Understanding System Monitor

Following are the four major pieces to the Performance tool:

• System Monitor

• Counter Logs

• Trace Logs

• Alerts

Each of these provides a different, but complementary, function in system monitoring.

System Monitor

Arguably the most utilized function of the four is System Monitor. This is the graphical representation of the counters that have been selected for monitoring. Counters are views into the core of the operating system that have been exposed to you as the system administrator for tracking. When a server such as Microsoft SQL Server or Office SharePoint Server 2007 is installed, new counters are installed that are specific to the server platform and that have been designed to provide performance information about that specific platform. A good example is with SQL Server. After installation, objects called SQLServer:Locks with various counters are added. Monitoring these counters will tell you if two or more SQL jobs are creating a lock on your SharePoint Server 2007 database and causing you to be unable to serve pages.

Figure 13-1 gives us a common view of System Monitor, illustrating operating system counters for Windows Server 2003.

Figure 13-1: Windows System Monitor

Counter Logs

The next important function (and perhaps the most valuable) of the Performance tool is Counter Logs. With Counter Logs, you can create log files based on any counter in the Performance tool. This is extremely helpful when tracking issues over periods of time and outside normal business hours. Using this function of the Performance tool is the best way to establish the baseline the performance of a system. With Counter Logs, counters can be configured to record with a default interval (how often a snapshot of the value is taken) and to monitor for a specified period of time.

Another important component is how these logs can be recorded. The default format is a binary file, which is a good compact format that can be read by anyone with the Performance tool. Other ways to record these logs include using a text file (either tab-delimited or comma-delimited), binary circular file (which allows for setting a size limit so that the oldest point is deleted when the maximum size is reached), or SQL database. SQL data is the superior file type for long-term monitoring because it allows you to keep the data in a very compact format and allows for complex queries on your performance data. Figure 13-2 shows the Properties configuration screen for the default System Overview counter log in the Performance tool.

Figure 13-2: Counter Logs

Trace Logs

Trace Logs are a way to gather detailed data when certain system events occur. Instead of being used to record the measurements of specific counters as Counter Logs are used for, Trace Logs are used to record memory and resource events. Trace Logs are not readable by typical programs such as Notepad or Microsoft Office Excel, but rather require parsing tools that are used by developers, using the Trace Log application programming interface (API) from MSDN.

More Info 

More information on the Trace Log application programming interface can be found at http://msdn.microsoft.com/library/default.asp?url=/library/en-us/DevTest_g/hh/DevTest_g/trace.xml.asp.

Alerts

The last function of the Performance tool is Alerts. Alerts allow administrators to create a set of conditions with any available counter. (See Figure 13-3.) When this condition is met, such as % Processor Time > 95, an action occurs. The following actions are available by default in the Performance tool:

• Log an entry in the application log

• Send a network message

• Begin a Counter Log

• Execute a specific program

Figure 13-3: Example of Alert actions

More Info 

For more information on how to configure alerts using the Performance tool, see Knowledge Base article KB324752 found at http://support.microsoft.com/default.aspx/kb/324752.

The Performance tool allows you the flexibility of any combination of these actions, based on the list of counters. Alerts can also be scheduled. For example, you can turn off the alert for Physical Disk Queue length during the time at which a SQL Log Shipping transaction is running because high amounts of I/O will be generated for legitimate reasons. With SharePoint Server 2007, use the Office Server Search Search Gatherer\Documents Delayed Retry counter to alert you when a non-zero value occurs. This condition indicates a server is unavailable during crawling.