped
are called pages.
Page Fault
• Page fault occurs when a program requests a
page of code or data is not in its working set
• A hard page fault occurs when the requested page
must be retrieved from disk.
• Hard faults cause paging(excessive is called thrashing),
which can degrade performance as accessing the
hard disk is slow and takes time
• A soft page fault occurs when then the requested
page is found elsewhere in physical memory.
• Soft page faults can be satisfied quickly and relatively
easily by the Virtual Memory Manager,
Page Pooling
• Pool Resources
• When a machine boots up, the Memory Manager
creates two dynamically sized memory pools that
kernel-mode components use to allocate system
memory.
• Paged Pool
• Paged Pool is exactly what its name implies - it can be
paged out
• Non Paged Pool
• The Non Paged Pool cannot be paged out.
• Drivers use the Non Paged Pool for many of their
requirements because they can be accessed at any
Interrupt Request Level (IRQL).
Memory Counters
MemoryCounters
Processor
Know First
• Processor
• Process & Threads
• Some More Terms
Processor
• Chip/ logic circuitry that responds to and
processes the basic instructions that drive a
computer.
• Basic system instructions may include processing
mouse and keyboard input and running
applications.
• Processors are associated with the operating
system and user programs support at least two
modes of execution -privileged & user mode
Process & Threads
• Process
• Executing instance of an application.
• A collection of one or more threads and associated system
resources such as memory, open files and devices.
• A process has a virtual address space, executable code,
open handles to system objects, a security context, a
unique process identifier, environment variables, a priority
class, minimum and maximum working set sizes, and at
least one thread of execution.
Process & Threads
• Thread
• Entity within a process that can be scheduled for
execution.
• All threads of a process share its virtual address space and
system resources.
• Each thread maintains exception handlers, a scheduling
priority, thread local storage, a unique thread identifier,
and a set of structures the system will use to save the
thread context until it is scheduled.
• The Idle Process
• When not executing the thread of an active user or system
process, processor execute a thread of a process
called Idle.
• It has such a low base priority that it runs only when
nothing else is scheduled to run.
Multithreading
• Ability of a program to manage its use by
more than one user at a time and to even
manage multiple requests by the same user
without having to have multiple copies of the
programming running in the computer.
• For example, word processor that prints a document
using a background thread, but at the same time
another thread is running that accepts user input, so
that you can type up a new document.
Some more Terms
• Multitasking
• Threads aren't allowed to run until done.
Instead, precious time with the processor is
allowed for a pre-set amount of time, called
a time slice, and then the thread is "preempted" to allow other threads to run.
• Scheduling
• The system scheduler controls multitasking
by determining which of the competing
threads receives the next processor time
slice. The scheduler determines which
thread runs next using scheduling priorities.
Thread Priority
• Threads are scheduled to run based on
their scheduling priority. Each thread is assigned a
scheduling priority. The priority levels range from zero
(lowest priority) to 31 (highest priority).
• As time passes and a thread doesn't get CPU time then
its priority will be dynamically adjusted upward to
ensure that eventually it will get time on the processor
Context Switches
• The scheduler maintains a queue of executable
threads for each priority level. These are known
as ready threads.
• When a processor becomes available, the system performs
a context switch as below:
• Save the context of the thread that just finished executing.
• Place the thread that just finished executing at the end of
the queue for its priority.
• Find the highest priority queue that contains ready threads.
• The most common reasons for a context switch are:
• The time slice has elapsed.
• A thread with a higher priority has become ready to run.
• A running thread needs to wait.
Privileged Mode Vs User
Mode
• Privileged or kernel mode
• Processing mode that allows code to have direct
access to all hardware and memory in the
system.
• I/O operations and other system services run in
privileged (kernel) mode
• User mode
• User applications run in user mode.
• Unless they are graphics-intensive or I/Ointensive (such as file and print services), most
applications should not be processing much
work in kernel mode.
Processor Counters
• % Processor Time_Total Instance
• Percentage of elapsed time a CPU is busy executing a non idle
thread (An indicator or processor activity).
• Processor % Time of sustained at or over 85% may indicate that
processor performance (for that load) is the limiting factor.
• % Privilege Time
• Percent of threads running in privileged mode (file or network I/O,
or allocate memory)
• Processor % Privilege Time consistently over 75 percent indicates a
bottleneck.
• Processor Queue Length
•
Number of tasks ready to run than the processors can get to.
•
High values many not necessarily be bad for % Processor Time. However, if the other
processor-related counters are increasing linearly such as % Privileged Time or Processor
Queue Length, high CPU utilization may be worth investigating.
• Less than 60% consumed = Healthy
• 51% – 90% consumed = Monitor or Caution
• 91% – 100% consumed = Critical or Out of Spec
Processor Counters
• System\Context Switches /sec.
• Occurs when higher priority threads preempts lower priority
threads that are currently running, and can indicate when too
many threads are competing for processor time.
• If much processor utilization is not seen and very low levels of context
switching are seen, it could indicate that threads are blocked
• As a general rule, context switching rates of less than 5,000 per
second per processor are not worth worrying about. If context
switching rates exceed 15,000 per second per processor, then there
is a constraint.
DISK
Know First
• Disk storage is a general category of storage
mechanisms where data are recorded by various
electronic, magnetic, optical, or mechanical
changes to a surface layer of one or more rotating
disks.
• Disk drive is a device implementing such a
storage mechanism and is usually distinguished
from the disk medium
• Different types like HDD, FDD
Know First
• Physical Disk
• Actual physical HDD
• Collection of disk partitions used to store all server
data
• Logical Volume
• Logical Disk refers to a Volume that has been
created on that disk.
• Presents a user with a contiguous address space;
that is, a logical volume simulates one large
contiguous storage space by using regions of
different disks
• A logical volume manages physical volumes by
Disk Counters
• Perfmon has two objects related to disk
performance:
• The Physical Disk performance object
• Monitors disk drives on the computer.
• Identifies the instances representing the physical
hardware
• Counters are the sum of the access to all
partitions on the physical instance.
• The Logical Disk Performance object
• Monitors logical partitions.
• Performance monitor identifies logical disks by
their drive letter or mount point.
Disk Counters
Disk Counter
Quiz Time
References
• http://blogs.technet.com/
• http://www.tenouk.com/ModuleT.html
• http://msdn.microsoft.com/
