Lab 1.1 Use Task Manager to Monitor a Server

Objectives

* Monitor a server using Task Manager

* Determine which applications, processes, and services are running

* Determine the CPU and memory resources used by a server

* Monitor network utilization at a NIC

* Monitor users on a network

Estimated completion time: 20 minutes

Activity Background

Task Manager is a useful monitoring tool for getting a quick picture of a server. The more you use Task Manager, the more you will get from using it. For instance, you’ll start to know at a glance what is normal for a particular

server what is not normal. Such expertise will help you determine, for example, which services should be

running the typical performance CPU

The Task Manager tabs for monitoring information

• Applications—displays currently running applications—lists running processes, as explorer.exe (Windows Explorer) exe (for DNS

Server)

* Services—lists services and their status, running, stopped, or paused

* Performance—displays real-time CPU and memory performance at a glance

* Networking—shows real-time network performance in terms of network utilization at all server NICs

* User—lists users connected to the server and provides tools to log off or disconnect users, as well as to send users a message

Two advantages of Task Manager are that you can start it quickly and it typically requires fewer server re-sources than many other monitoring tools. You might think of it as the Swiss Army knife of your monitoring tools because it has a little bit of everything and it is easy to keep handy.

In this activity, you use the features in Task Manager to monitor activity on a server.

For all the activities in this chapter, you’ll need to log on to an account with Administrator privileges. Addi-tionally, most of these activities can be completed on a virtual server or computer, such as in Hyper-V.

Throughout the activities in this book, you may occasionally see the User Account Control box with a message that Windows needs your permission to continue. Whenever you see this box, click Continue. Keep this in mind for all the activities because any interaction with the User Account Control box is not included in the steps.

Activity

1. Right-click the taskbar in a blank area and click Task Manager.

2. Click the Applications tab, if it is not displayed.

3. Start the Notepad application by clicking Start, pointing to All Programs, clicking Accessories, and clicking Notepad.

4. In Task Manager, click Untitled – Notepad and click End Task to terminate this program (which you might do for a hung program, for example). 5. Click the Processes tab in Task Manager.

6. Adjust the columns, if necessary, so that you can view the User Name of the user running the process, the CPU utilization for the process, and the Memory used. To adjust the width of a column, move the pointer over the column’s boundary line until you see a crosshair and then drag the boundary line.

7. Use the scroll bar to view the CPU utilization and memory used for each process and determine which pro-cess is currently using the most CPU resources and which is using the most memory.

8. Assume for a moment that you want to verify the location of an executable file used by a process, such as the explorer.exe process that runs Windows Explorer. You might verify the location as one way to be sure the version of Windows Explorer is the same version that came with Windows and is not a malware version running from an unauthorized location. Right-click explorer.exe and click Open File Location.

9. Minimize Task Manager, if necessary, to view the window showing the file location, which should be in the Windows folder. Close the file location window.

10. Maximize Task Manager, if needed.

11. In Task Manager, right-click another process and notice whether the menu has a Set Affinity option. The Set Affinity option is available on a multiple processor server. If you have this option, click it and note that you can select on which CPU (or on multiple CPUs) to run the process (see Figure 14-1). Click Cancel in the Processor Affinity dialog box.

Lab 14.1 Use Task Manager to Monitor a Server | 189 |

14

Figure 14-1 Processor Affinity dialog box

12. Click the Services tab.

13. Use the scroll bar to survey which services are running.

14. Right-click a service and note there are options to Stop Service, Start Service, and to Go to Process to determine which process is used by a service. Move the pointer away from the menu and click to close the menu.

190 Chapter 14 Server and Network Monitoring

15. Click the Services button to open the Services console from which to manage a service. Close the Services console.

16. Click the Performance tab in Task Manager.

17. Spend a few minutes monitoring the CPU and memory graphs. On many servers, the CPU Usage will peri-odically go up to 100%. This can be normal and often shows that processes are effectively using the CPU resources. However, if the CPU Usage always stays at 90–100%, this can be an indication that the server needs more CPU resources, such as another CPU. It can also mean that the server is running one or more inefficient programs. During these times, you can go back to the Processes tab to see exactly what processes are running to try to track down an inefficient program.

18. Click the Networking tab. Monitor the network activity shown in the network graph or graphs (depending on how many NICs are active in the server) for a few minutes. Note the bottom portion of the tab lists the network adaptors and the network utilization, link speed, and state of each adaptor. If you think an adapter is experiencing a problem, is overloaded, or is disconnected, you can get quick information on this tab.

19. Click the Users tab. This tab lists the users connected to the computer. When you highlight a particular user, you can click the Disconnect or Logoff buttons to release that user’s connection. You can also send a message to a user.

20. In this step you practice logging off your account. Before you log off your account, close any active programs and save any work, if necessary. Right-click your account. Note that there are options to Send a Message, Connect, Disconnect, Log Off, and for Remote Control of an account (options that do not apply to your account because you are the active account are deactivated). Click Log Off (see Figure 14-2).

Figure 14-2 Log off your account

21. In the Windows Task Manager box, click Log off user to confirm you want to proceed. Note that your account is logged off.

22. Log back on.

Lab 14.2 Use Resource Monitor | 191 |

Lab 1.2 Use Resource Monitor

Objectives

* Employ Resource Monitor to monitor the use of server resources

* Examine resource use graphs and statistics

Estimated completion time: 15 minutes

14

Activity Background

Resource Monitor offers a more in-depth picture of resource use than is available through Task Manager. Resource Monitor provides immediate resource data about a server’s processors, disks, network activity, and memory. An important advantage of Resource Monitor is that data is presented both in graphs and statistics. If you need to view which process or program is using more resources, Resource Monitor presents the information from highest to lowest use.

You can start Resource Monitor from Reliability and Performance Monitor, the Task Manager Performance tab, Server Manager, and the Computer Management tool. Resource Monitor is simple to use and is a fast source of resource information.

In this activity, you explore the information available in Resource Monitor.

Activity

1. Click Start, point to Administrative Tools, and click Performance Monitor. (You can also open Reliability and Performance monitor as an MMC snap-in).

2. Ensure that Performance is selected in the tree in the left pane (see Figure 14-3).

3. Note there are four graphs: CPU, Disk, Network, and Memory. Each graph shows the real-time activity for the resource it is measuring. Click the CPU down arrow.

192 Chapter 14 Server and Network Monitoring

Resource Monitor

4. The display under CPU shows current resource activity for the CPU or CPUs in the server (see Figure 14-4). Note which process is using the largest percentage of CPU resources. Additionally, note which processes are in second and third place.

5. Close CPU information by clicking its up arrow.

6. Click the Disk down arrow.

7. Note which processes are creating the most disk activity. Compare the read to the write activity for each process.

8. Close the Disk activity information by clicking its up arrow.

9. Click the Network down arrow.

10. Note which processes are creating network activity as shown in terms of send, receive, and total transmis-sion activity. The address column provides information about whether the activity is initiated from the server or from an external network source, such as a network device or computer.

11. Close the display of Network activity statistics.

12. Click the Memory down arrow.

13. Note which processes are using the most memory, as ranked from first to last in the statistics display. The columns of memory-related statistics for a specific process include:

* Commit (KB)—amount of virtual memory (from the paging file) that is allocated to the process

* Working Set (KB)—total amount of RAM currently in use by the process

* Shareable (KB)—amount of shared memory (RAM and virtual memory that can be shared with other processes) that is allocated for use by the process

* Private (KB)—amount of nonshareable memory (RAM and virtual memory that cannot be shared with other processes) that is allocated for use by the process

14. Leave the Reliability and Performance Monitor window open for the next activity.

Lab 14.2 Use Resource Monitor | 193 |

Figure CPU statistics

Lab 1.3 Use Performance Monitor to Evaluate Paging File and Memory Performance

Objectives

* Use paging file and memory counters in Performance Monitor

* Understand how to monitor memory and paging file activities to diagnose performance bottlenecks and address them

Estimated completion time: 20 minutes

Activity Background

Performance Monitor enables you to monitor a wide range of activities on a server. One very important applica-tion of this tool is to monitor paging file and memory use. In combination, these two elements play a significant role in the performance of a server.

Performance Monitor offers several objects and counters that you can use for monitoring paging file and memory performance.

An example of a situation resulting in a page fault is when two processes share the same block of paged data. One process may read the block from disk into memory, just before the other process is about to do the same. The second process is unable to access the paged block, because the paged block is in use. Page faults also occur when there is not enough RAM to be shared by virtual memory and caching.

All the page fault problems discussed thus far can be monitored by using Memory as the object and Page Faults/sec as the counter. In addition, increasing RAM reduces page faults and improves performance. Memory performance is especially important if database systems such as Microsoft SQL Server or Oracle are installed; these database systems are designed to share memory blocks when there is limited RAM.

Table 14-1 provides a summary of tips for monitoring and tuning memory and paging.

For this activity, you monitor a server to evaluate paging and memory performance. You use five counters, Memory: Page Faults/sec, Memory: Pages Input/sec, Memory: Pages Output/sec, Paging File: % Usage, and Paging File: % Usage Peak.

Activity

1. Open Performance Monitor, if it is not still open.

2. Click Performance Monitor under Monitoring Tools in the tree in the left pane.

3. If there are any counters currently running, as listed at the bottom of the right pane, click them one at a time and click the Delete button (the X) in the button bar in the top of the right pane to delete each one.

4. Click the Add button (a green plus sign) in the button bar in the right pane.

Table 14-1 Using Memory and Paging File Objects for Monitoring Performance

Object: Counter | Explanation | | | Memory: Cache Faults/sec | Measures the number of times the paging file is called from disk or relocated in | | memory. Higher values indicate potential performance problems. (Higher values | | will be about double or more that of baseline values on a lightly loaded system.) | | You can remedy this by adding more memory or use a processor with more cache. | | | Memory: Page Faults/sec | Returns a count of the average number of page faults per second for the current | | processor. Page faults occur whenever memory pages must be called from disk; the | | presence of page faults explains how memory overload can manifest as excessive | | disk activity. If the value is frequently over 5 or more, consider adding more RAM. | | | Memory: Pages Input/sec | These counters measure the number of virtual memory pages read into (Input/sec) | Memory: Pages Output/sec | and out of (Output/sec) memory per second. If their total is frequently over 20, | | this shows a need to add RAM. By using both counters you can assess demands | | on memory and paging at once. Pages Input/sec translates into page faults. Pages | | Output/sec shows demand on memory and when this value is frequently over | | 15–20, you need to add RAM. | | | Memory: Pages/sec | Tracks the number of pages written to or read from disk plus paging traffic for the | | system cache. If this value is typically over 20, you need additional RAM. | | | Paging File: % Usage | Both show how much of the paging file is currently occupied. Neither object/ | Paging File: % Usage Peak | counter should frequently exceed 99%. Look at this information in relation to the | | Memory counters: Pages Input/sec, Pages Output/sec, and Available Bytes. If the | | values are frequently over 99%, increase the paging file size. | | | Server: Pool Paged Peak | Shows the most that the server has used in terms of virtual memory. This should be | | at least 1.5 times the size of RAM in the server. | | |

Lab 14.3 Use Performance Monitor to Evaluate Paging File and Memory Performance | 195 |

5. In the Add Counters dialog ensure that <Local computer> is selected in the text box for Select

from computer

6. Scroll the box under the computer that is selected and click the + plus sign for Memory to view the counters for the Memory object.

7. | Click Page Faults/sec under Memory and click the Add >> button. | 14 | | 8. | Click Pages Input/sec and click the Add >> button. | | | | | | | 9. | Click Pages Output/sec and click the Add >> button. | | | 10. | Scroll to find the Paging File object and click the + plus sign to the right. | | | 11. Click % Usage under Paging File and click the Add >> button. | | | 12. Click % Usage Peak and click the Add >> button. The Add Counters dialog box should now look similar | | | | to Figure 14-5. | | | 13. Click OK in the Add Counters dialog box. You’ll see the counters you selected listed in the bottom of the | | | | right pane. You may have to scroll to view all the counters. Each counter is identified by a different color so | | | | that it can be distinguished in the graph as Performance Monitor continues to run (see Figure 14-6). | | | 14. | At the bottom of the right pane, click Page Faults/sec to highlight it (but do not click the check box). Note the | | | | statistics under the graph for Page Faults/sec, which include Last, Average, Maximum, Minimum, and Duration. | | | 15. Click Pages Input/sec at the bottom of the right pane and note its statistics. | | | 16. | Click each of Pages Output/sec, % Usage, and % Usage Peak to view statistics for each of these counters. | | | 17. | While you are monitoring, open and then close four or five programs or open and then close several items | | | | on the Administrative tools menu. Continue monitoring for several minutes. | | | 18. | When you are finished monitoring click each of the counters at the bottom of the page one at a time and | | | | click the Delete button to delete the counter. | | | 19. | Leave the Reliability and Performance Monitor window open for the next activity. | | |

| |

Lab 1.4 Use Performance Monitor to Evaluate Disk Performance

| | | | | Estimated completion time: | 20 minutes | | | | | | | | |

Activity Background

The amount of activity on specific hard disks can be related to server performance problems. For example, if you have multiple disks and one of the disks holds a majority of the server’s most frequently accessed large files, that disk can be a bottleneck. The solution is to redistribute the frequently accessed large files across the disks.

The two primary disk objects used by Performance Monitor are LogicalDisk and PhysicalDisk. Use LogicalDisk to observe activity on a set of disks, such as a striped volume. Use PhysicalDisk if you want to monitor a specific disk, such as disk 0 in a set of five disks. Watch at least two counters, % Disk Time and Current Disk Queue Length. The first counter shows the amount of activity on a disk and the second shows the number of waiting requests to access the disk. If one disk frequently is busy at the 100% level, information on the number of waiting requests helps to diagnose the problem. If there are 0 to 1 requests normally in the queue, the disk load is acceptable. If the queue generally has 2 or more requests, it is time to move some files from the overloaded disk to one less busy.

The best way to determine which files to move is to understand what applications and data are on the server and how they are used. If all the server disks are constantly busy, it may be necessary to purchase disks with more spindles or to add additional data paths.

If you have configured RAID-5 volumes, a bottleneck may be linked to more active disk writing than you initially estimated. RAID-5 disks are able to read data faster than they can write it because they must take time to calculate and write parity and fault tolerance data with each write operation. You can compare read to write activity by using the following Performance Monitor measures:

* For read activity, monitor the LogicalDisk and PhysicalDisk counters Avg. Disk Bytes/Read and Avg. Disk sec/Read.

* For write activity, monitor the LogicalDisk and PhysicalDisk counters Avg. Disk Bytes/Write and Avg. Disk sec/Write.

The Avg. Disk Bytes/Read or Write counter measures the average number of bytes transferred to or from the disk per each read or write activity. The Avg. Disk sec/Read or Write counter shows the average number of seconds it takes to perform the disk read or write activity. If the disk write activity is much more frequent than read activity and the users report delays in their work, consider using disk mirroring or duplexing instead of stripe sets with parity or RAID-5 volumes. Table 14-2 shows how to use several important objects and counters for disk monitoring.

Table 14-2 Using Objects and Counters to Monitor Disk Performance

Object: Counter | Explanation | | | | | | LogicalDisk: % Disk Time | Measures the percentage of time that a disk is busy with Read or Write requests. If | | this level is sustained at 80% or greater, redistribute files to spread the load across | | multiple logical drives. Also check the corresponding PhysicalDisk counter. | | | LogicalDisk: Avg. Disk Bytes | Used together, these provide a way to compare disk read to disk write activity, as | Read | a way to determine if you need to modify a currently established fault tolerance | LogicalDisk: Avg. Disk Bytes | method or add disk spindles. | | | Write | | | | | | | LogicalDisk: Avg. Disk Bytes/ | Measures the average number of bytes transferred between memory and disk | Transfer | during Read and Write operations. If the value is at or near 4 KB, this might mean | | | activity on that drive | indicates | | | smaller one, so | | . | | | LogicalDisk: Avg. Disk Queue | These objects/counters indicate how many system requests are waiting for | | disk access | queue length is greater than | for any | drive, consider | LogicalDisk: Current | redistributing | load across multiple logical | or, this | not possible, | Queue Length | upgrade the disk subsystem. Also check the corresponding PhysicalDisk counters. | | Monitor these counters with Avg. Disk Read Queue Length and Avg. Disk Write | | Queue Length for more detailed statistics. | | | | | PhysicalDisk: Avg. Disk Queue | These objects/counters track activity per hard disk, but provide much of the same | Length | kind of information that the logical disk counters do. However, the problem | PhysicalDisk: Current Disk | threshold for physical disks is different than for logical ones. For physical disks, | Queue Length | the threshold is between 1.5 and 2 times the number of spindles on the hard drive. | | For ordinary drives, this is the same as for logical disks. However, for RAID arrays, | | the number is equal to 1.5 to 2 times the number of drives in the array. Monitor | | these counters with Avg. Disk Read Queue Length and Avg. Disk Write Queue | | Length for more detailed statistics. | | | | | PhysicalDisk: % Disk Time | Measures the percentage of time that a hard drive is kept busy handling Read or | | Write requests. The sustained average should not exceed 90%, but even if sustained | | averages are high, this value is not worrisome unless the corresponding queue | | length numbers are in the danger zone as well. | | | | | PhysicalDisk: Avg. Disk Bytes | Used together, these provide a way to compare disk read to disk write activity, as | Read | a way to determine if you need to modify a currently established fault tolerance | PhysicalDisk: Avg. Disk Bytes | method or add disk spindles. | | | Write | | | | | | | PhysicalDisk: Avg. Disk Bytes/ | Measures the average number of bytes transferred by Read or Write requests | Transfer | between the drive and memory. Here, smaller values are more worrisome than | | larger ones because they can indicate inefficient use of drives and drive space. If | | a small value is caused by inefficient applications, try increasing file sizes. If it is | | caused by paging activity, an increase in RAM is a good idea. | | | | PhysicalDisk: Disk Bytes/sec | Tracks the number of bytes read from and written to disk each second. Use this | | object/counter combination to study the transfer rate of a disk to determine if you | | need to purchase a faster disk drive. | | | | | | | |

Lab 14.4 Use Performance Monitor to Evaluate Disk Performance | 199 |

In this activity, you use the following disk counters to monitor disk performance: LogicalDisk: % Disk Time, PhysicalDisk: % Disk Time, LogicalDisk: Current Disk Queue Length, PhysicalDisk: Current Disk Queue Length, LogicalDisk: Disk Bytes/sec, and PhysicalDisk: Disk Bytes/sec.

Activity

1. Open Reliability and Performance Monitor, if necessary.

2. Delete any counters that are still running.

3. Click the Add button (green plus sign) in the button bar to open the Add Counters dialog box.

4. In the Add Counters dialog box, click the + plus sign for LogicalDisk to view its counters.

5. Click % Disk Time.

6. Hold down the Ctrl key and click Current Disk Queue Length and Disk Bytes/sec.

7. Leave _Total selected under Instances of selected object.

8. Click Add >>.

9. Scroll to and click the + plus sign for PhysicalDisk.

10. Click % Disk Time.

11. Hold down the Ctrl key and click Current Disk Queue Length, and Disk Bytes/sec.

12. Ensure that _Total is selected under Instances of selected object.

13. Click Add >>. Your selections should look similar to Figure 14-7.

14

Figure 14-7 Add Counters dialog box

200 Chapter 14 Server and Network Monitoring

14. Click OK in the Add Counters dialog box.

15. Open and close four or five programs or selections from the Administrative Tools menu to see how your server responds (see Figure 14-8).

Figure 14-8 Monitoring disk activity

16. For practice, click the down arrow for the Change graph type button on the button bar in the right pane and click Histogram bar.

17. Monitor the disk activity for a few minutes and then delete all the counters you have started.

18. Close Reliability and Performance Monitor.