Monitoring performance

System Monitor and Performance Logs and Alerts support detailed monitoring of the utilization of operating system resources.

  • Before monitoring your system, see Checklist: Monitoring performance.
  • To find features that have been changed in Windows XP, see New ways to do familiar tasks.
  • For tips about performance monitoring, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.


Checklist: Monitoring performance

Step | Reference
Read key concepts about monitoring performance. | Introduction to Performance; Best practices
Ensure that you have appropriate permissions on the computer you want to monitor. | Setting up a monitoring configuration
Set up a monitoring configuration. | Setting up a monitoring configuration
Evaluate monitoring results and establish a baseline. | Analyzing performance data
Investigate variations in performance data, and then tune or upgrade components as needed. | Solving performance problems
Archive monitoring data and use archives to monitor trends. | Evaluating trends and planning for additional resources


New ways to do familiar tasks

The following table lists common tasks for System Monitor and Performance Logs and Alerts (hosted in the Performance console, named Perfmon.msc). It also maps where you can perform the tasks in Windows XP and Windows 2000. For existing Performance Monitor (Perfmon.exe) users, the table also shows where these tasks are performed in Windows NT 4.0. Many of the toolbar buttons remain the same in the three versions and can be used instead of the steps listed in this table.

If you want to | In Windows NT 4.0 use | In Windows 2000 or Windows XP use
Create a chart of performance data. | Performance Monitor on the Administrative Tools menu. | System Monitor in the Performance console, started from Administrative Tools.
Create a report. | Performance Monitor on the Administrative Tools menu. | System Monitor in the Performance console, started from Administrative Tools.
Create a log. | Performance Monitor on the Administrative Tools menu. | Performance Logs and Alerts in the Performance console or under System Tools in Computer Management, started from Administrative Tools.
View log data. | Performance Monitor on the Administrative Tools menu. | System Monitor in the Performance console, started from Administrative Tools.
Create an alert. | Performance Monitor on the Administrative Tools menu. | Performance Logs and Alerts in the Performance console or under System Tools in Computer Management, started from Administrative Tools.
Create a workspace with multiple views. | Performance Monitor on the Administrative Tools menu. | Microsoft Management Console, Add/Remove Snap-in command on the File menu.

To locate the Windows NT 4.0 version of Performance Monitor, see the Microsoft Windows Resource Kits Web site.(http://www.microsoft.com/)

You can use Windows XP System Monitor to open settings files created with the Windows NT 4.0 version of Performance Monitor.


Best practices

  • Set up a monitoring configuration

    Configure Performance Logs and Alerts to report data for the recommended counters at regular intervals, such as every 10 to 15 minutes. Retain logs over extended periods of time, store data in a database, and query the data to report on and analyze the data as needed for overall performance assessment, trend analysis, and capacity planning.

    For best results, do the following before starting System Monitor or Performance Logs and Alerts on the computer you want to monitor:

    • Stop screen-saver programs.
    • Turn off services that are not essential or relevant to monitoring.
    • Increase the paging file to 1.5 times your computer's physical memory.
    • Using Registry Editor, view the entries in the following registry subkeys and make note of all nonzero values:
      • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager\Memory Management
      • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters

      Caution

      • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.

      Some of these registry values can be adjusted for better performance. For information about modifying the registry, see Registry Editor overview.

    • If the server in question has halted or is not responding, run System Monitor from another computer.
  • Keep monitoring overhead low

    In general, the performance tools are designed for minimal overhead. However, you might find that the overhead increases under each of the following conditions:

    • You are running System Monitor in graph view.
    • You have selected an option other than the default (current value) for a report view.
    • You are sampling at very frequent intervals (less than three seconds apart).
    • Many different objects and counters are selected.

    Other aspects of performance tool operation that affect performance include file size and disk space taken up by log files. To reduce file size and related disk space usage, extend the update interval. Also, log to a disk other than the one you are monitoring. Frequent logging also adds demand on disk input and output (I/O).

    If monitoring overhead is a concern, run only the Performance Logs and Alerts service and do not monitor using a System Monitor graph.

    During remote logging, performing frequent updates can slow performance due to network transport. In this case, it is recommended that you log continuously on remote computers but upload logs infrequently — for example, once a day.

  • Analyze performance results and establish a performance baseline

    Review logged data by graphing it using the System Monitor display or exporting it for printing. Compare the values against the counter thresholds shown in Analyzing performance data to verify that resource usage or other activity is within acceptable limits. Set your baseline according to the level of performance that you consider satisfactory for your typical workload.

  • Set alerts

    Set alerts according to the counter values you consider to be unacceptable, as defined by baseline evaluation.

  • Tune for improved performance

    Tune system settings and workload to improve performance, and repeat monitoring to examine tuning results.

    See Solving performance problems for information on how to change configurations and other things you can do to improve performance.
  • Plan

    Monitor trends for capacity planning and add or upgrade components as needed. Maintain logged data in a database and observe changes to identify changes in resource requirements. After you observe changes in activity or resource demand, you can identify where you might need additional resources.


How to...

  • Work with counters
  • Work with monitoring views
  • Work with data
  • Work with settings
  • Create and configure counter logs
  • Create and configure trace logs
  • Create and configure alerts
  • Work with logs and alerts


Work with counters

  • Add counters
  • Delete counters
  • Get details about counters


Add counters to System Monitor

Microsoft Windows graphic

To add counters to System Monitor

  1. Open Performance.
  2. Right-click the System Monitor details pane and click Add Counters.

    Or, click the Add button on the toolbar.

  3. To monitor any computer on which the monitoring console is run, click Use local computer counters.

    Or, to monitor a specific computer, regardless of where the monitoring console is run, click Select counters from computer and specify a computer name (the name of the local computer is selected by default).

  4. In Performance object, click an object to monitor. The Processor object is selected by default.
  5. To monitor all counters, click All counters.

    Or, to monitor only selected counters, click Select counters from list and select the counters you want to monitor. The % Processor Time counter is selected by default.

  6. To monitor all instances of the selected counters, click All instances.

    Or, to monitor only selected instances, click Select instances from list and select the instances you want to monitor. The _Total instance is selected by default.

  7. Click Add.

Notes

  • XOX
  • By default, the following three counters are displayed in System Monitor -- Memory\Pages/sec, PhysicalDisk(_Total)\Avg. Disk Queue Length, and Processor(_Total)\%Processor Time.
  • If you select an object on a remote computer, you might notice a short delay as System Monitor refreshes the list to reflect objects present on that computer.
  • When creating a monitoring console for export, be sure to select Use local computer counters. Otherwise, System Monitor will obtain data from the computer named in the text box, regardless of where the console file is installed.
  • For a description of a particular counter, click the name of the counter in Add counters, and then click Explain.
  • To monitor the sum of the values all of a particular counter's instances, select the _Total instance.
  • Unless you are configuring data from a log, you can select only active instances in the list box.
  • By default, counters are shown with both the instance name and an instance index. To turn off this feature, right-click the details pane, click Properties, click the General tab, and clear the Allow duplicate counter instances check box.
  • Some object types have several instances. For example, if a system has multiple processors, the Processor object type will have multiple instances. The Physical Disk object type has two instances if a system has two disks. Some object types such as Memory and Server have only a single instance. If an object type has multiple instances, you can add counters to track statistics for each instance, or in many cases, for all instances at once.
  • When you select two instance indices of the same counter, for example, if you are monitoring multiple threads of a process, note that the instance index number assigned to that instance may change over time as the instance, such as a thread, starts and stops. You cannot assume that the index number corresponds to the same thread over the life of the process.
  • By default, process and thread instances have a #n appended (where n is an integer). To append the process identifier (ID) instead, create a DWORD value called ProcessNameFormat under the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfProc\Performance subkey and set its value to 2. Likewise, to append the thread ID instead, create a DWORD value called ThreadNameFormat under the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfProc\Performance subkey and set its value to 2. To turn off any of these options and return to the default, set the value of the appropriate DWORD to 1.
  • You can change the default display characteristics assigned to a counter such as the color, line style and width, and graph scale by using the Data tab in the System Monitor Properties dialog box. To access the Data tab, right-click the details pane, and click Properties.
Related Topics


Delete counters from System Monitor

Microsoft Windows graphic

To delete counters from System Monitor

  1. Open Performance.
  2. In the System Monitor details pane, click the name of the counter in the legend.
  3. Press DELETE.

Notes

  • XOX
  • You can also delete counters by using the Remove button on the Data tab in the System Monitor Properties dialog box.
  • To delete all counters, click the New Counter Set button on the toolbar.
  • To clear all data samples from the display, click the Clear Display button. (This button is available only when working with current data, not with log data.)

Related Topics


Get details about counters

Microsoft Windows graphic

To get details about counters

  1. Open Performance.
  2. Right click the System Monitor details pane and click Add Counters.
  3. In Performance object, click an object.
  4. In Select counters from list, click the counter for which you want information.
  5. Click Explain.

Notes

  • XOX
  • When working with System Monitor, you can match a line in a graph with the counter for which it is charting values. To do so, select a counter in the legend, then click the Highlight button on the toolbar, or double-click a position in the line. If chart lines are close together, try to find a point in the graph where they diverge. Otherwise, System Monitor might have difficulty pinpointing the value you are interested in.

  • For more complete information about performance counters, see the Windows Performance Counter Reference (Counters.chm) on the Microsoft Windows Resource Kits (http://www.microsoft.com/) companion disc.


Working with monitoring views

Microsoft Windows graphic

Work with monitoring views

  • Use logged data
  • Change counters and counter properties
  • Change sampling options
  • Monitor a different computer
  • Highlight counter data
  • Change from graph view
  • Add titles, grids, and other attributes
  • Change background, chart, text, other colors, and font properties


Use logged data

Microsoft Windows graphic

To use logged data

  1. Open Performance.
  2. Right-click the System Monitor details pane and click Properties.
  3. Click the Source tab.
  4. Under Data Source, click Log files, and then add one or more files that you want to use as a datasource.

    To add files to the list, click the Add button to open the Select Log File dialog box. Double-click the names of the files you want to open.

    Or, to remove files from this list, click the Remove button.

  5. Click Time Range. To specify the time range in one or more log files that you want to view, drag the bar or its handles for the appropriate starting and ending times.
  6. Click the Data tab and click Add to open the Add Counters dialog box. The counters you selected during log configuration are shown. You can include all or some of these in your graph.

Notes

  • XOX
  • Unless you specifically want to monitor start-up events, you should exclude times that include such events from your time window because these temporary high values tend to skew overall performance results.
  • The Clear Display button on the toolbar is disabled when you are viewing log data.
  • You can also view counter-log data by opening files that have been saved in comma-separated or tab-separated format using Microsoft Excel.
  • To view data from an SQL Database, click the Source tab. Then, under Data Source, click the Database button, and then select the System DSN name and Log Set from the drop-down list. In order to access the SQL database, the System Database Source Name (System DSN) must be predefined, and privileges granted to write to the database. The Log Set, specified by the DSN, must already be created in the database.
  • You can also select either multiple or nonadjacent counters from the Select counters from list. To select multiple counters, press SHIFT+ DOWN ARROW. To select nonadjacent counters, press CTRL, click Select counters from list, and then click the counters you want to use from this list.

Related Topics


Change counters and counter properties

Microsoft Windows graphic

To change counters and counter properties

  1. Open Performance.
  2. Right-click the System Monitor details pane and click Properties.
  3. On the Data tab, specify the options you want to use:
    • Add. Opens the Add Counters dialog box, where you can select other counters to add.
    • Remove. Removes the counter selected in the counter list.
    • Color. Changes the color of the selected counter.
    • Scale. Changes the displayed scale of a selected counter in the graph or histogram view. Counter values can be scaled exponentially from .0000001 to 1000000.0. You may want to adjust the counter scale settings to enhance the visibility of counter data in the graph. Changing the scale does not affect the statistics displayed in the value bar.
    • Width. Changes the line width of a selected counter. Note that defining a line width can determine the line styles that are available.
    • Style. Changes the line style for a selected counter. Styles can be selected only when you are using the default line width.

Notes

  • XOX
  • By default, System Monitor displays Pages/sec, Avg. Disk Queue Length, and % Processor Time counter data for the local computer.

Related Topics


Change sampling options

Microsoft Windows graphic

To change sampling options

  1. Open Performance.
  2. Right-click the System Monitor details pane and click Properties.
  3. On the General tab, specify the sampling option you want:
    • To sample automatically at regular intervals, select the Sample automatically every check box and in seconds, type the length of the interval in seconds. The default interval is one second.
    • To sample manually, clear the Sample automatically every check box. You can also use the Freeze Display button on the toolbar to sample data manually.

      When manual sampling is selected, use the Update Data button to collect a sample.

Notes

  • XOX
  • To clear all data samples from the display, click the Clear Display button on the toolbar. (This button is available only when working with current data, not with log data.)

Related Topics


Monitor a different computer

Microsoft Windows graphic

To monitor a different computer

  1. Open Performance.
  2. Right-click the System Monitor details pane and click Add Counters.
  3. Click Select counters from computer, and type the Universal Naming Convention (UNC) name, such as \\MyLogServer, of the computer you want to monitor in the text box.

    System Monitor will obtain counters from the computer you specify, regardless of where System Monitor is running.

  4. In Performance object, click an object to monitor.
  5. In Select counters from list, click one or more counters, or click All counters to use all counters for that object.
  6. To use all counter instances available when System Monitor is in use, click All instances.

    Or, to use only selected counter instances, click Select instances from list, and select the instances you want to use.

Notes

  • XOX
  • If you lack the appropriate permissions to monitor the computer, an error message will appear, but the counter will still be displayed in the histogram or graph legend without any data or any graph line.
  • If you select an object on a remote computer, you might notice a short delay as System Monitor refreshes the list to reflect objects present on that computer.
  • If you do not see a counter that you want to monitor, the service or feature that provides the counter object might not be installed or enabled on that computer. In such a case, you need to install or enable the service or feature before you can monitor related data.


Highlight counter data

Microsoft Windows graphic

To highlight counter data

  1. Open Performance.
  2. In the legend, click the counter you want to highlight.
  3. Click the Highlight button or press CTRL+H.

    For the counter selected, a thick line replaces the colored chart line. For white or light-colored backgrounds (defined by the BackColor property), this line is black; for other backgrounds, this line is white.

Notes

  • XOX
  • When working with the System Monitor control in Microsoft Word, note that default key settings in Microsoft Word may conflict with the CTRL+H combination used for System Monitor highlighting. You might need to change these to support highlighting when the System Monitor control (Sysmon.ocx in the systemroot\System32 folder) is used in Microsoft Word.


Change from graph view

Microsoft Windows graphic

To change from graph view

  1. Open Performance.
  2. On the toolbar, click the View Histogram button to change to bar graph view or the View Report button to change to report view.

Notes

  • XOX
  • You can also change display type by changing the View setting on the General tab of the System Monitor Properties dialog box.
  • The counter data and path properties are displayed differently in a System Monitor report than they are in a graph. In report view, information is displayed in columns, with counter names and data values grouped by their associated performance objects, and separate columns for each instance and its data.

    The values found on the value bar in a graph are not included. Using the General tab of the System Monitor Properties dialog box, you can choose a single value to be displayed in the report: last (default), current, average, minimum, or maximum. The default value for reports based on current activity is current and for logged activity is average.

  • If you choose average, minimum, or maximum statistics in the Report view, the statistic is calculated at each sample interval. This incurs some additional performance overhead.
  • In histogram view, the chart lines are replaced by bars. The remainder of the display is identical to the graph view.
  • If selected, the toolbar remains displayed for all views.
  • By default, the data values are displayed without commas separators. To display data values with commas separating thousands, that is, (000,000) format, use the Registry Editor to create a DWORD value called DisplayThousandsSeparator under the HKEY_CURRENT_USER\Software\Microsoft\SystemMonitor subkey and set its value to 1.
  • By default, if the data range for the sample period is sufficiently large, the System Monitor graph view displays the minimum and maximum values for the data point as a vertical line. To display only the average values, use the Registry Editor to create a DWORD value called DisplaySingleLogSampleValue under the HKEY_CURRENT_USER\Software\Microsoft\SystemMonitor subkey, and set its value to 1.

Related Topics


Add titles, grids, and other attributes

Microsoft Windows graphic

To add titles, grids, and other attributes

  1. Open Performance.
  2. Right-click the System Monitor details pane and click Properties.
  3. On the Graph tab, specify the graph options you want to use.

Notes

  • XOX
  • The default minimum and maximum scale values are 0 and 100, respectively.
  • To change the grid color, use the Appearance tab.
  • To add or remove the legend, statistics, or the toolbar, use the General tab.
  • To change border style or appearance, use the General tab.

Related Topics


Change background, chart, text colors, and font properties

Microsoft Windows graphic

To change background, chart, text, other colors, and font properties

  1. Open Performance.
  2. Right-click the System Monitor details pane and click Properties.
  3. Select the Appearance tab.
  4. To change the color elements, in Color, select the graph element for which you want to change the color. To change the color used for the selected graph element, click the Change button.

    Or, to change the font used for the text or numbers on your graph, in Font, click the Change button. In Font, set any font options you want. The options include Font, Font style, Size, and Script.

  5. The available elements in Color are:
    • Graph Background. The background color of the window area where counter data is charted.
    • Control Background. The background color that surrounds the window area where data is charted.
    • Text. The text color.
    • Grid. The color used for vertical and horizontal grid lines.
    • Time Bar. The color used for the timer bar.

Note

  • XOX

Related Topics


Work with data

  • Copy data between instances of System Monitor
  • Print performance data
  • Save graph data as an HTML page
  • Save data to a log file
  • Insert the System Monitor control in a Microsoft Word document
  • Collect performance data by using WMI


Copy counter data between instances of System Monitor

Microsoft Windows graphic

To copy counter data between instances of System Monitor

  1. Open Performance.
  2. In the System Monitor details pane, click the Copy Properties button on the toolbar.

    This copies all current properties in HTML format to the Windows Clipboard.

  3. Open another instance of System Monitor and click the Paste Counter List button on the toolbar to load the counter path data from the Clipboard into the current window.

Note

  • XOX


Print performance data

Microsoft Windows graphic

To print performance data

  1. Open Performance.
  2. Press ALT+PRINT SCREEN to copy a view of the active window.
  3. Click Start, point to Programs, point to Accessories, and click Paint.
  4. On the Edit menu, click Paste.

    If prompted with the alert message The image in the Clipboard is larger than the bitmap. Would you like the bitmap enlarged?, click Yes.

  5. On the File menu, click Print.

Notes

  • XOX
  • You can also print performance data if you:
    • Add the System Monitor control to a Microsoft Office application such as Microsoft Word or Microsoft Excel and print from that program.
    • Save the performance data as an HTML file and print it from Internet Explorer or another program.
    • Import a log file in comma-separated (.csv) or tab-separated (.tsv) format into a Microsoft Excel spreadsheet and print from that application.

Related Topics


Save graph data as an HTML page

Microsoft Windows graphic

To save graph data as an HTML page

  1. Open Performance.
  2. Add counters to a graph.
  3. Right-click the displayed graph, and then click Save As.
  4. In the Save As dialog box, select a path and type the name of the new HTML file.

Note

  • XOX
  • You can apply the counter settings saved as an HTML page by dragging the HTML file from Windows Explorer onto a System Monitor graph. If you open the HTML file in a browser, it will display a static System Monitor graph containing the data at the time the HTML file was saved.
  • You can also import counter data saved to the Windows Clipboard to System Monitor, or export all properties from System Monitor to the Windows Clipboard. Use the Copy Properties button on the toolbar to transfer to the Windows Clipboard the counter properties currently displayed in System Monitor. Use the Paste Counter List button in the toolbar to transfer properties from the Clipboard to the current window.
  • You can also save report data as a tab-separated file for use with Microsoft Excel. To do so, right-click in your report display, and then click Save As. In the Save As dialog box, type the name of the report file and select .tsv for the file format type. Click Save.

Related Topics


Insert the System Monitor control in a Microsoft Word document

Microsoft Windows graphic

To insert the System Monitor control in a Microsoft Word document

  1. Open a Microsoft Word document, and then place the insertion point where you want to insert the control.
  2. On the View menu, point to Toolbars, and click Control Toolbox.
  3. Click the More Controls icon, and click System Monitor Control.

Notes

  • The System Monitor control is inserted in the document at the location you selected. The control is currently in design mode, meaning that you can work with it using the Visual Basic editor. The control assumes the ambient properties of the application. That is, the control defaults to the BackColor, ForeColor, and Font settings for the Word document. To change these settings, or to add counters, click the Exit Design Mode icon to exit design mode.
  • After adding counters and configuring the graph according to your preferences, you can print the performance data or save the document using the appropriate commands provided by Word.
  • Use Microsoft Word 97 or later.

Related Topics


Save data to a log file

Microsoft Windows graphic

To save data to a log file

  1. Open Performance.
  2. Select a log file as the data source to display.
  3. Right-click the System Monitor details pane and click Save Data As.
  4. Type the name of the saved log file and select the format.
  5. Enter the sampling rate (value n) for the saved log file in Reduce log file size by only writing one out of every n original log records.

    By default, n is set to 1 and the saved log file contains the same number of data points as the original log file.

  6. Click Save.

Notes

  • XOX
  • This feature only works on log files and not on real-time data.

  • For more information on displaying logged data, see Related Topics.

Related Topics


Collect performance data by using WMI

Microsoft Windows graphic

To collect performance data by using WMI

  • At a command prompt, type

    mmc.exe path\perfmon.msc /sysmon_wmi

    where path is the full path to the saved console file, for example:
    %systemroot%\system32

Notes

  • XOX
  • This procedure obtains performance data by using Windows Management Instrumentation (WMI) instead of the registry.
  • You can also perform this procedure at a command prompt by typing:

    perfmon.exe /wmi

Related Topics


Work with settings

  • Save a monitoring console
  • Save log or alert settings to an HTML page
  • Create a custom console
  • Use Windows NT 4.0 version of Performance Monitor settings files


Saving a monitoring console

Microsoft Windows graphic

To save a monitoring console

  1. Open Performance.
  2. Using System Monitor or a tool under Performance Logs and Alerts, configure the tool with the settings you want.
  3. On the File menu, click Save As, and then type the name you want for this console. The default directory for storing this file is System32 on the root volume.
  4. Click Save.

Note

  • XOX

Related Topics


Save log or alert settings as an HTML page

Microsoft Windows graphic

To save log or alert settings as an HTML page

  1. Open Performance.
  2. Create a log or an alert.
  3. In the details pane, right-click the name of the log or the alert and click Save Settings As. By default, the settings are saved in the user's personal default directory, which is is typically My Documents.

Note

  • XOX

Related Topics


Create a custom monitoring console

Microsoft Windows graphic

To create a custom monitoring console

  1. Open Microsoft Management Console (MMC).
  2. On the File menu, click Add/Remove Snap-in.
  3. On the Standalone tab, click Add.
  4. In the snap-in list, click ActiveX Control, and then click Add.
  5. In the Insert ActiveX Control wizard, click Next.

    There is a short delay before the next dialog box appears; this is normal.

  6. In Control category, click All Categories.
  7. In Control type, click System Monitor Control.
  8. Click Next.

    The System Monitor control provides the functionality of System Monitor.

  9. In Select a name for the ActiveX control, type a name for the control, and then click Finish.

Note

  • To open MMC, click Start, click Run, and then type mmc.
  • Creating a custom console is useful if you want to have System Monitor hosted in the same console with Event Viewer or another tool.


Use Windows NT 4.0 version of Performance Monitor settings files

Microsoft Windows graphic

To use Windows NT 4.0 version of Performance Monitor settings files

  • At a command prompt, type

    perfmon.exe file_name

    where file_name is the name of the settings file you want to use.

Notes

  • This procedure will open a Windows XP Performance console configured with the settings from the Windows NT 4.0 version of Performance Monitor settings file.
  • This procedure works for the following types of Windows NT 4.0 version of Performance Monitor settings files: chart (.pmc), report (.pmr), alert (.pma), and log (.pml). Workspace (.pmw) files that were created with Windows NT 4.0 version of Performance Monitor are not fully compatible with Windows XP System Monitor. Only one of the views previously saved in the workspace will be available in System Monitor.
  • To display the Windows NT 4.0 settings file in System Monitor, the system temporarily converts the file for use with System Monitor, but discards the converted version after the console starts. If you want to save the settings file for permanent use with System Monitor, type the following command:

    perfmon.exe /HTMLFILE:converted_file settings_file

    where converted_file is the name you are giving to the converted file and settings_file is the name of the original Windows NT 4.0 settings file.

Related Topics


Create and configure counter logs

  • Create a counter log
  • Add objects to a log
  • Add counters to a log
  • Get details about objects and counters
  • Set file parameters for a log


Create a counter log

Microsoft Windows graphic

To create a counter log

Using the Windows interface

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then double-click Counter Logs.

    3. Any existing logs will be listed in the details pane. A green icon indicates that a log is running; a red icon indicates that a log has been stopped.

  3. Right-click a blank area of the details pane, and click New Log Settings.
  4. In Name, type the name of the log, and then click OK.
  5. On the General tab, click Add Objects and select the performance objects you want to add, or click Add Counters to select the individual counters you want to log.
  6. If you want to change the default file and schedule information, make the changes on the Log Files tab and the Schedule tab.

Notes

  • XOX
  • You can also use the Run As text box and Password button to specify the logon account name for the performance logs and alerts service. You can access these features from the General tab.
  • To save the settings for a counter log, trace log, or alert, right-click the log or alert in the details pane and click Save Settings As. You can then specify an .htm file in which to save the settings. To reuse the saved settings for a new log or alert, right-click the details pane, and then click New Log Settings From or New Alert Settings From. This is an easy way to generate new settings from a log or alert configuration.

Using a command line

  1. Open Command Prompt
  2. Type:

    logman create counter collection_name –c {path [path...]} | {–cf filename}

Value | Description
create counter collection_name | Creates a counter collection query named collection_name.
–c {path [path...]} | –cf {filename} | Specifies the performance counter path to log (path), or specifies the path name of the log file that lists these counters (–cf filename). To list multiple counter paths, separate the command line by a space, or use the -cf option to list counter paths in an input file, one per line. Use this format [\\computer]\object[instance]\counter] for each counter path where: Computer is the optional computer name or the Internet protocol (IP) address of a remote computer. If a computer name is not supplied, the local computer will be used by default. Object is the performance counter object (process or memory). Instance (if any) is the performance object (process). Counter is the performance counter for the object (processor time).
For example, to create a collection query named perf_log to collect Total % Processor Time counter data, type:

logman create counter perf_log –c "\Processor(_Total)\% Processor Time"

Notes

  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    logman /?

Related Topics


Add objects to a log

Microsoft Windows graphic

To add objects to a log

Using the Windows interface

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then double-click Counter Logs or Alerts.
  3. In the details pane, double-click the log or alert you want to modify.
  4. On the General tab, click Add Objects. For each object that you want to add to the log or alert, perform the following steps:
    • To log objects from the computer on which the Performance Logs and Alerts service will run, click Use local computer counters.

      Or, to log objects from a specific computer regardless of where the service is run, click Select counters from computer and specify the Universal Naming Convention (UNC) name, such as \\MyLogServer, of the computer you want to monitor.

    • In Performance object, click an object to monitor.
    • Click Add.

Notes

  • XOX
  • When creating a monitoring console for export, be sure to select Use local computer counter objects. Otherwise, counter logs will obtain data from the computer named in the text box, regardless of where the console file is installed.
  • For a description of an object, click the object in Performance counters and then click Explain.
  • When you specify the name of a remote computer using Select counter objects from computer, only the name of the local computer and those computer names entered during the current Performance session are listed. Computer names entered in previous sessions will not be listed.

Using a command line

  1. Open Command Prompt
  2. Type:

    logman update collection_name –c {path [path...]} | {–cf filename}

Value | Description
update collection_name | Updates the collection query named collection_name. For counter collections, modifications to the query will stop, and then restart the collections.
–c {path [path...]} | –cf {filename} | Specifies the performance object path to log (path), or specifies the path name of the log file that lists these objects (–cf filename). To list multiple object paths, separate the command line by a space, or use the -cf option to list object paths in an input file, one per line. Use this format [\\computer]\object[*]\*] for each object path where: Computer is the optional computer name or the Internet protocol (IP) address of a remote computer. If a computer name is not supplied, the local computer will be used by default. Object is the performance counter object (process or memory).
For example, to add the PhysicalDisk object to the collection query named perf_log on computer \\COMP1, type:

logman update perf_log –c "\\COMP1\PhysicalDisk(*)\*"

Notes

  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    logman /?

Related Topics


Add counters to a log

Microsoft Windows graphic

To add counters to a log

Using the Windows interface

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Counter Logs.
  3. In the details pane, double-click the log you want to modify.
  4. On the General tab, click Add Counters. For each counter or group of counters that you want to add to the log, perform the following steps:
    • To log counters from the computer on which the Performance Logs and Alerts service will run, click Use local computer counters.

      Or, to log counters from a specific computer regardless of where the service is run, click Select counters from computer and specify the Universal Naming Convention (UNC) name, such as \\MyLogServer, of the computer you want to monitor.

    • In Performance object, select an object to monitor.
    • In Select counters from list, click one or more counters to monitor.
    • To monitor all instances of the selected counters, click All Instances. (Binary logs can include instances that are not available at log startup, but which subsequently become available.)

      Or, to monitor particular instances of the selected counters, click Select Instances From List, and then click an instance or instances to monitor.

    • Click Add.

Notes

  • XOX
  • When creating a monitoring console for export, be sure to select Use local computer counters. Otherwise, counter logs will obtain data from the computer named in the text box regardless of where the console file is installed.
  • For a description of a counter, click the counter in Performance counters and then click Explain.
  • Some object types have several instances. For example, if a system has multiple processors, the Processor object type will have multiple instances. The PhysicalDisk object type has two instances if a system has two disks. Some object types, such as Memory and Server, have only a single instance. If an object type has multiple instances, you can add counters to track statistics for each instance, or, in many cases, for all instances at once. By default, counters are shown with both the instance name and an instance index. To turn off this feature, right-click the System Monitor graph, click Properties, and clear the Allow duplicate counter instances check box.
  • When you specify the name of a remote computer using Select counters from computer, only the name of the local computer and those computer names entered during the current Performance session are listed. Computer names entered in previous sessions will not be listed.

Using a command line

  1. Open Command Prompt
  2. Type:

    logman update collection_name –c {path [path...]} | {–cf filename}

Value | Description
update collection_name | Updates the collection query named collection_name. For counter collections, modifications to the query will stop, and then restart the collections.
–c {path [path...]} |
–cf {filename} 		Specifies the performance counter path to log (path), or specifies the path name of the log file that lists these counters (–cf filename). To list multiple counter paths, separate the command line by a space, or use the -cf option to list counter paths in an input file, one per line. Use the format [\\computer]\object[instance]\counter] for each counter path where:

Computer is the optional computer name or the Internet protocol (IP) address of a remote computer. If a computer name is not supplied, the local computer will be used by default.

Object is the performance counter object (process or memory).

Instance (if any) is the performance object (process).

Counter is the performance counter for the object (processor time).

Note

  • An asterisk (*) can be used as a wild card when specifying the counter path. For example, to specify all instances of the % Processor Time, use:
    "\Processor(*)\% Processor Time"
For example, to add all instances of the % Interrupt Time to the collection query named perf_log on computer \\COMP1, type:

logman update perf_log –c "\\COMP1\Processor(*)\% Interrupt Time"

Notes

  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    logman /?

Related Topics


Get details about objects and counters

Microsoft Windows graphic

To get details about objects and counters

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Counter Logs.
  3. In the details pane, double-click the counter log.
  4. Click the Add Objects button to open the Add Objects dialog box, or click the Add Counters button to open the Add Counters dialog box.
  5. In the Add Objects dialog box, select Performance objects, click an object, then click Explain.
  6. In the Add Counters dialog box, select Performance object, click an object, and in Performance counters, click a counter then click Explain.

Note

  • XOX
  • Clicking Explain opens a pop-up window that contains information about the selected object or counter. For more information on counters, including detailed descriptions of how each counter is calculated and guidelines on using counters to diagnose performance problems, see the Windows Performance Counter Help Reference (Counters.chm) on the Microsoft Windows Resource Kit companion disc.

Related Topics


Set file parameters for a log

Microsoft Windows graphic

To set file parameters for a log

Using the Windows interface

  1. Open Performance.
  2. Double-click Performance Logs and Alerts.
  3. To set file properties for a counter log, double-click Counter Logs.

    Or, to set file properties for a trace log, double-click Trace Logs.

  4. In the details pane, double-click the log.
  5. On the Log Files tab, complete the following options:
    • Log file type. In the list, select the format you want for this log file, complete the options, and then click the Configure button.
      Log file format | Description | Applies to
      Text File (Comma delimited) | This option defines a comma-delimited log file (with a .csv extension). Use this format, for example, to export the log data into a spreadsheet program. | Counter logs
      Text File (Tab delimited) | This option defines a tab-delimited log file (with a .tsv extension). Use this format, for example, to export the log data into a spreadsheet program. | Counter logs
      Binary File | This option defines a sequential, binary-format log file (with a .blg extension). Use this file format if you want to be able to record data instances that are intermittent—that is, stopping and resuming after the log has begun running. Nonbinary file formats cannot accommodate instances that are not persistent throughout the duration of the log. | Counter logs
      Binary Circular File | This option defines a circular, binary-format log file (with a .blg extension). Use this file format to record data continuously to the same log file, overwriting previous records with new data when the file reaches its maximum size. | Counter logs
      Circular Trace File | This option defines a circular trace log file (with an .etl extension). Use this file format to record data continuously to the same log file, overwriting previous records with new data when the file reaches its maximum size. | Trace logs
      Sequential Trace File | This option defines a sequential trace log file (with an .etl extension) that collects data until it reaches a user-defined limit and then closes and starts a new file. | Trace logs
      SQL Database | This option defines the name of an existing SQL database and log set within the database where the performance data will be read or written. Use this file format to collect performance data at an enterprise level rather than a per server basis. | Counter logs
    • End file names with. Select this and choose the suffix style you want from the list. Use End file names with to distinguish between individual log files with the same log file name that are in a group of logs that have been automatically generated.
    • Start numbering at. Set this to the start number for automatic file numbering, when you select nnnnnn as the End file names with.
    • Comment. If appropriate, type a comment or description for the log file.
    • Configure. Select the configuration parameters using the following options for either Configure Log Files or Configure SQL Logs, based on the log file type selected from the drop-down menu.
      Option | Description | Applies to
      Location | Type the name of the folder where you want the log file created, or click Browse to search for the folder. | Configure Log Files
      File name | Type a partial or base name for the log file. You can use File name in conjunction with End file names with if appropriate. | Configure Log Files
      Repository name | Select the System DSN (Data Source Name) from the drop-down list, and then type the Log set name. The Log set name will be stored in the database within the System DSN. | Configure SQL Logs
  6. Log file size. Decide, using the following options, whether or not you want to limit the size of the log file.
  7. Or, under Log set size. Decide, using the following options, whether or not you want to limit the size of the log set.
    • Maximum limit. When you select this option, data is continuously collected in a log file until it reaches limits set by disk quotas or the operating system. (For SQL logs data is collected in a database until it reaches its limits set by the number of records written.)
    • Limit of. To define a size limit for the log file, specify the size. For counter and trace logs, specify the maximum size in megabytes. For SQL logs, specify the maximum size in records.

Notes

  • XOX
  • Windows generates an error message if available disk space falls below a specified minimum. If you choose to allow the file to grow to its maximum size, consider the available space on your disk and any quotas that may be in effect. An error might occur if you run out of disk space due to logging. The Log file size option works in conjunction with the When the log file is full option on the Schedule tab.
  • When you select a log file–size limit or log set, the stop option When the log file is full reflects the size limit typed here.
  • The File name can identify a group of log files with similar parameters.
  • The End file names with suffix can be a numeric sequence or a character string indicating the date and time the log was started. For example, you might define the File name "DailyLog" and the Performance Logs and Alerts service would append the date as a suffix for each file so that you might have a series of files named as follows: DailyLog_19990715, DailyLog_19990716, for each day the log is run.
  • The comment text and the file name appear in the details pane in the Performance Logs and Alerts console window.
  • Sequential counter or trace log files can grow to a size larger than the maximum file size specified by the user. This can occur for different reasons, depending on what type of log is configured. For counter logs, the log service postpones checking the log's file size until after it has collected the last data sample, at which point the file size may already have exceeded the defined limit. For trace logs, the log service writes additional buffers to the log when the log service stops, which may cause the final log file size to be slightly larger than the defined limit.

Using a command line

  1. Open Command Prompt
  2. Type the appropriate command below:
Action | Command
Defines the log file format. | logman update collection_name -f {bin | bincirc | csv | tsv | SQL}
Specify the file suffix. | logman update collection_name –v {nnnnn | mmddhhmm}
Set the automatic file numbering start number. | logman update collection_name –v nnnnn
Specify the location of the log file. | logman update collection_name –o path
Specify the location of the SQL database and log set where output data will be written. | logman update collection_name –o DSN!counter_log
Value | Description
update collection_name | Updates the collection query named collection_name. For counter collections, modifications to the query will stop, and then restart the collections.
-f bin | bincirc | csv | tsv | SQL Specifies the file format used for collecting performance counter and trace data. You can use binary (bin), circular binary (circbin), comma (csv) and tab (tsv) separated, or SQL database (SQL) formats when collecting performance counters.

Note

  • For SQL database formats, you must use the -o option in the command line with the DNS!counter_log option, the System Database System Name (System DSN) must be predefined, and you must have write privileges to the database. The log set counter_log is created in the database, and is specified by the DSN.
If a file format is not specified, it defaults to binary.
–v nnnnn | mmddhhmm | Attaches the version control information to the end of the output file and path name. Use numeric nnnnn format, or date format mmddhhmm (month, day, 24-hour, minute) for version control.
–o path | Specifies the path name of the output file that collects performance counter or trace data. By default, the collection log file name is the collection query name suffixed by either .blg for performance counters, or .etl for trace data.
–o DSN!counter_log | Specifies the location of the SQL database and log set.
For example, to specify that the output for counter collection perf_log be written to an SQL log set named daily_log in the perfdb database, type:

Logman update perf_log –f sql –o perfdb!daily_log

Notes

  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    logman /?

Related Topics


Create and configure trace logs

  • Create a trace log
  • Define trace log providers and events
  • Define trace log buffers


Create a trace log

Microsoft Windows graphic

To create a trace log

Using the Windows interface

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Trace Logs.

    Any existing logs will be listed in the details pane. A green icon indicates that the logs are running; a red icon indicates logs have been stopped.

  3. Right-click a blank area of the details pane, and click New Log Settings.
  4. In Name, type the name of the trace log you want to create, and then click OK.

    By default, the log file is created in the PerfLogs folder in the root directory on your system drive, a sequence number is appended to the file name you entered, and the sequential trace file type with the .etl extension. Use the Log Files and Advanced tabs to modify these parameters or define other parameters for your log. To define providers and events to log, use the General tab. To specify when you want logging to occur, use the Schedule tab.

Notes

  • XOX
  • You can also use the Run As text box and Password button to specify the logon account name for the performance logs and alerts service. You can access these features from the General tab.
  • To save the settings for a log file, right-click the file in the details pane, and click Save Settings As. You can then specify an .htm file in which to save the settings. To reuse the saved settings for a new log, right-click the details pane, and click New Log Settings From.

Using a command line

  1. Open Command Prompt.
  2. To create a trace log type:

    Logman create trace collection_name

Value | Description
create trace | Creates a trace log collection query.
collection_name | Specifies the name of the collection query.

For example, to create a trace log named perf_log, type:

logman create trace perf_log

Notes

  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    Logman /?

Related Topics


Define trace log providers and events

Microsoft Windows graphic

To define trace log providers and events

Using the Windows interface

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Trace Logs.
  3. In the details pane, double-click the log.
  4. For a list of the installed providers and their status (enabled or not), click Provider Status.

    By default, the Nonsystem providers option is selected to keep trace-logging overhead to a minimum.

  5. If you click Events logged by system provider, a default provider (the Windows kernel trace provider) is used to monitor processes, threads, and other activity. To define events for logging, click the check boxes as appropriate.
  6. If you click Nonsystem providers, you can select the data providers you want —for example, if you have written your own providers. Use the Add or Remove buttons as needed.

Notes

  • XOX
  • Trace logging of file details and page faults can generate an extremely large amount of data. It is recommended that you limit trace logging using the file details and page fault options to a maximum of two hours.
  • You must have special privileges to log data from the kernel or some providers. Use the Run as text box to specify an administrator account to do this.
  • Only one instance of each trace provider can be enabled at any given time.

Using a command line

  1. Open Command Prompt.
  2. Type the appropriate command from those provided in the following tables:
Action | Command
To view each installed provider and its status. | logman query providers
To specify that data collected by the system trace provider is logged. | logman update collection_name -P "Windows kernel trace" (process, thread, disk, net, page, file)
To specify that data collected by a provider other than the system trace provider is logged. | logman update collection_name -P provider
Value | Description
query providers | Queries the providers installed on the local system.
update collection_name | Updates the collection query named collection_name.
-P "Windows kernel trace" (process, thread, disk, net, page, file) | Specifies "Windows kernel trace" as the provider that collects data for the trace log. Process, thread, disk, net, pf, hf, registry, image, and file are optional events to include in the trace log. Use process to include data on the creating and ending processes. Use thread to include data on the creating and ending threads. Use disk to include data on disk input/output operations. Use net to include data on TCP/IP send or receive requests. Use pf to enable soft page fault tracing. Use hf to enable hard page fault tracing. Use registry to include data on registry operations. Use image to include data on the program name for the loaded process. Use file to include file input/output (I/O) data.
-P provider | Specifies the nonsystem provider that collects data for the trace log.

For example, to specify that a provider named Nonsystem01 is used to collect data for a trace log named perf_log, type:

logman update perf_log -P Nonsystem01

Notes

  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    logman /?

Related Topics


Define trace log buffers

Microsoft Windows Graphic

To define trace log buffers

Using the Windows interface

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and click Trace Logs.
  3. In the details pane, double-click the log.
  4. Click the Advanced tab.
  5. In Buffer size, specify the size of the buffer you want to use in kilobytes for trace data collection.
  6. In Minimum, specify the smallest number of buffers you want to use for trace data.
  7. In Maximum, specify the largest number of buffers you want to use for trace data.
  8. To have the trace provider periodically flush the buffers, select the Transfer data from buffers to log file at least every check box and specify the transfer interval in seconds.

Note

  • XOX

Using a command line

  1. Open Command Prompt.
  2. Type:

    logman update collection_name –bs {value} –nb {min max} –ft [[hh:]mm:]ss

Value | Description
update collection_name | Updates the collection query named collection_name.
–bs {value} | Specifies the buffer size in n kilobytes for the trace log.
–nb {min max} | Specifies the minimum and maximum number of buffers for the trace log.
–ft [[hh:]mm:]ss | Specifies whether the buffer will be flushed, and the interval at which the buffer will be flushed.

For example, to specify a buffer size of 128 kilobytes, a minimum of 10 buffers, and a maximum of 25 buffers for a trace log named perf_log, type:

logman update perf_log –bs 128 –nb 10 25

Notes

  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    logman /?

Related Topics


Create and configure alerts

  • Create an alert
  • Define counters and thresholds for an alert
  • Define actions for an alert


Create an alert

Microsoft Windows graphic

To create an alert

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Alerts.

    Any existing alerts will be listed in the details pane. A green icon indicates that the alerts are running; a red icon indicates alerts have been stopped.

  3. Right-click a blank area of the details pane, and then click New Alert Settings.
  4. In Name, type the name of the alert, and then click OK.
  5. To define a comment for your alert, along with counters, alert thresholds, and sample intervals, use the General tab.

    To define actions that should occur when counter data triggers an alert, use the Action tab, and to define when the service should begin scanning for alerts, use the Schedule tab.

Notes

  • XOX
  • You can also use the Run As text box and Password button to specify the logon account name for the performance logs and alerts service. You can access these features from the General tab.
  • To save the counter settings for a log file or an alert file, right-click the file in the details pane, and then click Save Settings As. You can then specify an .htm file in which to save the settings. To reuse the saved settings for a new log or alert, right-click the details pane, and click New Log Settings From or New Alert Settings From. This is an easy way to generate log settings from an alert configuration.

Related Topics


Define counters and thresholds for an alert

Microsoft Windows graphic

To define counters and thresholds for an alert

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Alerts.
  3. In the details pane, double-click the alert.
  4. In Comment, type a comment to describe the alert as needed.
  5. Click Add.
  6. For each counter or group of counters that you want to add to the log, perform the following steps:
    1. To monitor counters from the computer on which the Performance Logs and Alerts service will run, click Use local computer counters.

      Or, to monitor counters from a specific computer regardless of where the service is run, click Select counters from computer and type the Universal Naming Convention (UNC) name, such as \\MyLogServer, of the computer you want to monitor in the text box.

    2. In Performance object, click an object to monitor.
    3. In Select counters from list, click one or more counters to monitor.
    4. To monitor all instances of the selected counters, click All Instances. (Binary logs can include instances that are not available at log startup but subsequently become available.)

      Or, to monitor particular instances of the selected counters, click Select Instances From List, and then click an instance or instances to monitor.

    5. Click Add.
  7. In Alert when the value is, specify Under or Over, and in Limit, specify the value that triggers the alert.
  8. In Sample data every, specify the amount and the unit of measure for the update interval.
  9. Complete the alert configuration using the Action and Schedule tabs.

Notes

  • XOX
  • When creating a monitoring console for export, be sure to select Use local computer counters. Otherwise, counter logs will obtain data from the computer named in the text box, regardless of where the console file is installed.
  • Some object types have several instances. For example, if a system has multiple processors, the Processor object type will have multiple instances. The PhysicalDisk object type has two instances if a system has two disks. Some object types, such as Memory and Server, have only a single instance. If an object type has multiple instances, you can add counters to track statistics for each instance, or in many cases, for all instances at once.


Define actions for an alert

Microsoft Windows graphic

To define actions for an alert

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Alerts.
  3. In the details pane, double-click the alert.
  4. Click the Action tab.
  5. To have the Performance Logs and Alerts service create an entry visible in Event Viewer, select Log an entry in the application event log. This option is selected by default.
  6. To have the service trigger the messenger service to send a message, select Send a network message to, and then type the name of the computer on which the alert message should be displayed.
  7. To run a counter log when an alert occurs, select Start performance data log and specify the counter log you want to run.
  8. To have a program run when an alert occurs, select Run this program, and then type the file path and name or click Browse to locate the file. When an alert occurs, the service creates a process and runs the specified command file. The service also copies any command-line arguments you define to the command line that is used to run the file. Click Command Line Arguments and select the appropriate check boxes for arguments to include when the program is run.

Notes

  • XOX
  • XOX
  • When you select Run this program, by default, the program runs in the background.
  • To run an interactive program, open Services, and then in Performance Logs and Alerts, on the Log On tab, select the Allow service to interact with desktop check box.

Related Topics


Work with logs and alerts

  • Start or stop a counter log, trace log, or alert manually
  • Remove counters from a log or alert
  • View or change properties of a log or alert
  • Define start or stop parameters for a log or alert
  • Delete a log or alert


Start or stop a counter log, trace log, or alert manually

Microsoft Windows graphic

To start or stop a counter log, trace log, or alert manually

Using the Windows interface

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and click Counter Logs, Trace Logs, or Alerts.
  3. In the details pane, right-click the name of the log or alert you want to start or stop, and click Start to begin the logging or alert activity you defined, or click Stop to terminate the activity.

Notes

  • XOX
  • There might be a slight delay before the log or alert starts or stops. This change will be indicated when the icon changes color (from green for started to red for stopped, and vice versa).

Using a command line

  1. Open Command Prompt
  2. Type:

    logman start collection_name

    or

    logman stop collection_name

Value | Description
start collection_name | Starts the data collection query collection_name. Use this option to change from scheduled collections to manual ones. Use the update parameter in the command line with begin-time (–b), end-time (–e), or repeat-time (–rt) to reschedule collections.
stop collection_name | Stops the data collection query collection_name. Use this option to change from scheduled collections to manual ones. Use the update parameter in the command line with begin-time (–b), end-time (–e), or repeat-time (–rt) to reschedule collections.
For example, to stop the collection query named perf_log, type:

logman stop perf_log

Notes

  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    logman /?

Related Topics


Remove counters from a log or alert

Microsoft Windows graphic

To remove counters from a log or alert

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Counter Logs or Alerts.
  3. In the details pane, double-click the name of the log or alert.
  4. Under Counters, click the counter you want to remove, and then click Remove.

Note

  • XOX

Related Topics


View or change properties of a log or alert

Microsoft Windows Graphic

To view or change properties of a log or alert

Using the Windows interface

  1. Open Performance.
  2. Double-click Performance Logs and Alerts.
  3. Click Counter Logs, Trace Logs, or Alerts.
  4. In the details pane, double-click the name of the log or alert.
  5. View or change the log properties as needed.
Tool to modify | Properties to define | Tab to use
Alerts | Comment, counters, alert thresholds, and update interval | General
Alerts | Actions to take when an event occurs: run a program, send a message, start a counter log, update the event log | Action
Counter logs | Counter log counters and update interval | General
Counter logs | Counter log file comment, file type, file size limits, path and name, automatic naming parameters | Log Files
Counter logs | Manual or automated start and stop methods and schedule | Schedule
Trace logs | Trace log providers and events to log | General
Trace logs | Trace log comment, file size limits, path and name, automatic naming parameters | Log Files
Trace logs | Trace log buffer size, limits, and transfer interval | Advanced

Notes

  • XOX
  • To start or stop a log or alert, right-click its name in the details pane, and click Start or Stop as appropriate. This overrides any scheduled start and stop settings, resetting the start and stop mode to manual.

Using a command line

  1. Open Command Prompt.
  2. Type the appropriate command below:
Action | Command
To update counter log counters and the update interval. | logman update collection_name –c {path [path...]} | –cf {filename} –si [[hh:]mm:]ss
To update a counter log collection, file type, file size limits, path and name, and automatic naming parameters. | logman update collection_name –f {bin | bincirc | csv | tsv | SQL} –max value –o path –v {nnnnn | mmddhhmm}
To update manual to automated start and stop methods and schedule. | logman update collection_name –b M/d/yyyy h:mm:ss [AM | PM] –e M/d/yyyy h:mm:ss [AM | PM] –r
To update trace log providers and events to log. | logman update collection_name –p provider
To update a trace log collection, file type, file size limits, path name, and automatic naming parameters. | logman update collection_name –f {bin | bincirc} –max value –o path –v {nnnnn | mmddhhmm}
To update a trace log's buffer size, limits, and transfer interval. | logman update collection_name –bs {value} –nb {min max} –ft [[hh:]mm:]ss
Value | Description
update collection_name | Updates the collection query named collection_name. For counter collections, modifications to the query will stop, and then restart the collections.
–c {path [path...]} | –cf {filename} | Specifies the performance counter path to log (path), or specifies the path name of the log file that lists these counters (–cf filename). To list multiple counter paths, separate the command line by a space, or use the -cf option to list counter paths in an input file, one per line. Use this format [\\computer]\object[instance]\counter] for each counter path where: Computer is the optional computer name or the Internet protocol (IP) address of a remote computer. If a computer name is not supplied, the local computer will be used by default. Object is the performance counter object (process or memory). Instance (if any) is the performance object (process). Counter is the performance counter for the object (processor time).
–si [[hh:]mm:]ss | Specifies the update interval for counter collection in hours, minutes, and seconds.
-f bin | bincirc | csv | tsv | SQL | Specifies the file format used for collecting performance counter and trace data. You can use binary (bin), circular binary (circbin), comma (csv) and tab (tsv) separated, or SQL database (SQL) formats when collecting performance counters. If a file format is not specified, it defaults to binary. Binary (bin) and circular binary (circbin) are the only types supported for trace collections.
–max {value} | Specifies the maximum size of the collected log file in megabytes. If the log file exceeds the maximum size, the collection will stop. For an SQL database, the maximum size is the number of records to be written.
–o path | Specifies the path name of the output file that collects performance counter or trace data. By default, the collection log file name is the collection query name suffixed by either .blg for performance counters, or .etl for trace data.
–v {nnnnn | mmddhhmm} | Attaches the version control information to the end of the output file and path name. Use numeric nnnnn format, or date format mmddhhmm (month, day, 24-hour, minute) for version control.
–b M/d/yyyy h:mm:ss[AM | PM] | Specifies the begin-time for collections in a 24-hour format. You can also specify begin-time for collections in a 12-hour format by adding AM or PM in the command line. By default, the current day and time is used unless otherwise specified.
–e M/d/yyyy h:mm:ss[AM | PM] | Specifies the begin-time for collections in a 24-hour format. You can also specify begin-time for collections in a 12-hour format by adding AM or PM in the command line. By default, the current day and time is used unless otherwise specified.
–r –[–]r | Repeats the collection every day at the time periods specified by the –b and –e options. This is valid only for begin- and end-times specified on the same day, month, and year. –[–]r turns off the repeat option.
–p {provider [flags [level]]} | Specifies the name of the provider.
–bs {value} | Specifies the buffer size in n kilobytes for the trace log.
–nb {min max} | Specifies the minimum and maximum number of buffers for the trace log.
–ft [[hh:]mm:]ss | Specifies whether the buffer will be flushed, and the interval at which the buffer will be flushed.

Notes

  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    logman /?

Related Topics


Define start or stop parameters for a log or alert

Microsoft Windows Graphic

To define start or stop parameters for a log or alert

Using the Windows interface

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Counter Logs, Trace Logs, or Alerts.
  3. In the details pane, double-click the name of the log or alert.
  4. Click the Schedule tab.
  5. Under Start log, click one of the following options:
    • To start the log or alert manually, click Manually. When this option is selected, to start the log or alert, right-click the log name in the details pane, and click Start.
    • To start the log or alert at a specific time and date, click At, and then specify the time and date.
  6. Under Stop log, select one of the following options:
    • To stop the log or alert manually, click Manually. When this option is selected, to stop the log or alert, right-click the log or alert name in the details pane, and click Stop.
    • To stop the log or alert after a specified duration, click After, and then specify the number of intervals and the type of interval (days, hours, and so on).
    • To stop the log or alert at a specific time and date, click At, and then specify the time and date. (The year box accepts four characters; the others accept two characters.)
    • To stop a log when the log file becomes full, select options as follows:
      • For counter logs, click When the log file is full. The file will continue to accumulate data according to the file-size limit you set on the Log Files tab.
      • For trace logs, click When the n-MB log file is full. The file will continue to accumulate data according to the file-size limit you set on the Log Files tab.

      When setting this option, take into consideration your available disk space and any disk quotas that are in place. An error might occur if your disk runs out of disk space due to logging.

  7. Complete the properties as appropriate for logs or alerts:
    • For logs, under When a log file closes, select the appropriate option:
      • If you want to configure a continuous (automated) counter or trace logging, select Start a new log file.
      • If you want to run a program after the log file stops (for example, a copy command for transferring completed logs to an archive site), select Run this command. Also, type the path and file name of the program to run, or click Browse to locate the program.

        By default, the program runs in the background. If you want to run an interactive program, you should also open Computer Management and select the Allow service to interact with desktop check box on the Log On tab in Performance Logs and Alerts. Use Run as to select an administrative account that has access to the system.

        Where?

        • Programs
        • Administrative Tools
        • Computer Management
        • Services and Applications
        • Services
        • Performance Logs and Alerts
        • Log On tab
    • For alerts, under When an alert scan finishes, select Start a new alert scan if you want to configure continuous alert scanning.

Note

  • XOX
  • When you schedule a log to close at a specific time and date or close the log manually, the Start a new log file option is unavailable.
  • If the log is set to start at a scheduled time using Start At, the log will restart if the system reboots during the scheduled time. The scheduled time is based on the Stop settings.

Using a command line

  1. Open Command Prompt.
  2. Type:

    logman update collection_name –m start stop

Value | Description
update collection_name | Updates the collection query named collection_name.
–m start stop | Specifies that the logging will start and stop manually. Start specifies the time you want logging to start. Stop specifies the time you want logging to stop.

Notes

  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    logman /?

Related Topics


Delete a log or alert

Microsoft Windows Graphic

To delete a log or alert

Using the Windows interface

  1. Open Performance.
  2. Double-click Performance Logs and Alerts.
  3. Click Counter Logs, Trace Logs, or Alerts.
  4. In the details pane, right-click the name of the log or alert, and click Delete.

Note

  • XOX

Using a command line

  1. Open Command Prompt.
  2. Type:

    logman delete collection_name

Value | Description
delete collection_name | Deletes the collection query named collection_name. If collection_name does not exist, you will receive an error.

For example, to delete a log named perf_log, type:

logman delete perf_log

Notes

  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    logman /?

  • This command is used only for deleting logs. You cannot use this command to delete an alert.


Concepts

This section provides general background information about Windows XP performance monitoring tools:

  • Introduction to Performance
  • Understanding Performance
  • Using the Performance tools
  • Administering Performance
  • Resources


Introduction to Performance

Windows XP provides the following tools for monitoring resource usage on your computer:

  • System Monitor (part of the Performance console)
  • Performance Logs and Alerts (part of the Performance console)
  • Task Manager

Monitoring system performance is an important part of maintaining and administering your Windows XP installation. You use performance data to:

  • Understand your workload and its effect on your system's resources.
  • Observe changes and trends in workloads and resource usage so you can plan for future upgrades.
  • Test configuration changes or other tuning efforts by monitoring the results.
  • Diagnose problems and target components or processes for optimization.

System Monitor and Performance Logs and Alerts provide detailed data about the resources used by specific components of the operating system and by programs that have been designed to collect performance data. The graphs provide a display for performance-monitoring data. The logs provide recording capabilities for the data. Alerts send notification to users through the Messenger service when a counter value reaches, rises above, or falls below a defined threshold.

Microsoft technical support often uses the results of performance monitoring in problem diagnosis. Therefore, Microsoft recommends that you monitor system performance as part of your administrative routine.

Task Manager is another tool that provides performance information about systems running Windows XP. Task Manager provides information about programs and processes that are running on your computer, plus a summary of its processor and memory usage.

For overviews of the performance monitoring tools, see: System Monitor overview and Performance Logs and Alerts overview.


System Monitor overview

You can use System Monitor to measure the performance of your own computer or other computers on a network. Specifically, you can use System Monitor to do the following:

  • Collect and view real-time performance data on a local computer or from several remote computers.
  • View data collected either currently or previously in a counter log.
  • Present data in a printable graph, histogram, or report view.
  • Incorporate System Monitor functionality into applications that support ActiveX controls, such as Web pages, and Microsoft Word and other applications in the Microsoft Office suite.
  • Create HTML pages from performance views.
  • Create reusable monitoring configurations that can be installed on other computers using Microsoft Management Console.

With System Monitor, you can collect and view extensive data about the usage of hardware resources and the activity of system services on computers you administer. You can define the data you want the graph to collect in the following ways:

  • Type of data. To select the data to be collected, you can specify
    • performance objects, performance counters, and object instances.

Some objects provide data about system resources (such as memory). Others provide data about the operation of applications (for example, system services or Microsoft BackOffice applications running on your computer).

  • Source of data. System Monitor can collect data from your local computer or from other computers on the network where you have permission to do so. (By default, administrative permission is required.) In addition, you can include real-time data or data collected previously using counter logs.
  • Sampling parameters. System Monitor supports manual, on-demand sampling or automatic sampling based on a time interval you specify. When viewing logged data, you can also choose starting and stopping times so that you can view data spanning a specific time range.

In addition to options for defining data content, you have considerable flexibility in designing the appearance of your System Monitor views. You can choose from among the following options:

  • Type of display. System Monitor supports graph, histogram, and report views. The graph view is the default view; it offers the widest variety of optional settings.
  • Display characteristics. For any of the three views, you can define the colors and fonts for the display. In graph and histogram views, you can select from many different options when you view performance data. These options include the following:
    • Provide a title for your graph or histogram and label the vertical axis.
    • Set the range of values depicted in your graph or histogram.
    • Adjust the characteristics of lines or bars plotted to indicate counter values, including color, width, style, and so on.

For more information about the performance monitoring process, see Introduction to Performance.

For more information about the System Monitor user interface, see System Monitor interface.


Performance Logs and Alerts overview

With Performance Logs and Alerts you can collect performance data automatically from local or remote computers. You can view logged counter data using System Monitor or export the data to spreadsheet programs or databases for analysis and report generation. Performance Logs and Alerts offers the following capabilities:

  • Performance Logs and Alerts collects data in a comma-separated or tab-separated format for easy import to spreadsheet programs. A binary log-file format is also provided for circular logging or for logging instances such as threads or processes that might begin after the log starts collecting data. (Circular logging is the process of continuously logging data to a single file, overwriting previous data with new data.)
  • You can also collect data in an SQL database format. This option defines the name of an existing SQL database and log set within the database where the performance data will be read or written. This file format is useful when collecting and analysing performance data at an enterprise level rather than a per server basis.
  • Counter data collected by Performance Logs and Alerts can be viewed during collection as well as after collection has stopped.
  • Because logging runs as a service, data collection occurs regardless of whether any user is logged on to the computer being monitored.
  • You can define start and stop times, file names, file sizes, and other parameters for automatic log generation.
  • You can manage multiple logging sessions from a single console window.
  • You can set an alert on a counter, specifying that a message be sent, a program be run, an entry be made to the application event log, or a log be started when the selected counter's value exceeds or falls below a specified setting.

Similar to System Monitor, Performance Logs and Alerts provides support for defining performance objects, performance counters, and object instances, and setting sampling intervals for monitoring data about hardware resources and system services. Performance Logs and Alerts also offers other options related to recording performance data. These include:

  • Start and stop logging either manually on demand, or automatically based on a user-defined schedule.
  • Configure additional settings for automatic logging, such as automatic file renaming, and set parameters for stopping and starting a log based on the elapsed time or the file size.
  • Create trace logs. Using the default Windows XP system data provider or another application provider, trace logs record detailed system application events when certain activities such as a disk input/output (I/O) operation or a page fault occurs. When the event occurs, Windows XP logs the data to a file specified by the Performance Logs and Alerts service. This differs from the operation of counter logs; when counter logs are in use, the service obtains data from the system when the update interval has elapsed, rather than waiting for a specific event. A parsing tool is required to interpret the trace log output. Developers can create such a tool using application programming interfaces (APIs) provided on the MSDN Library Web site (http://msdn.microsoft.com/).
  • You can also produce trace analysis reports from trace log output files using the Tracerpt tool. Use this tool to process kernel, Active Directory, and other transactional-based trace event logs, and to generate trace analysis reports and a .csv files from binary logs.
  • Define a program that runs when a log is stopped.

If you want to export log data to Microsoft Excel, the Performance Logs and Alerts service must be stopped because Microsoft Excel requires exclusive access to the log file. Other programs are not known to require this exclusive access; therefore, in general you can work with data from a log file while the service is collecting data to that file.

For more information about the Performance Logs and Alerts user interface, see Performance Logs and Alerts interface.


Understanding Performance

This section describes the design and operation of System Monitor and Performance Logs and Alerts:

  • Performance objects and counters
  • Performance tool architecture
  • Performance monitoring in Windows NT 4.0


Performance objects and counters

Windows XP obtains performance data from components in your computer. As a system component performs work on your system, it generates performance data. That data is described as a performance object and is typically named for the component generating the data. For example, the Processor object is a collection of performance data about processors on your system.

A range of performance objects are built into the operating system, typically corresponding to the major hardware components, such as memory, processors, and so on. Other programs might install their own performance objects. For example, services such as Windows Internet Name Service (WINS), or server programs such as Microsoft Exchange provide performance objects, and performance graphs and logs can monitor these objects.

Each performance object provides counters that represent data on specific aspects of a system or service. For example, the Pages/sec counter provided by the Memory object tracks the rate of memory paging.

Although your system might make many more objects available, the following list provides the default objects you will use most frequently to monitor system components:

  • Cache
  • Memory
  • Objects
  • Paging File
  • PhysicalDisk
  • Process
  • Processor
  • Server
  • System
  • Thread

The following services or features of Windows XP that you might use in your configuration provide the following performance objects:

Feature or service to monitor | Performance object available
TCP/IP | Internet Control Message Protocol (ICMP), Internet Protocol (IP), NetBIOS over TCP/IP (NetBT), Transmission Control Protocol (TCP), and User Datagram Protocol (UDP) objects
Browser, Workstation, and Server services | Browser, Redirector, and Server objects
QoS Admission Control | Admission Control Service/RSVP Service and Interface objects
Windows Internet Name Service (WINS) | WINS object
Connection Point Services | PBServer Monitor object
Indexing Service | Indexing Service, Indexing Service Filter, and Http Indexing Service objects
Directory service | NT directory service (NTDS) object
Print server activity | Print queue object

For a description of the data provided by a particular counter associated with a performance object, click Explain in the Add Counters dialog box. For information about adding counters, see To add counters to System Monitor.

Although some objects (such as Memory and Server) have only a single instance, some performance objects can have multiple instances. If an object has multiple instances, you can add counters to track statistics for each instance, or for all instances at once.

Depending on how the counter was defined, its value can be one of the following:

  • The most recent measurement of an aspect of resource utilization. These are also called instantaneous counters.

    An example is Process\Thread Count, which shows the number of threads for a particular process as of the last time this was measured.

  • The average of the last two measurements over the period between samples. (Because counters are never cleared, this is actually an average of the difference between the measurements.)

    An example is Memory\Pages/sec, a rate per second based on the average number of memory pages during the last two samples.

    • Other counter types can be defined as described in the Platform Software Development Kit.

The combination of computer name, object, counter, instance, and instance index is known as the counter path. The counter path is typically shown in the tools as follows:

Computer_name\Object_name(Instance_name#Index_Number)\Counter_name

The computer_name is optional. If you do not supply a name, Windows XP will use the local computer by default.


Performance tool architecture

Various levels of the Windows architecture support the operation of System Monitor and Performance Logs and Alerts. For example, the performance tools obtain data by default through the registry. You can optionally collect data by using the Windows Management Instrumentation (WMI) interface for hardware resources or applications installed on the system. The Performance Data Helper dynamic-link library (DLL) acts as an intermediary between the WMI and the performance tools. It formats the data and makes calculations, where necessary, to convert raw data for display or reporting. For information about configuring performance tools to collect data using WMI, see To collect performance data by using WMI.

The DLLs supplied by the operating system provide counters for monitoring the behavior of resources such as memory, processors, disks, and network adapters and protocols. In addition, many Windows services and BackOffice applications provide their own DLLs that install counters you can use to monitor their operation.

System Monitor and Performance Logs and Alerts use the Remote Registry service process that manages user logon and logoff operations to monitor remote connections. In addition, they use the Messenger service in Windows to send users alert notification. (This service must be running for alert notifications to be received.)


Performance monitoring in Windows NT 4.0

The enhanced features of System Monitor and Performance Logs and Alerts replace the functionality of the Windows NT 4.0 Performance Monitor. You can use these tools to open settings files created in Windows NT 4.0 Performance Monitor.

The Microsoft Windows Resource Kits Web site (http://www.microsoft.com/) provides the Windows NT 4.0 version of Performance Monitor (perfmon4.exe).


Using the Performance tools

This section covers:

  • Setting up a monitoring configuration
  • Quick reference to System Monitor settings
  • System Monitor toolbar and keystroke reference
  • System Monitor interface
  • Performance Logs and Alerts interface
  • Analyzing performance data
  • Solving performance problems
  • Evaluating trends and planning for additional resources


Setting up a monitoring configuration

Setting up a monitoring configuration is the first step in evaluating your system's performance. To monitor your Windows XP installation, you can choose to view data in a graph or collect the data in log files for use in other applications.

For best results, read the following sections for setting up your monitoring configuration. However, to get started quickly, you can use the predefined log settings under Counter Logs. These settings, named System Overview, are configured to create a binary log that, after manual startup, updates every 15 seconds and logs continuously until it achieves a maximum size. If you start logging with these settings, data is saved to the Perflogs folder on the root directory and includes the counters: Memory\Pages/sec, PhysicalDisk(_Total)\Avg. Disk Queue Length, and Processor(_Total)\% Processor Time.

Choosing the monitoring method

Graphs are useful for short-term, real-time monitoring of a local or remote computer — for example, when you want to observe a system event while it is happening. Choose the update interval so as to capture the type of activity you are interested in. Logs are useful for record keeping and for extended monitoring, especially of a remote computer; logged data can be exported for report generation and presented as graphs or histograms using System Monitor. Logging is the most practical way to monitor multiple computers.

Choosing how often to monitor

For routine monitoring, start by logging activity over 15-minute intervals. If you are monitoring for a specific problem, you might want to vary the interval. If you are monitoring activity of a specific process at a specific time, set a frequent update interval; however, if you are monitoring a problem that manifests itself slowly, such as a memory leak, use a longer interval.

Also consider the overall length of time you want to monitor when choosing this interval. Updating every 15 seconds is reasonable if you are monitoring for no more than four hours. If you are monitoring a system for eight hours or more, do not set an interval shorter than 300 seconds (five minutes). Setting the update interval to a frequent rate (low value) can cause the system to generate a large amount of data, which can be difficult to work with and can increase the overhead of running Performance Logs and Alerts.

Monitoring a large number of objects and counters can also generate large amounts of data and consume disk space. Try to balance the number of objects you monitor and the sampling frequency to keep log file size within manageable limits.

If you prefer to maintain a long update interval when logging, you can still view data fluctuations that occur between those intervals. To do so, see To use logged data for information about manipulating time ranges within logs.

Choosing the data to monitor

Start by monitoring the activity of the following components in order:

  • Memory
  • Processors
  • Disks
  • Network

The following table shows the minimum counters recommended for server monitoring. When examining specific resources, you should include other counters for the associated performance object.

Component | Performance aspect being monitored | Counters to monitor
Disk | Usage | Physical Disk\Disk Reads/sec Physical Disk\Disk Writes/sec LogicalDisk\% Free Space Interpret the % Disk Time counter carefully. Because the _Total instance of this counter may not accurately reflect utilization on multiple-disk systems, it is important to use the % Idle Time counter as well. Note that these counters cannot display a value exceeding 100%.
Disk | Hindrances | Physical Disk\Avg. Disk Queue Length (all instances)
Memory | Usage | Memory\Available Bytes Memory\Cache Bytes
Memory | Hindrances | Memory\Pages/sec Memory\Page Reads/sec Memory\Transition Faults/sec Memory\Pool Paged Bytes Memory\Pool Nonpaged Bytes Although not specifically Memory object counters, the following are also useful for memory analysis: Paging File\% Usage object (all instances) Cache\Data Map Hits % Server\Pool Paged Bytes and Server\Pool Nonpaged Bytes
Network | Throughput | Protocol transmission counters (varies with networking protocol); for TCP/IP: Network Interface\Bytes total/sec Network Interface\ Packets/sec Server\Bytes Total/sec or Server\Bytes Transmitted/sec and Server\Bytes Received/sec You may want to monitor other objects for network and server throughput as described in Monitoring network activity.
Processor | Usage | Processor\% Processor Time (all instances)
Processor | Hindrances | System\Processor Queue Length (all instances) Processor\ Interrupts/sec System\Context switches/sec

If some of the counters listed in the preceding table are not available on your computer, verify that you have installed the necessary services or activated the counters.

Choosing the computer to use for monitoring

When monitoring computers remotely, you have some options for how to collect data. For example, you could run performance logging on the administrator's computer, drawing data continuously from each remote computer. In another case, you could have each computer running the service to collect data and, at regular intervals, run a batch program to transfer the data to the administrator's computer for analysis and archiving.

Centralized data collection (that is, collection on a local computer from remote computers that you are monitoring) is simple to implement because only one logging service is running. You can collect data from multiple systems into a single log file. However, it causes additional network traffic and might be restricted by available memory on the administrator's computer. To do centralized data collection, use the Add Counters dialog box to select a remote computer while running System Monitor on your local computer.

Distributed data collection (that is, data collection that occurs on the remote computers you are monitoring) does not incur the memory and network traffic problems of centralized collection. However, it does result in delayed availability of the data, requiring that the collected data be transferred to the administrator's computer for review. To do distributed data collection, use Computer Management on a local computer to select a remote computer on which to collect data.

When monitoring remote computers, note that the remote computer will only allow access to user accounts that have permission to access it. In order to monitor remote systems from your computer, you must start the Performance Logs and Alerts service using an account that has permission to access the remote computers you want to monitor. By default, the service is started under the local computer's "system" account, which generally has permission only to access services and resources on the local computer. To start this under a different account, use the Run As option when configuring data collection, or use Services under Computer Management and update the properties of the Performance Logs and Alerts service.

Keeping records of performance data

With Performance Logs and Alerts, you can log performance data to a SQL database. When you retain your logged data in a database, you can query the information and include it in reports. Using database analysis tools, you can query results and examine the results in detail using a variety of parameters. You can also use logs for trend-analysis and capacity-planning.

Exporting your monitoring configuration

After configuring the performance tools with the counters, update intervals, and other settings, you can save those settings on your local computer. If you save the settings under the name Perfmon.msc, note that you are permanently changing the configuration of the tools on the computer. Therefore, it is recommended that you save the file under another name.

In addition to saving monitoring settings, you can add other tools or add multiple copies of System Monitor, for example, if you want to monitor graph and report views simultaneously. For information about adding tools to a console, see To create a custom monitoring console.


Quick reference to System Monitor settings

For all of the following settings, first right-click the System Monitor details pane, and then click Properties.

To add or change this | Use this tab
View type: graph, histogram, or report | General
Objects, counters, and instances (add or delete) | Data You can also add counters by right-clicking the details pane and clicking Add Counters, or by clicking the Add button on the toolbar. To delete counters, use the Remove button on the Data tab, the DELETE key on the keyboard, or the Delete button on the toolbar. To remove all counters and specify new ones, click the New Counter Set button on the toolbar.
Source of data displayed: current data input to the graph, current data input from a log, archived data input from a log | Source You can also use the View Log File Data button on the toolbar to use a log file as the data source or View Current Activity to view real-time data.
Time range for a log and view time range | Source
Update frequency | General You can also use the Freeze Display and Update Data buttons on the toolbar to take samples manually.
Report or histogram value type(minimum, maximum, average) | General
Display of counter legend | General
Display of last, minimum, and maximum values for a selected counter (the value bar); allow multiple counter instances | General
Color, width, style, or graph line | Data
Scale of counter data values | Data
Background color of area bordering the graph area; color of graph data-display area | Appearance
Title of graph | Graph
Label on value axis, vertical or horizontal grid lines, and upper and lower limits of graph axes | Graph
Font color in graph display or legend | Appearance
Font type, size, and style | Appearance
Grid color, timer bar color | Appearance
Border style, appearance of graph window | General
Toolbar | General

Using report value types other than Current when monitoring real-time data incurs substantial overhead because of the need to make calculations across all samples for each value displayed.


System Monitor toolbar reference

Microsoft Windows graphic

System Monitor toolbar and keystroke reference

You can access many commonly used functions by using the buttons found on the System Monitor toolbar, or by using keystroke combinations. The following table displays these functions and their corresponding buttons or keystroke combinations.

Function | Button | Keystroke Combination
New Counter Set | New Counter Set | CTRL+E
Clear Display | Clear Display | CTRL+D
View Current Data | View Current Activity | CTRL+T
View Log File Data | View Log File Data | CTRL+L
View Graph | View Graph | CTRL+G
View Histogram | View Histogram | CTRL+B
View Report | View Report | CTRL+R
Add | Add | CTRL+I
Delete | Delete | DELETE
Paste Counter List | Paste Counter List | CTRL+V
Copy Properties | Copy Properties | CTRL+C
Properties | Properties | CTRL+Q
Freeze Display | Freeze Display | CTRL+F
Update Data | Update Data | CTRL+U
Highlight | Highlight | CTRL+H
Help | Help | F1


System Monitor interface

When you open Performance, by default, a toolbar will appear and the graph view area will display the same set of counters as those that appear with the system overview query in Performance Logs and Alerts. When you have added counters to the graph, after a short delay (depending on the time you select for the update interval), System Monitor will begin charting counter values in this graph area. You can choose to have data updated automatically or on demand; for updating on-demand, use the Update Data button to start and stop the collection intervals. Click the Clear Display button to remove all data from the display.

The names and associated information for the counters you select are shown in the columns beneath the graph. This is called the legend. The legend displays the following information:

  • Computer on which System Monitor is running.
  • Performance object.
  • Performance counter.
  • Graphical properties of each counter.
  • Performance object instance. Note that, by default, counter instances are listed by name and numerical index. This index appears after the instance name, represented by a pound sign (#) and a number. This index makes it easier to monitor multiple instances, for example, when you are monitoring threads of a process.

    To turn off the index display, right-click the graph, click Properties, and clear the Allow duplicate counter instances check box. By default, process and thread instances have a #n appended (where n is an integer). To append the process identifier (ID) instead, create a DWORD value called ProcessNameFormat under the following subkey:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfProc\Performance

    and set its value to 2. Likewise, to append the thread ID instead, create a DWORD value called ThreadNameFormat under the subkey:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfProc\Performance

    and set its value to 2.

    To turn off any of these options and return to the default, set the value of the appropriate DWORD to 1.

To match a line in a graph with the counter for which it is charting values, select a counter in the legend, then press CTRL+H or click the Highlight button on the toolbar, or double-click a position in the line. When highlighting is in effect, the bar or line representing data for the selected counter changes color to white for most background colors (including the default color) or black for white or light-colored backgrounds. If chart lines are close together, try to find a point in the graph where they diverge. Otherwise, System Monitor might not be able to find the value you are interested in.

Above the columns is the value bar, where you see the last, minimum, maximum, and average values for the counter that is currently selected. These values are calculated over the time period and number of samples displayed in the graph (reflected by the Duration value), not over the time that has elapsed since monitoring was started. The Duration value in the value bar indicates the total elapsed time displayed in the graph (based on the update interval). The movement of the timer bar across the graph indicates the passing of each update interval. Regardless of the update interval, the view will show up to 100 samples. System Monitor compresses log data as necessary to fit it in the display. To see the compressed data in a log, right-click the graph, click Properties, and select a shorter time range on the Source tab. Shorter time ranges contain less data, so it is less likely that data points will be eliminated.

You can define the attributes of the graph:

  • Type of display, with options for graph, histogram, or report
  • Background color of the details pane and of the data-display area
  • Size, type, and style of font used to show text in the display
  • Color, width, and style of line used to chart data

Be aware that default key settings in Microsoft Word can conflict with the CTRL+H combination used for System Monitor highlighting. You might need to change these key settings to support highlighting when the System Monitor control (Sysmon.ocx in the system_root\System32 folder) is used in Microsoft Word.

Clicking Object, Counter, Instance, or Computer in the counter legend sorts entries in ascending or descending order for that category. For example, to sort all counters by name, click Counter.

For more information, see Quick reference to System Monitor settings.


Performance Logs and Alerts interface

In Performance Logs and Alerts you define settings for counter logs, trace logs, and alerts. The details pane of the console window shows logs and alerts that you have created. You can define multiple logs or alerts to run simultaneously. Each log or alert is a saved configuration that you define. If you have configured the log for automatic starting and stopping, a single log can generate many individual log data files. For example, if you were generating a log file for each day's activity, one file would close at 11:59 P.M. today, and a new file would open at 12:00 A.M. tomorrow. The following table explains the query summary information provided by the columns in the details pane.

Column | Description
Name | The name of the log or alert. Think of this as a "friendly name," describing the type of data you are collecting or the condition you are monitoring. One log can generate multiple log files. Sample settings, named System Overview, have been predefined for counter logging. You can start logging using these settings or define your own settings, as appropriate.
Comment | This can be any descriptive information about the log or alert.
Log File Type | The log-file format you define. For alert, the type will always be alerts; for trace logs, it will always be sequential. For logs, this can be binary, binary circular, text file (comma delimited), text file (tab delimited) or SQL.
Log File Name | The path and base file name you defined for the files generated by this log. The base file name is used for automatically naming new files.

To see the parameters defined for each log, double-click the list entry for the log. In the dialog box that appears, you can choose how to name your log files, when logging is scheduled to occur, and what performance objects and counters you want to monitor in your log.

If a log is currently running and collecting data (based on the schedule you defined for the log or alert), a green data icon appears next to the log or alert. If a red icon appears, the log or alert has been defined but is not currently running.

You can configure more than one type of log to run at a time. One log can generate multiple log files if the restart option is selected, or if the user starts and stops the log multiple times. However, you will not see these individual log files listed in the console window. Use Windows Explorer to view a listing of these files.


Analyzing performance data

Analyzing your performance-monitoring data consists of examining counter values that are reported while your system is performing various operations. During this process, you should determine the processes that are most active and the programs or threads, if any, that are monopolizing a resource. Using this type of performance-data analysis, you can understand how your system is responding to workload demands.

As a result of this analysis, you might find that your system performs satisfactorily at some times and unsatisfactorily at others. Depending on the causes of these variations and the degree of difference, you may choose to take corrective action or to accept these variations and delay tuning or upgrading resources to a later time.

The level of system performance that you consider acceptable when your system is handling a typical workload and running all required services is its baseline. The baseline performance is a standard that the administrator determines based on the work environment. It might correspond to a range of counter values, including some that are temporarily unacceptable, but that generally indicate the best possible performance under the administrator's specific conditions. The baseline can be the measure used for setting performance expectations of your users and can be included in any service agreements that you put in place.

Analyzing performance data includes:

  • Determining acceptable values for counters
  • Understanding variations in performance data


Determining acceptable values for counters

In general, deciding whether or not performance is acceptable is a judgment that varies significantly with variations in user environments. The values you establish as the baselines for your organization are the best basis for comparison. Nevertheless, the following table containing threshold values for specific counters can help you determine whether values reported by your computer indicate a problem. If System Monitor consistently reports these values, it is likely that hindrances exist on your system and you should take tune or upgrade the affected resource.

For tuning and upgrade suggestions, see Solving performance problems.

Resource | Object\Counter | Suggested threshold | Comments
Disk Physical Disk\% Free Space
Logical Disk\% Free Space 		15%
Disk Physical Disk\\% Disk Time
Logical Disk\% Disk Time 		90%
Disk | Physical Disk\Disk Reads/sec, Physical Disk\Disk Writes/sec | Depends on manufacturer's specifications | Check the specified transfer rate for your disks to verify that this rate does not exceed the specifications. In general, Ultra Wide SCSI disks can handle 50 to 70 I/O operations per second.
Disk | Physical Disk\Current Disk Queue Length | Number of spindles plus 2 | This is an instantaneous counter; observe its value over several intervals. For an average over time, use Physical Disk\Avg. Disk Queue Length.
Memory | Memory\Available Bytes | Less than 4 MB | Research memory usage and add memory if needed.
Memory | Memory\Pages/sec | 20 | Research paging activity.
Paging File | Paging File\% Usage | Above 70% | Review this value in conjunction with Available Bytes and Pages/sec to understand paging activity on your computer.
Processor | Processor\% Processor Time | 85% | Find the process that is using a high percentage of processor time. Upgrade to a faster processor or install an additional processor.
Processor | Processor\Interrupts/sec | Depends on processor; 1000 interrupts per second is a good starting point | A dramatic increase in this counter value without a corresponding increase in system activity indicates a hardware problem. Identify the network adapter causing the interrupts. You might need to install an additional adapter or controller card.
Server | Server\Bytes Total/sec | If the sum of Bytes Total/sec for all servers is roughly equal to the maximum transfer rates of your network, you might need to segment the network.
Server Server\Work Item Shortages 3 If the value reaches this threshold, consider adding the DWORD entries InitWorkItems (the number of work items allocated to a processor during start up) or MaxWorkItems (the maximum number of receive buffers that a server can allocate) to the registry (under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters). The entry InitWorkItems can range from 1 to 512 while MaxWorkItems can range from 1 to 65535. Start with any value for InitWorkItems and a value of 4096 for MaxWorkItems and keep doubling these values until the Server\Work Item Shortages threshold stays below 3. For information about modifying the registry, see Registry Editor Help.

Caution

  • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.
Server | Server\Pool Paged Peak | Amount of physical RAM | This value is an indicator of the maximum paging file size and the amount of physical memory.
Server | Server Work Queues\Queue Length | 4 | If the value reaches this threshold, there may be a processor hindrance. This is an instantaneous counter; observe its value over several intervals.
Multiple Processors | System\Processor Queue Length | 2 | This is an instantaneous counter; observe its value over several intervals.


Understanding variations in performance data

The following considerations can help you understand performance variations that you observe:

  • Resource usage can vary dramatically based on the work being done at various times of day.
  • Counters that show usage ratios over an interval are more informative measurements than averages of instantaneous counter values because averages can include data for service startup or other events that can cause the numbers to go far out of range for a brief period, thereby skewing the results.


Solving performance problems

Analysis of your monitoring data can reveal problems such as excessive demand on certain resources resulting in slowdowns. This section discusses common causes for slowdowns and a recommended strategy for tuning and testing.

Causes of slowdowns

Demand on system resources might become extreme enough to cause resource slowdowns for the following reasons:

  • Resources are insufficient and additional or upgraded components are required.
  • Resources are not sharing workloads evenly and need to be balanced.
  • A resource is malfunctioning and needs to be replaced.
  • A program is monopolizing a particular resource; this might require substituting another program, having a developer rewrite the program, adding or upgrading resources, or running the program during periods of low demand.
  • A resource is incorrectly configured and configuration settings need to be changed.

Strategy for tuning and testing

The table of threshold values that is presented in Determining acceptable values for counters helps to isolate the performance problem by resource. Find the tuning and upgrade discussion related to your specific problem in one of the following topics:

  • Monitoring and tuning memory usage
  • Monitoring processor activity
  • Monitoring disk activity
  • Monitoring network activity
  • Monitoring Windows XP services
  • Monitoring legacy programs

Lack of memory is by far the most common cause of serious performance problems in computer systems. If you suspect other problems, check memory counters to rule out a memory shortage. Poor response time on a workstation is most likely to result from memory and processor problems; servers are more susceptible to disk and network problems.

Before you start tuning, consider the following recommendations:

  • Make one change at a time. In some cases, a problem that appears to relate to a single component might be the result of slowdowns involving multiple components. For this reason, it is important to address problems individually.

    Making multiple changes simultaneously can make it impossible to assess the impact of each individual change.

  • Repeat monitoring after every change. This is important for understanding the effect of the change and to determine whether additional changes are required. Proceed methodically, making one change to the identified resource at a time and then testing the effects of the changes on performance. Because tuning changes can affect other resources, it is important to keep records of the changes you make and to remonitor after you make a change.
  • In addition to monitoring, review event logs, because some performance problems generate output you can display in Event Viewer. For more information about using Event Viewer, see Event Viewer.
  • To see whether network components are playing a part in performance problems, compare the performance of programs that run over the network with locally run programs.

Tuning and upgrade tips by component

This section lists tuning tips for resources you are monitoring:

  • Memory:
    • Increase physical memory above the minimum required.
    • Create multiple paging files when you use multiple disks.
    • Determine the correct size for the paging files. The recommended size of the paging file is equivalent to 1.5 times the amount of RAM available on your system.
    • Ensure that memory settings are properly configured as described in Making sure you have enough memory.
    • Run memory-intensive programs on your highest-performing computers or when system workload is light.
  • Disk:
    • Upgrade to a higher-speed disk, or add disks. When you do this, upgrade the disk controller and the bus.
    • On servers, use Disk Management to create striped volumes on multiple physical disks. This solution increases throughput because I/O commands can be issued concurrently.
    • Distribute programs among servers. Distributed File System (DFS) can be used to balance workload.
    • Isolate tasks that heavily utilize disk I/O on separate physical disks or disk controllers.
    • Use Disk Defragmenter to consolidate files optimizing data access and disk space.
    • If you want to improve the efficiency of disk access, consider installing the latest driver software for your host adapters. Contact your adapter manufacturer for information.
  • Processor:
    • Add a processor (especially for multithreaded programs), or upgrade to a faster processor.
    • On multiprocessor computers, manage the processor affinity with respect to process threads and interrupts.
  • Network:
    • Configure your network so that systems shared by the same group of people are on the same subnet.
    • Unbind infrequently used network adapters. For more information, see To modify the protocol bindings order .
    • If you are using more than one protocol, you can set the order in which the workstation and NetBIOS software bind to each protocol. See Network and Dial-Up Connections Help for more information. Some reasons for changing the list order are:
      • If the protocol you use most frequently is first in the binding list, average connection time decreases.
      • Some protocols are faster than others for certain network topologies. If you are optimizing a client computer, putting the faster protocol first in the bindings list improves performance. Because the server accepts incoming connections using the protocol chosen by the client computer, there is no reason to reorder server computer bindings.
    • Install a high-performance network adapter in the server. If your server uses a 16-bit adapter, you can significantly increase performance by replacing it with a high-performance 32-bit adapter.
    • Use multiple network adapters. Windows XP supports multiple adapters for a given protocol and multiple protocols for a given adapter. Although this configuration can create distinct networks that cannot communicate with one another, it is a way to increase file-sharing throughput.

Solving performance problems includes:

  • Monitoring and tuning memory usage
  • Monitoring processor activity
  • Monitoring disk activity
  • Monitoring network activity
  • Monitoring Windows XP services
  • Monitoring legacy programs


Monitoring and tuning memory usage

Monitoring and tuning memory usage includes:

  • Watching how programs use system resources
  • Making sure you have enough memory


Watching how programs use system resources

Because processor and memory resources have such a significant influence on the operation of your computer, it is important to understand how programs use these resources. This topic describes how observing certain counters in the System Monitor graph display can help you learn about processor and memory usage by programs. Start by working with the Process\% Processor Time and Process\Working Set counters:

  • % Processor Time. The percentage of elapsed time that a processor is busy executing all threads for a particular process. (Notice that % Processor Time is high for the Idle process when the system is not busy.)
  • Working Set. The current number of physical memory bytes used by or allocated to a process. This value can be larger than the minimum number of bytes actually needed by the process. It may reflect physical bytes that are shared by multiple processes.

Using these counters, you can graph some or all of the programs running on a computer, as shown in the following example, charting processor usage by System Monitor (shown as MMC).

Graph of processor usage by applications

Notice that, at program startup, the Process\% Processor Time values climb sharply for each program, decrease, and then level off. It's important to be aware that processor usage spikes at program startup; you may want to omit temporarily high startup values from your monitoring data to obtain a more accurate picture of typical processor usage by your programs.

After startup, the graph should show increases in processor activity as the programs perform some activity — for example, as System Monitor reads a new set of counter values. You can observe this by changing the update interval for System Monitor. Notice that, if System Monitor is configured with a short update interval, it will read data more frequently and generate more processor activity by System Monitor. A longer update interval will generate less processor activity.

Monitoring memory-counter values for programs provides a similar illustration of how programs make demands on system resources and how those resources respond. For every program running on a computer, the operating system allocates a portion of physical memory. This is called the working set. Even if the program is not generating any activity, the operating system allocates memory for the program's working set.

The working-set value is of particular interest when the Memory\Available Bytes counter falls below a certain threshold. Windows XP satisfies the memory requirements of programs by using free (available) bytes. As free bytes fall into short supply, the operating system begins to replenish the shortage by taking memory from the working sets of less active programs. As a result, you will see the values for one program's working set increase while the values for other programs decrease. If there isn't sufficient memory on the system to satisfy the requirements of all active programs, paging occurs and program performance suffers. For information about monitoring paging activity, see Checking for excessive paging.

Graph of memory usage by applications

You can expand sample reports and charts to include more programs and more counters. To understand system activity, watch these and other counter values as you change system activity levels.

For information about how you can monitor processor activity or memory usage, see the following topics:

  • Making sure you have enough memory
  • Monitoring processor activity


Making sure you have enough memory

Memory usage is perhaps the most important factor in system performance. One of the ways you might become aware of a memory shortage is if your system is paging frequently. Paging is the process of moving fixed-size blocks of code and data from RAM to disk using units called pages in order to free memory for other uses. Although some paging is acceptable because it enables Windows XP to use more memory than actually exists, constant paging is a drain on system performance. Reducing paging will significantly improve system responsiveness.

This section describes how you can determine whether your system has an adequate amount of memory and an appropriate configuration for its role and how to begin to analyze its paging activity. (Further discussion of paging and related factors appears in Checking for excessive paging.)

Checking your configuration

Before beginning to monitor memory usage on your computer in detail, verify that your computer is properly equipped and configured:

  1. Make sure your system has the recommended amount of memory for running Windows XP and all of your programs or services. Compare the amount of memory on your system with requirements of the operating system and your programs. Consult product documentation for programs or services that you are running to verify that memory is adequate.

    To see the amount of system memory, see To determine the amount of RAM on your computer. To estimate your memory requirements, start with the memory required for the operating system and add the following factors:

    • Number of users multiplied by the average size of the open data files per user
    • Number of programs run on the server computer multiplied by the average size of programs run on the server

    If you are uncertain about the memory requirements of a process that you are running, you can note its working set in System Monitor, shut it down, and observe the corresponding effect on paging activity on your computer. The amount of memory freed by terminating programs is the amount of additional physical RAM needed on the system.

  2. Check that system settings are appropriate based on how you use your computer. When you install Windows XP, Setup configures your computer with settings that optimize it for file sharing. However, in some cases, that configuration can cause excessive paging on your computer because it causes the system to maintain a large system-cache working set. If you are not using the computer for file sharing or for other programs that specifically require this setting to be enabled, you can turn it off to reduce the amount of paging.

    To change these settings, see To configure memory-related settings on your computer.

Monitoring memory counters

To monitor for a low-memory condition, start with the following object counters:

  • Memory\Available Bytes
  • Memory\Pages/sec

Available Bytes indicates how many bytes of memory are currently available for use by processes. Pages/sec provides the number of pages that were either retrieved from disk due to hard page faults or written to disk to free space in the working set due to page faults.

Low values for Available Bytes (4 MB or less) might indicate there is an overall shortage of memory on your computer or that a program is not releasing memory. If the value of Pages/sec is 20 or more, you should research the paging activity further. A high rate for Pages/sec might not indicate a memory problem but might instead be the result of running a program that uses a memory-mapped file.

You must monitor Available Bytes along with Pages/sec and Paging File % Usage to determine whether this is the case. If you are reading a noncached memory-mapped file, you should also see normal or low cache activity. For more information, see Checking for excessive paging.

If you suspect a memory leak, monitor Memory\Available Bytes and Memory\Committed Bytes to observe memory behavior and monitor Process\Private Bytes, Process\Working Set, and Process\Handle Count for processes you think might be leaking memory. Also monitor Memory\Pool Nonpaged Bytes, Memory\Pool Nonpaged Allocs, and Process(process_name)\Pool Nonpaged Bytes if you suspect that a kernel-mode process is causing the leak.

Checking for excessive paging

Because excessive paging can make substantial use of the hard disk, it is possible to confuse a memory shortage that causes paging with a disk bottleneck that results in paging. As a result, when you investigate the causes of paging, where a memory shortage is not apparent, make sure to track disk usage counters such as the following along with memory counters:

  • Logical Disk\% Disk Time
  • Physical Disk\Avg. Disk Queue Length

For example, include Page Reads/sec with % Disk Time and Avg. Disk Queue Length. If a low rate of page-read operations coincides with high values for % Disk Time and Avg. Disk Queue Length, there could be a disk bottleneck. However, if an increase in queue length is not accompanied by a decrease in the pages-read rate, then a memory shortage exists.

To determine the impact of excessive paging on disk activity, multiply the values of the Physical Disk\Avg. Disk sec/Transfer and Memory\Pages/sec counters. If the product of these counters exceeds 0.1, paging is taking more than 10 percent of disk access time. If this occurs over a long period, you probably need more memory.

Investigating program activity

Next, check for excessive paging due to programs that are running. If possible, stop the program with the highest working set value and see whether that dramatically changes the paging rate. If you suspect excessive paging, check the Memory\Pages/sec counter. This counter shows the number of pages that needed to be read from disk because they were not in physical memory. (Notice the difference between this counter and Page Faults/sec, which indicates only that data was not immediately available in the specified working set in memory.)

Checking the paging file size

You have some options for how to manage your paging file for better performance:

  • You can place a paging file on other disk drives. If you have multiple hard disks, splitting up the paging file is a good idea because it will speed up the access time. If you have two hard disks and you split the paging file, both hard disks can be accessing information simultaneously, greatly increasing the throughput. However, if you have two hard disks and one hard disk is faster than the other, it might be more effective to store the paging file only on the faster hard disk. You might need to experiment to arrive at the best configuration for your system.
  • You can increase the size of the paging file. When you start Windows XP, it automatically creates a paging file (Pagefile.sys) on the disk where you installed the operating system. Windows XP uses the paging file to provide virtual memory. The recommended size for the paging file is equivalent to 1.5 times the amount of RAM available on your system. However, the size of the file also depends on the amount of free space available on your hard disk when the file is created. You can find out how large your system's paging file is by looking at the file size shown for Pagefile.sys in Windows Explorer.

    If you are not already short of disk space, you can increase the size of the paging file. If your users tend to run several programs simultaneously, they might find that increasing the size of the paging file will enable programs to start faster.

    Although you can reset both the initial and the maximum sizes for the paging file, it is more efficient to expand initial paging file size, rather than force the operating system to allocate more paging file space as programs start, which fragments the disk.

    If the paging file reaches its maximum size, a warning is displayed and the system might halt. To see whether your paging file is approaching its upper-limit before reaching it, check the actual file size and compare it to the maximum paging file size setting in the System utility in Control Panel. If these two numbers are close in value, consider increasing initial paging file size or running fewer programs.

    Paging file counters offer another way to see whether the size of the Pagefile.sys file is appropriate:

    • Paging File\% Usage
    • Paging File\% Usage Peak (bytes)

    If the % Usage Peak value approaches the maximum paging file setting, or if % Usage nears 100 percent, consider increasing the initial file size.

If multiple paging files are spread across multiple disk drives, the path name of each file appears as an instance of the Paging File object type. You can either add a counter for each paging file or select the _Total instance to look at combined usage data for all your paging files.


Monitoring processor activity

Monitoring the Processor and System object counters provides valuable information about the utilization of your processors and helps you determine whether or not a bottleneck exists. You will want to include the following:

  • Processor\% Processor Time for processor usage.

    Optionally, you can also monitor Processor\% User Time and % Privileged Time along with % Processor Time for more detail.

  • System\Processor Queue Length for bottleneck detection.

Observing processor usage values

To gauge the activity of the processor, check the Processor\% Processor Time counter. This counter shows the percentage of elapsed time that a processor is busy executing a nonidle thread.

When you examine processor usage, consider the role of the computer and the type of work being done. Depending on what the computer is doing, high processor values could mean either that the system is efficiently handling a heavy workload or that it is struggling to keep up. For example, if you are monitoring a user's computer, and that computer is used for computation, the computational program might easily use 100 percent of the processor's time. Even if this causes the performance of other applications on that computer to suffer, this can be addressed by changing workload.

On the other hand, values around 100 percent on a server computer that processes many client requests indicate that processes are queuing up, waiting for processor time, and causing a bottleneck. Such a sustained high level of processor usage is unacceptable for a server.

Investigating processor bottlenecks

A processor bottleneck develops when threads of a process require more processor cycles than are available. Long processor queues can build up and system response suffers. The two most common causes of processor bottlenecks are CPU-bound programs and drivers or subsystem components (typically disk or network components) that generate excessive interrupts.

To determine whether a processor bottleneck exists due to high levels of demand for processor time, check the value of the System\Processor Queue Length counter. A queue of two or more items indicates a bottleneck. If more than a few program processes are contending for most of the processor's time, installing a faster processor will improve throughput. An additional processor can help if you are running multithreaded processes, but be aware that scaling to additional processors may have limited benefits. See Monitoring multiprocessor systems for more information.

In addition, the Server Work Queues\Queue Length counter, which tracks the current length of the server work queue for the computer, can reveal processor bottlenecks. A sustained queue length greater than 4 indicates possible processor congestion. This counter is a value at a specific time, not an average over time.

To determine whether interrupt activity is causing a bottleneck, watch the values of the Processor\Interrupts/sec counter, which measures the rate of service requests from input/output (I/O) devices. If this counter value increases dramatically without a corresponding increase in system activity, it can indicate a hardware problem.

You can also monitor Processor\% Interrupt Time for an indirect indicator of the activity of disk drivers, network adapters, and other devices that generate interrupts.

Note

  • To detect hardware problems that may affect processor performance, such as IRQ conflicts, watch the values of System\File Control Bytes/second.

Monitoring multiprocessor systems

To observe the efficiency of a multiprocessor computer, use the following additional counters.

Counter | Description
Process\% Processor Time | The sum of processor time on each processor for all threads of the process.
Processor(_Total)\% Processor Time | A measure of processor activity for all processors in the computer. This counter sums the average nonidle time of all processors during the sample interval and divides it by the number of processors. For example, if all processors are busy for half of the sample interval, on average, it displays 50%. It also displays 50% if half of the processors are busy for the entire interval, and the others are idle.
Thread\% Processor Time | The amount of processor time for a thread.

Managing processor affinity on multiprocessor systems

If you want to assign a particular process or program to a single processor to improve its performance at the expense of other processes, in Task Manager, click Set Affinity. This option is available only on multiprocessor systems.

Controlling processor affinity can improve performance by reducing the number of processor cache flushes as threads move from one processor to another. This might be a good option for dedicated file servers. However, be aware that dedicating a program to a particular processor may not allow other program threads to migrate to the least-busy processor.

You may also want to control processor affinity for interrupts generated by disk or network adapters. A tool provided on the Microsoft Windows Resource Kits (http://www.microsoft.com/) companion disc enables you to manage interrupts in this way.


Monitoring disk activity

Disk-usage statistics help you balance the workload of network servers. System Monitor provides physical disk counters for troubleshooting, capacity planning, and for measuring activity on a physical volume.

At a minimum you should monitor the following counters:

  • Physical Disk\Disk Reads/sec and Disk Writes/sec
  • Physical Disk\Current Disk Queue Length
  • Physical Disk\% Disk Time
  • LogicalDisk\% Free Space

When testing disk performance, log performance data to another disk or computer so that it does not interfere with the disk you are testing.

Additional counters you may want to observe include Physical Disk\Avg. Disk sec/Transfer, Avg. Disk Bytes/Transfer, and Disk Bytes/sec.

The Avg. Disk sec/Transfer counter reflects how much time a disk takes to fulfill requests. A high value might indicate that the disk controller is continually retrying the disk because of failures. These misses increase average disk transfer time. For most disks, high average disk transfer times correspond to values greater than 0.3 seconds.

You can also check the value of Avg. Disk Bytes/Transfer. A value greater than 20 KB indicates that the disk drive is generally performing well; low values result if an application is accessing a disk inefficiently. For example, applications that access a disk at random raise Avg. Disk sec/Transfer times because random transfers require increased seek time.

Disk Bytes/sec gives you the throughput rate of your disk system.

Because disk counters can cause a modest increase in disk access time, Windows XP does not automatically activate the counters at system startup.

Determining workload balance

To balance loads on network servers, you need to know how busy the server disk drives are. Use the Physical Disk\% Disk Time counter, which indicates the percentage of time a drive is active. If % Disk Time is high (over 90 percent), check the Physical Disk\Current Disk Queue Length counter to see how many system requests are waiting for disk access. The number of waiting I/O requests should be sustained at no more than 1.5 to 2 times the number of spindles making up the physical disk.

Most disks have one spindle, although Redundant Array of Inexpensive Disks (RAID) devices usually have more. A hardware RAID device appears as one physical disk in System Monitor; RAID devices created through software appear as multiple drives (instances). You can either monitor the Physical Disk counters for each physical drive (other than RAID), or you can use the _Total instance to monitor data for all the computer's drives.

Use the values of the Current Disk Queue Length and % Disk Time counters to detect bottlenecks with the disk subsystem. If Current Disk Queue Length and % Disk Time values are consistently high, consider upgrading the disk drive or moving some files to an additional disk or server.

Notes

  • The LogicalDisk object counters have been removed. The system maps physical drives to logical drives using the same instance name. Therefore, if you have a dynamic volume that consists of multiple physical disks, instances might appear as "Disk 0 C:," "Disk 1 C:," and "Disk 2 D:," where C: is made up of physical drives 0 and 1. If you have two logical partitions on a disk, the instance appears as "0 C: D:."
  • For hardware-enabled stripe sets, per-disk statistics are not available. You can obtain this data only when monitoring stripe sets enabled in software.
  • If you are using a RAID device, the % Disk Time counter can indicate a value greater than 100 percent. If it does, use the Avg. Disk Queue Length counter to determine how many system requests on average are waiting for disk access.


Monitoring network activity

Network monitoring typically consists of observing server resource utilization and measuring overall network traffic. With System Monitor you can handle both of these activities, although for in-depth traffic analysis, you should use Network Monitor.

Start by tracking the counters that are described in the topic Setting up a monitoring configuration to observe resource usage on your server. To concentrate on network-related resource usage, add the counters that correspond to the various layers of your network configuration. Abnormal network counter values often indicate problems with a server's memory, processor, or disks. For that reason, the best approach to monitoring a server is to watch network counters in conjunction with Processor\% Processor Time, PhysicalDisk\% Disk Time, and Memory\Pages/sec.

For example, if a dramatic increase in Pages/sec is accompanied by a decrease in Bytes Total/sec handled by a server, the computer is probably running short of physical memory for network operations. Most network resources, including network adapters and protocol software, use nonpaged memory. If a computer is paging excessively, it could be because most of its physical memory has been allocated to network activities, leaving a small amount of memory for processes that use paged memory. To verify this situation, check the computer's system event log for entries indicating that it has run out of paged or nonpaged memory.

Note

  • The operating system automatically sets a default limit for allocable nonpaged pool memory. This default value is approximately 80 percent of installed memory. If the system reaches this limit as a result of network activity, problems can result. To change this limit, modify the registry under:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\MaxNonpagedMemoryUsage

    For information about modifying the registry, see Registry Editor Help.

    Caution

    • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.

If you enable Network Monitor, you can use network-related objects with System Monitor to analyze overall network performance. For information on monitoring overall network traffic, see Monitoring overall network traffic.

Observing throughput across network layers

Investigating network performance includes monitoring activity at different network layers:

  • Data-link layer. This includes the network adapter. Use the Network Interface object counters:
    • Bytes total/sec
    • Bytes sent/sec
    • Bytes received/sec.

    • Note

    • If you are using media-sense network adapters, Windows XP displays an icon in the taskbar if the adapter becomes disconnected from the network medium. Because the driver supporting the adapter continues to run even when it is not processing traffic, the driver causes the continued use of system resources and drains performance. Therefore, it is important to attend to disconnected adapters immediately after the system detects them. As soon as you see the icon, check the adapter connection. Reconnect the adapter if appropriate; otherwise disable or remove the adapter to avoid the waste of resources associated with this condition.
  • Network layer. Use the IP object counters:
    • Datagrams Forwarded/sec
    • Datagrams Received/sec
    • Datagrams/sec
    • Datagrams Sent/sec.
  • Transport layer. Varies with network protocol in use. For TCP/IP, use the TCP object counters:
    • Segments Received/sec
    • Segments Retransmitted/sec
    • Segments/sec
    • Segments Sent/sec.

    If the retransmission rate is high, there may be a hardware problem.

    The ICMP and UDP object counters are also provided and are useful for more extensive monitoring of TCP/IP network transmissions. The ICMP performance object consists of counters that measure the rates at which Internet Control Message Protocol (ICMP) messages are sent and received by using the ICMP protocol. It also includes counters that monitor ICMP protocol errors.The UDP performance object consists of counters that measure the rates at which User Data Protocol (UDP) datagrams are sent and received using the UDP. It includes counters that monitor UDP errors.

    If you are using the NWLink protocol, three objects are available: NWLink IPX and NWLink NetBIOS for computers communicating over the IPX protocol; and NWLink SPX for computers connecting over the SPX protocol. Note that frame-related counters for these objects report only zeroes.

  • Presentation/program layer. Use the Server object counters if you are monitoring a server, or the Redirector object counters if you are monitoring a user's client computer. (Some program-layer processes, such as Web servers, may have their own object counters, which you would use for monitoring transmissions across this layer.)

    The Redirector object counters collect data about requests transmitted by the Workstation service; the Server object counters collect data about requests received and interpreted by the Server service.

    At a minimum, include the Bytes total/sec counter for both the Redirector object (for client computers that you monitor) and the Server object (for server computers).

    Each of these objects provides several other counters you may want to monitor if you suspect problems with either the Workstation or Server services:

    • Redirector\Current Commands
    • Redirector\Network Errors/sec
    • Redirector\Reads Denied/sec
    • Redirector\Writes Denied/sec
    • Redirector\Server Sessions Hung
    • Server\Sessions Errored Out
    • Server\Work Item Shortages
    • Server\Pool Paged Peak
    • Server\Nonpaged Pool Failures

    If the Work Item Shortages counter value is increasing, consider changing the registry values for InitWorkItems or MaxWorkItems under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer.

    The Sessions Errored Out counter reports automatic disconnections along with errored-out sessions. To get a more accurate value for errored-out sessions, obtain the value for Sessions Timed Out and reduce the Sessions Errored Out value by that amount. See Resources for more information.

Monitoring overall network traffic

If network traffic exceeds local area network (LAN) capacity, performance typically suffers across the network. To prevent this situation, it is important to monitor network-wide traffic levels, particularly on larger networks with bridges and routers. To monitor network traffic, please install the Network Monitor.

For information about Network Monitor, see Network Monitor Help.


Monitoring Windows XP services

The many services available with Windows XP provide their own performance objects and counters. These are as follows:

  • Monitoring the Browser service
  • Monitoring directory service activity
  • Monitoring DHCP
  • Monitoring Distributed Transaction Coordinator
  • Monitoring QoS Admission Control
  • Monitoring DNS
  • Monitoring Fax Service
  • Monitoring the File Replication service
  • Monitoring Indexing Service
  • Monitoring Internet Authentication Service
  • Monitoring Internet Information Services
  • Monitoring the Phone Book service
  • Monitoring SMTP
  • Monitoring telephony counters
  • Monitoring WINS
  • Monitoring Battery Status


Monitoring the Browser service

If your organization is maintaining domains under Windows NT Server 4.0, use the following counters for monitoring the Browser service:

  • Browser\ Mailslot Allocations Failed
  • Browser\ Mailslot Opens Failed/sec
  • Browser\ Mailslot Receives Failed
  • Browser\ Mailslot Writes Failed
  • Browser\ Missed Mailslot Datagrams
  • Browser\ Missed Server Announcements
  • Browser\ Missed Server List Requests
  • Browser\ Server Announce Allocations Failed/Sec


Monitoring directory service activity

The NTDS object provides statistics about the activity of the directory service. Some important counters to monitor using this object include the following:

  • DRA Inbound Object Updates Remaining in Packet
  • DRA Pending Replication Synchronizations
  • LDAP Client Sessions
  • LDAP Bind Time


Monitoring DHCP

The DHCP service performance object provides counters for monitoring activity of the DHCP service. For more information about using these counters, see DHCP Concepts.


Monitoring Distributed Transaction Coordinator

The Distributed Transaction Coordinator performance object provides statistics about the activity of the Distributed Transaction Coordinator, a part of Component Services that coordinates external transactions (also known as two-phase transactions). See Component Services for more information.


Monitoring QoS Admission Control

QoS Admission Control installs the Admission Control Service/RSVP performance object for monitoring purposes. Network administrators can use these counters to monitor the RSVP reservations in a subnet.


Monitoring DNS

The Domain Name System (DNS) performance object provides statistics about the activity of the DNS service. For more information, see Using System Monitor.


Monitoring Fax Service

The Fax Service object tracks activity of Fax Service while the service is running. It is recommended that you use the counters in conjunction with event log data about fax events to assess service performance.

The following counters can indicate a system problem, such as installation of the wrong modem driver, which prevents the fax from being sent or received:

  • Inbound Failed Receptions. This counter indicates the number of faxes that were not received. This would be a call that was answered without a fax being received.
  • Outbound Failed Connections. This counter indicates the number of faxes that were not sent, for example, because there was no dial tone, no answer, a busy line, or because of another unknown error.
  • Outbound Failed Transmissions. This counter indicates the number of faxes that could not be sent.

If you see values for these counters, check the event log for details; no dial tone, no answer, or busy lines will be noted. An unknown error could indicate a system problem. In this case, check the phone line for line noise, and check the sending and receiving fax devices for an incorrect modem driver.


Monitoring the File Replication service

The File Replication service provides the FileReplicaConn and FileReplicaSet objects to provide information about activity of the File Replication service.

The FileReplicaConn object displays performance statistics of the REPLICACONN object that defines replica connections to Distributed File System (DFS) roots.

The FileReplicaSet object displays performance statistics of the REPLICASET object that defines a replica set (one or more replicas, shared volumes, or directories that store duplicates of the contents of an original share). The object reports statistics for the computer that constitutes the original share.

For example, in a bidirectional ring topology of three computers A, B, and C, where computer A and computer C both replicate from computer B, the FileReplicaSet counters would provide data for computer B.


Monitoring Indexing Service

Indexing Service provides the following three different performance objects:

  • HTTP Indexing Service object. The counters for this object report statistics regarding queries run by Indexing Service.
  • Indexing Service object. The counters for this object report statistics pertaining to the creation of indexes and the merging of indexes by Indexing Service.
  • Indexing Service Filter object. The counters for this object report filtering activity of Indexing Service.

Use the "HTTP Indexing Service\Total requests rejected" counter to monitor Indexing Service for server obstacles


Monitoring Internet Authentication Service

The following objects report activity of Internet Authentication Service (IAS):

  • IAS Accounting Clients
  • IAS Accounting Server
  • IAS Authentication Clients
  • IAS Authentication Server
  • IAS Remote Accounting Server
  • IAS Remote Authentication Server
  • IAS Accounting Proxy Server
  • IAS Authentication Proxy Server


Monitoring Internet Information Services

Internet Information Services provides the following counters for monitoring service activity:

  • FTP Service object
  • Internet Information Services Global object
  • Web Service and Web Service Cache objects
  • Active Server Pages object

FTP Service object counters

The FTP Service object counters show data about the anonymous and nonanonymous connections to the File Transfer Protocol (FTP) Server application. The counters can be reported on a per-site basis.

Internet Information Services Global object

The Internet Information Services Global object contains counters that report on bandwidth throttling and on usage of the Internet Information Services (IIS) Object Cache, a cache shared by the IIS services.

Bandwidth throttling is a feature of Internet Information Services that limits the bandwidth used by the IIS services to a value set by an administrator. If the bandwidth used by the IIS services approaches or exceeds this limit, bandwidth throttling delays or rejects IIS service requests until more bandwidth becomes available.

The IIS Object Cache stores frequently used objects and objects that would slow performance if they were retrieved repeatedly. The counters provide reports on the size and content of the IIS Object Cache, as well as its effectiveness, such as cache hits and misses.

Web Service and Web Service Cache objects

These Web Service objects provide counters that show data about the anonymous and nonanonymous connections to the Hypertext Transport Protocol (HTTP) service application and HTTP requests, listed by request method, that have been handled since the Web service was started.

Active Server Pages object

You can use the Active Server Pages object to monitor applications running on your Web server that use Active Server Pages. To monitor requests processed by calls to Common Gateway Interface (CGI) applications or Internet Server Application Programming Interface (ISAPI) extensions, use counters on the Web Service object.


Monitoring the Phone Book service

The PBServer Monitor performance object monitors activity on the phone book server. The Total Hits/Sec counter is useful in determining the amount of traffic on the phone book server.


Monitoring SMTP

The SMTP Server performance object monitors message activity generated by the Simple Mail Transport Protocol (SMTP) service.


Monitoring telephony counters

It can be useful to monitor telephony counters if you are using a computer as a telephony server, such as a remote access server, or if you are using a driver to enable your server to emulate a small Private Branch Exchange (PBX) or telephone switch.

Monitor the following counters and research server activity if the values for these counters are lower than expected:

  • Telephony\ Incoming calls/sec
  • Telephony\ Outgoing calls/sec
  • Telephony\ Total number of calls


Monitoring WINS

Windows Internet Name Service (WINS) installs the WINS server performance object for monitoring service activity. The WINS server performance counters are cleared each time you start and stop the service.

For more information about WINS performance counters, see WINS performance monitoring reference.


Monitoring Battery Status

The Battery Status performance object monitors activity on laptop batteries. The counters included in this object are:

  • ChargeRate. The rate of charge in milliwatts (mW). If the battery is not charging, the value of this counter is 0.
  • DischargeRate. The rate of discharge in mW. If the battery is not discharging, the value of this counter is 0.
  • RemainingCapacity. The amount of charge left in the battery in mW.
  • Tag. The number of times the battery was changed.
  • Voltage. The voltage of the battery in millivolts (mV).


Monitoring legacy programs

This topic describes how to monitor a 16-bit Windows-based program or an MS-DOS-based program.

In Windows XP, 16-bit Windows-based programs run as separate threads in a multithreaded process called Windows Virtual DOS Machine (NTVDM). The NTVDM process simulates a 16-bit Windows environment. An MS-DOS-based program runs in its own NTVDM process.

You can monitor a 16-bit program or an MS-DOS-based program running on your computer with System Monitor by monitoring the ntvdm instance of the Process performance object. Note that 16-bit programs running in an NTVDM appear only if they are started in a separate memory space.

If you find that your 16-bit programs are not performing well under Windows XP, you can access some of the program's properties by right-clicking the name of the program in Windows Explorer and configuring the properties as follows:

  • If the program is in a window and the display performance is slow, on the Screen tab, click Full-Screen.
  • If the program is in a window and seems to pause periodically, click the Misc tab, and set the Idle Sensitivity slider to Low.

It is possible to turn off Compatible Timer Hardware Emulation for the program if performance does not improve by changing the previously described settings. To do so, right-click _Default.pif or the program name, point to Program, and click Windows NT. In the dialog box that appears, clear the Compatible Timer Hardware Emulation check box. This change typically causes a decrease in performance and should be made only if other efforts fail.


Evaluating trends and planning for additional resources

The data that you accumulate through daily monitoring provides the information you need for trend analysis and capacity planning. Even if your computer is operating satisfactorily today, it is important to plan for changes in demand by new users or by new technologies and programs added later. Unanticipated network growth can result in overused resources and poor levels of network service. By characterizing system performance over time, you can justify the need for new resources before the need becomes critical.

Using the data collected from the counters described in Setting up a monitoring configuration, observe how the values for each component change over time. These changes can indicate a need to increase or upgrade components as described in Tuning and upgrade tips by component.


Administering Performance

This section covers:

  • Managing Performance from the command line


Managing performance from the command line

In addition to using the Performance snap-in, you can use the following command-line utilities:

  • Logman manages and schedules performance counter and event trace log collections on local and remote systems.
  • Perfmon opens a Windows XP Performance console configured with settings files from the Windows NT 4.0 version of Performance Monitor.
  • Relog extracts performance counters from performance counter logs into other formats, such as text file (tab delimited), text file (comma delimited), binary-BIN, and SQL.
  • Tracerpt processes event trace logs or real-time data from instrumented event trace providers. You can also use it to generate trace analysis reports and CSV (comma-delimited) files for the events generated.
  • Typeperf writes performance counter data to the command window or to a supported log file format.
  • Lodctr registers new Performance counter names and Explain text for a service or device driver. It also saves and restores counter settings and Explain text.
  • Unlodctr removes performance counter names and Explain text for a service or device driver from the system registry.

For more information about incorporating these performance commands into your Windows Management Instrumentation (WMI) scripts, see Scripting Logs and Monitoring at the Microsoft Windows Resource Kits Web site.(http://www.microsoft.com/)

For information about other command-line utilities, see Command-line reference. For more information about manageability, see Management and Administration.


Resources

  • For a more detailed discussion of performance data and its analysis, see the Microsoft Windows Resource Kits Web site.(http://www.microsoft.com/)
  • For information about optimizing programs or writing performance counters for programs, see the MSDN Library at the Microsoft Web site (http://msdn.microsoft.com/).
  • For information about including performance-monitoring functionality in Microsoft Office or Visual Basic applications, see Developing programs for performance monitoring.


Developing programs for performance monitoring

In addition to its wide variety of options that you can configure, System Monitor offers users the ability to extend monitoring capabilities programmatically. Because System Monitor is available as an ActiveX control (Sysmon.ocx in the systemroot\System32 folder) that supports Visual Basic Automation, developers can incorporate the System Monitor control's capabilities into their programs. The simplest way to take advantage of this extensibility is to embed the System Monitor control in a Microsoft Office application such as Microsoft Word. In this manner, you can include System Monitor graphs in reports and print them. For information about how to do this, see To insert the System Monitor control in a Microsoft Word document.

When you have placed the control in a program, you can access the properties, events, and methods by running the Visual Basic Editor from the container program or by running Visual Basic directly.

You can use or create custom performance monitoring tools using the System Monitor automation interface. For more information, see the Microsoft Platform Software Development Kit (SDK), available separately.


Troubleshooting

What problem are you having?

Counter values consistently equal zero.

Cause: The process being monitored has stopped, and there is no data for the process in the performance tools.

Solution: If you stopped the process manually, restart it to see the process in System Monitor. Otherwise, check Event Viewer for concurrent entries. You might find an error associated with this process.

Cause: The counter DLL was disabled after you selected the corresponding counters in a log or display. The performance tools will not detect that the counter was removed or disabled but will report the counter data as zeroes.

Solution: Enable the corresponding counter DLL.

Cause: You lack permissions on the computer being monitored. If you don't have appropriate permissions to monitor the computer, an error message will be displayed when you attempt to select the counter, but the counter will still appear in the histogram or graph legend without any data or any graph line.

Solution: An administrator must ensure that your user account has permissions to use the performance tools.

System Monitor shows gaps in its line graphs.

Cause: This could be because data collection was subordinated to higher priority processing activity on a system with a heavy load. When the system has adequate resources to continue with data collection, the graphing will resume as usual. A message appears describing this.

Solution: Reduce the performance overhead of system monitoring.

See also: Best practices

Values recorded in a log do not appear in the graph view.

Cause: The graph is limited to 100 samples.

Solution: Reduce the selected time range.

See also: To use logged data

Objects, counters, or instances are missing or invalid.

Cause: Test routines that run when you start Performance have detected a problem with installed counters and have disabled the counters to prevent the counters from slowing the system. Disabled objects and counters do not appear in the Add Counters dialog box.

Solution #1: You can enable the disabled counters. Using Registry Editor, change the value under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Service_name\Performance\Disable Performance Counters from 1 for disable to 0 for enable. Note that counters that have been disabled after initial testing are likely to contain errors and may cause system problems. For information about debugging problems with counter DLLs, see the Microsoft Web site (http://msdn.microsoft.com/).

Solution #2: You can turn off the counter DLL automatic testing feature or adjust the level of testing. Using Registry Editor, locate the Configuration Flags subkey under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Perflib and change the value of the REG_DWORD entry for this subkey:

REG_DWORD Value | Performance Counter DLL Test Level
0x00 | Test for buffer alignment errors and report any critical error detected.
0x01 | Do not test for data buffer alignment errors.
0x02 Do not disable DLLs when errors are detected.

Note

  • Windows will still write messages to the Event Log if this option is used.
0x04 | Disable all performance counter function testing.
0x08 Enable the disabling of performance objects if they exceed a time-out value.

Note

  • Normally Windows will merely write a message to the Event Log.
0x10 | Enable the collection of performance and error statistics for each performance object. This is the default setting.

Caution

  • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.

Cause: The process that starts the object counters is not started or installed.

Solution: Use Task Manager to verify that the process is running. If so, use Exctrlst.exe on the Microsoft Windows Resource Kit companion CD to verify that the counter DLL is enabled.

Cause: The counters have not been enabled.

Solution: Make sure that the service or feature that provides the counter has been installed or configured.

Cause: The DLL that installs the counters is generating errors. An example is if the counter does not handle localization functions correctly.

Solution: Check Event Viewer to determine whether the counter DLL or the Performance Data Helper reported any errors.

Cause: You are trying to monitor a 16-bit or MS-DOS application. Only 32-bit processes appear in the instances list. Active 16-bit processes appear as threads running in a Windows Virtual DOS Machine (NTVDM) process.

Solution: Monitor the application via the NTVDM process.

See also: Monitoring legacy programs

Cause: The instance you want to monitor is not currently active. If you are configuring System Monitor to collect real-time data, you can select only active instances for data collection. (If you are viewing logged data, you can select inactive instances for which the log contains data.) If you select the process and it stops after you have selected it, it will continue to appear in the list box but the reported data will be zeroes.

Solution: Make sure the instance is active.

There are sometimes extremely high values for one instance and not the other when you are monitoring processes of the same name.

Cause: The performance tools sometimes misrepresent data for separate instances of processes with the same name by reporting the combined values of the instances as the value of a single instance.

Solution: Use the instance index and track the Process\ID Process and Process\Creating Process ID counters.

When monitoring several threads, if one thread stops, its data appears to be reported for another.

Cause: This is because of the way threads are numbered. For example, assume you are monitoring three threads, numbered 0, 1, and 2. If thread 0 stops, the remaining threads get renumbered. The original thread 0 is now gone and the original thread 1 is renamed to 0. As a result data for the stopped thread 0 could be reported along with data for the running thread 1 because old thread 1 is now old thread 0.

Solution: Use the instance index with Thread ID to track these threads.

An error message is displayed if you try to export log data to Microsoft Excel while the Performance Logs and Alerts service is actively collecting data to that log.

Cause: Microsoft Excel requires exclusive access to the log file. Other programs are not known to require this exclusive access; therefore, in general, you can work with data from a log file while the service is collecting data to that file.

Solution: Stop the Performance Logs and Alerts service before trying to use it with Microsoft Excel.

You lost your connection to a remote computer from which you were logging data and you cannot resume logging.

Cause: Logging data from a remote computer requires the use of Remote Registry Service. If the service stops due to failure, by default the system restarts it automatically only once.

Solution: If Remote Registry Service stops more than once, you must restart the service manually on the second and any subsequent failures. To change this default behavior, use Computer Management or Services (on the Administrative Tools menu) to modify the properties for Remote Registry Service.

Help for System Monitor does not appear when you click Help; only Performance Logs and Alerts is displayed.

Cause: Because System Monitor is designed as an ActiveX control, its behavior differs from other programs. For example, System Monitor Help is not available when you right-click System Monitor and then click Help on the shortcut menu.

Solution: Click the Help button on the System Monitor toolbar.

You cannot log performance counters from a remote computer.

Cause: You might not have permission to view the counters on the remote computer.

Solution: Ask the administrator of the remote computer to give you read access to that computer.

Cause: You might not have the correct privileges granted through Group Policy.

Solution: Ask the administrator of the remote machine to grant you access through the following User Rights policies: Profile System Performance and Profile a Single Process. For more information on Group Policy, see Group Policy.

Cause: The Performance Logs and Alerts service might not have permission to log on to the remote computer or to create and update the log file.

Solution: Use the Run As text box and Password button to specify the logon account name with the necessary permissions for the performance logs and alerts service. You can access these features from the General tab.

Cause: The Remote Registry service is not running on the remote machine.

Solution: On the remote computer, start the Remote Registry service.

  1. Open Computer Management.
  2. In the console tree, click Services.

    Where?

    • Services and Applications
    • Services
  3. In the details pane, click Remote Registry Service
  4. On the Action menu, click Start.

Cause: The log file size limit may not be large enough to collect your requested data.

Solution: Increase the limit of the log file size or set the file size to the maximum limit allowed. For more information, see To set file parameters for a log.

Cause: The log update interval may be too short to allow the server to respond to each periodic data request.

Solution: Increase the log's update interval. For more information, see To view or change properties of a log or alert.

Your counters no longer work after you installed a new application, and you would like to restore the old counter settings.

Cause: Whenever you install a new application that installs performance counters on the operating system, Windows creates a backup copy of the performance counter registry entries taken prior to the addition of the application's performance counters file. This backup is saved as a file named PerfStringBackup.INI. If Windows successfully adds the application's performance counters file, it then replaces the previous version of the PerfStringBackup.INI file with the file that it just created.

Solution: Restore the performance counter registry to the state described in the uncorrupted backup file by using the following command:

LODCTR /R:filename

where filename is name of the backup performance counter registry entry file.

Note

  • To make a backup copy at any time of the performance counter registry settings, use the following command:

    LODCTR /S:filename

    where filename is any name. You can save these backup files anywhere on your computer.


Work with data

  • Copy data between windows
  • Print performance data
  • Save graph data as an HTML page
  • Insert the System Monitor control in a Microsoft Word document
  • Save data to a log file
  • Collect performance data by using WMI


Choosing which counters to use

The following topics can help you determine which counters you should select to monitor the usage of a specific resource or the activity of a particular service and to investigate related problems.

  • Finding memory bottlenecks
  • Finding disk bottlenecks
  • Finding processor bottlenecks
  • Finding network bottlenecks
  • Finding printer bottlenecks


Work with settings

  • Save a monitoring console
  • Create a custom monitoring console
  • Use Windows NT 4.0 version of Performance Monitor settings files


Finding memory bottlenecks

Use the following counters to identify bottlenecked memory resources:
  • Memory\Available Bytes
  • Memory\Pages/sec

See Analyzing performance for counter threshold values that should not be exceeded, and see Solving performance problems for tuning techniques that might alleviate performance problems.


Finding processor bottlenecks

Use the following counters to identify bottlenecked processor resources:

  • Processor\ Interrupts/sec
  • Processor\ % Processor Time
  • Process(process)\ % Processor Time
  • System\ Processor Queue Length

See Analyzing performance for counter threshold values that should not be exceeded, and see Solving performance problems for tuning techniques that might alleviate performance problems.


Finding disk bottlenecks

Use the following counters to identify bottlenecked disk resources:

  • PhysicalDisk\ % Disk Time and % Idle Time
  • PhysicalDisk\ Disk Reads/sec and Disk Writes/sec
  • PhysicalDisk\ Avg. Disk Queue Length
  • LogicalDisk\ % Free Space

Monitor memory counters to determine whether excessive paging is putting a strain on the disk.

See Analyzing performance for counter threshold values that should not be exceeded, and see Solving performance problems for tuning techniques that may alleviate performance problems.


Finding network bottlenecks

Use the following counters to identify bottlenecked network resources:

  • Network Interface\ Bytes Total/sec, Bytes Sent/sec, and Bytes Received/sec
  • Protocol_layer_object\ Segments Received/sec, Segments Sent/sec, Frames Sent/sec, and Frames Received/sec

    • For NWLink performance objects, frame-related counters report only zeroes. Use datagram-based counters for these objects.

  • Server\ Bytes Total/sec, Bytes Received/sec, and Bytes Sent/sec

See Analyzing performance for counter threshold values that should not be exceeded, and see Solving performance problems for tuning techniques that might alleviate performance problems.


Finding printer bottlenecks

Use the following counters to identify bottlenecked printer resources:

  • Print Queue\ Bytes Printed/sec
  • Print Queue\ Job Errors

Low values for Bytes Printed/sec can indicate a printer throughput problem. Note that this value varies based on the type of printer. Consult your printer documentation for acceptable values for printer throughput.

Job errors are typically caused by improper port configuration. Check your port configuration for invalid settings.


Configure memory-related settings on your computer

Microsoft Windows graphic

To configure memory-related settings on your computer

  1. Open Network Connections.
  2. Right-click Local Area Connection and click Properties.
  3. In Components checked are used by this connection, double-click File and Printer Sharing for Microsoft Networks.
  4. Under Optimization, notice that Maximize data throughput for file is selected by default. To turn this option off and reduce paging activity, click Maximize data throughput for network.

Note

  • XOX


Determine the amount of RAM on your computer

Microsoft Windows graphic

To determine the amount of RAM on your computer

  1. Open My Computer and click Properties.
  2. On the General tab, the amount of memory in kilobytes (KB) appears beneath the Computer information.

Note

  • XOX