Lesson 2: Monitoring Windows XP Performance | MCDST Self-Paced Training Exam 70-271(c) Supporting Users and Troubleshooting a Micro[... ]ystem

In addition to configuring Windows XP for optimal performance, you can also use two tools to monitor performance and troubleshoot performance problems. Task Manager provides a real-time view of certain performance measures, such as the current load on a processor and current memory usage. The Performance tool is a more sophisticated performance-monitoring utility that captures many different types of performance data and allows you to display that data as a graph or save it to a log.

After this lesson, you will be able to

Use Task Manager to view real-time performance data.
Use the Performance tool to capture and view performance data.

Estimated lesson time: 30 minutes

Monitoring Performance by Using Task Manager

Task Manager provides information about applications and processes that are currently running on a computer, and also provides real-time performance information about the processor, memory, and network usage. You can start Task Manager in the following ways:

Right-click any open area on the Windows taskbar and select Task Manager.
Press Ctrl+Alt+Delete.
Press Ctrl+Shift+Escape.

The two tabs in the Task Manager window that measure performance are the Performance tab and the Networking tab.

Monitoring Processor and Memory Performance

The Performance tab, shown in Figure 12-5, has four gauges that indicate various aspects of system performance:

CPU Usage Indicates the percentage of processor cycles that are not idle at the moment. If this graph displays a high percentage continuously (and not when there is an obvious reason, such as a big application), your processor may be overloaded. If your computer has two processors, two graphs are shown. If this value runs continuously over 80%, you might need to upgrade your processor.
PF Usage Indicates the percentage of the paging file that is currently being used. If this value runs near 100% continuously, you might need to increase the size of the paging file or decide whether you need more memory.
CPU Usage History Indicates how busy the processor has been recently, although the gauge only shows values after Task Manager was opened. You can use the Update Speed command on the View menu to specify how often the values are refreshed. The High value updates about twice per second; Normal value updates once every two seconds; Low value updates once every four seconds. You can also pause the updates and update the view manually by pressing F5. This is a useful method if you want to monitor some specific activity.

Page File Usage History Indicates how full the page file has been over time, although it also shows values only after Task Manager was opened. Values that are set using the Update Speed command affect this history as well.

click to expand
Figure 12-5: The Performance tab of Task Manager shows real-time processor and memory usage.

Exam Tip

If the sustained processor usage exceeds 80 percent, the processor is probably a performance bottleneck on the computer. If the page file usage value runs near 100 percent continuously, you might need to increase the size of the page file or add more memory to the computer.

In addition to displaying these four graphs, the Performance tab also displays the following sections:

Totals Provides totals for the number of processes, threads, and handles that are currently running. A process is a single executable program. A thread is an object within a process that runs program instructions. A handle represents a specific input/output (I/O) instance. A process may have multiple threads, each of which in turn may have multiple handles.
Physical Memory (K) Indicates the total and available physical memory, and the amount of memory in the system cache.
Commit Charge (K) Indicates the memory that is currently committed to running processes.
Kernel Memory (K) Indicates the memory that is used by the operating system. Paged kernel memory is available only to system processes. Nonpaged kernel memory can be used by applications when necessary.

Monitoring Network Activity

The Networking tab in Task Manager, shown in Figure 12-6, indicates the current network traffic on various network connections on the computer. You can use this information to quickly determine if the network is causing a bottleneck that would result in performance problems for applications that require network connectivity. The detailed information at the bottom of the tab displays current network utilization and link speed for each enabled adapter.

click to expand
Figure 12-6: The Networking tab of Task Manager shows current network activity.

Monitoring Performance by Using the Performance Tool

When troubleshooting performance issues, you may need more detail than Task Manager provides. If so, you can use the Performance tool to collect vast amounts of performance information. In addition to providing access to more detailed information, the Performance tool allows you to monitor other systems remotely, log information for future analysis, and configure alerts to notify you of potential error conditions.

The Performance tool classifies information in the following areas:

Object An object represents a major system component (hardware or software) of the computer or operating system. Examples of objects include physical disks, processor, and memory.
Instance Each occurrence of an object is considered an instance. For example, if there are two processors on a computer, there are two processor instances. If there are three hard disks on a computer, each disk is represented by a separate instance.
Counter A counter is a particular aspect of an object that the Performance tool can measure. For example, the physical disk object contains the following counters:
- Percentage Disk Read Time
- Average Disk Bytes Per Read
- Disk Reads Per Second

To start the Performance tool, follow these steps:

From the Start menu, select Control Panel.
In Control Panel, select Performance And Maintenance.
In the Performance And Maintenance window, select Administrative Tools.
In the Administrative Tools window, select Performance.

When you first start the Performance tool, the graph displays three counters by default (as shown in Figure 12-7):

Pages/sec Represents the rate at which pages are read from or written to disk during virtual memory operations. Consistently high values can indicate that not enough memory is present on a system.
Avg. Disk Queue Length Represents the average number of read and write requests queued for the selected disk. Consistent values above zero means that requests are backing up, which may indicate not enough memory or a slow disk system.
%Processor Time Represents the percentage of elapsed time that the processor spends executing nonidle tasks. Consistently high values (over approximately 80 percent) might indicate that your processor is slowing down your system.

Figure 12-7: The Performance Tool starts working right away.

The three default counters actually do a very good job of representing the basic aspects of a computer’s performance. Of course, they are only three of the hundreds of counters that are available in the Performance tool. The counters that you monitor depend on whether you are trying to collect general baseline information, troubleshoot a performance problem, diagnose an issue with an application, and so on. Detailed information on commonly monitored objects and counters is presented later in this section.

To add a counter to the Performance tool, follow these steps:

Right-click the graph and select Add Counters.
In the Add Counters dialog box, shown in Figure 12-8, select the computer that you want to monitor.

Figure 12-8: Select a counter to add to the Performance tool graph.
Select the appropriate Performance Object.
Select All Counters or a specific counter from the list. You can use the Shift and Ctrl keys to select multiple counters. Click Explain for an explanation of any counter.
Select All Instances or choose a specific instance of the object.
Click Add to add the counter.
Repeat Steps 3 through 7 as often as necessary to add all the desired counters.
Click Close to return to the Performance window.

In the Performance window, you can view counter data in the following formats:

As a graph, similar to the one shown in Figure 12-7.
As a histogram, similar to the one shown in Figure 12-9.

Figure 12-9: A histogram represents values as vertical bars.
As a report, such as the one shown in Figure 12-10.

Figure 12-10: A report displays values as simple text.

To change the view, right-click the current view, select Properties, and access the General tab.

Performance Logs and Alerts

The Performance Logs And Alerts utility allows you to log counter information to a file and to trigger alerts that are based on configured events. This utility contains three subsections:

Counter Logs Log activity for selected counters at regular intervals.
Trace Logs Log activity for selected counters when a particular event occurs.
Alerts Log activity and can notify a user when a particular counter exceeds a certain threshold.

You can view and analyze performance logs by using the Performance tool or an external data-analysis program, such as Microsoft Excel.

To enable performance logging, follow these steps:

In the Performance window, expand Performance Logs And Alerts.
Right-click Counter Logs and select New Log Settings.
In the New Log Settings dialog box, enter the name for the log and click OK.
On the General tab, shown in Figure 12-11, add the counters that you want to log. Modify the sampling interval, if necessary.

Figure 12-11: Configure general log properties.
On the Log Files tab, you can modify the name and location of the log file, as well as the type of file if desired.
On the Schedule tab, shown in Figure 12-12, configure the start and stop times for logging. You can manually stop and start logging, or configure logging to start and stop at specified times.

Figure 12-12: Configure log-scheduling properties.
Click OK to save the log configuration.

After you create a log, you can load the log into the Performance tool and view it the same way you would view real-time performance data. To view a performance log, follow these steps:

In the Performance window, select System Monitor, right-click the data display, and then select Properties.
In the System Monitor Properties dialog box, on the Source tab, select Log Files, as shown in Figure 12-13. Click Add and enter the name of the log file that you want to view. Click OK to continue.

Figure 12-13: Choose the log file to view in System Monitor.
Right-click the data display and then select Add Counters.
Add the counters that you want to view and then click OK. The available counters are limited to those that are present in the log.

In addition to other monitoring techniques, you can use alerts to notify users or administrators when conditions exceed preset criteria. For example, you can configure an alert to send a message to the administrator when processor utilization exceeds 80 percent.

When an alert is triggered, you can perform the following actions:

Log an entry in the application event log. This option is enabled by default.
Send a network message to a particular user.
Start a performance log that can further monitor the alert condition.
Run a program that can be used to launch any application program. You can use this option to launch a script that would send e-mail to the administrator.

To configure an alert, follow these steps:

In the Performance window, expand Performance Logs And Alerts.
Right-click the Alerts folder and select New Alert Settings.
Enter a name for the alert and click OK.
On the General tab, add the counter(s) and the alert value, as shown in Figure 12-14.

Figure 12-14: Configure an alert to warn you when counters cross performance thresholds.
On the Action tab, configure the action(s) to be performed when an alert is triggered.
On the Schedule tab, configure the start and stop times for when the alert should be scanned. You can turn scanning on and off manually or configure scanning to occur on a schedule.
Click OK to create the alert.

Real World—Establishing a Baseline of Performance Data

It is important to establish a baseline, or reference point, of performance data at a time when the computer has adequate resources and is performing well. Having a baseline for comparison is necessary to identify changes in resource usage if computer performance begins to decline.

You establish a baseline by monitoring key counters for an extended period of time—several days to a week is generally adequate. Use the logging feature to gather baseline information. As you analyze your baseline logs, you will notice spikes and dips in the recorded values, but do not focus on them. Instead, look at the averages, identify trends, and define acceptable ranges for each of the counters. When constructing a baseline, use just a few important counters for the disk, memory, and processor objects.

Important Memory Counters

You can detect memory bottlenecks by monitoring and evaluating several important physical memory, paging file, and file system cache counters. Table 12-2 contains a listing of these counters and brief descriptions.

Table 12-2: Important Memory-Related Counters
Object	Counter	Description
Memory	Pages/sec	The number of pages that were either read from disk or written to disk to make room in physical memory for other pages. This counter is the primary indicator of whether or not the computer has sufficient memory. An average value in excess of 20 can indicate insufficient memory in the computer.
Memory	Available Bytes	Amount of physical memory that is unallocated in the computer. Does not include any memory that is allocated to working sets or file system cache.
Paging File	% Usage	Percentage of the paging file that is currently in use.
Paging File	% Usage Peak (bytes)	Peak percentage of the paging file in use.
Cache	Copy Read Hits %	The percentage of time that information was found in the file system cache and did not have to be read from disk.

Important Processor Counters

Monitoring and evaluating several important counters allow you to detect processor bottlenecks. Table 12-3 contains a listing of these counters and brief descriptions.

Table 12-3: Important Processor-Related Counters
Object	Counter	Description
Processor	% Processor Time	The percent of time that the processor is processing information (processing a nonidle thread). This counter is the primary indicator of processor activity. Sustained values over 80 percent indicate a potential processor bottleneck.
Processor	Interrupts/sec	The average rate per second that the process handles interrupt requests from applications and hardware devices. This counter indicates the activity of the devices in a computer that uses interrupts. When a computer is idle, values average around 100. Averages in excess of 300 indicate a potential problem.
System	Processor Queue Length	Number of threads in the processor queue, waiting to be processed. This counter is a true indicator of processor efficiency. If this counter averages two or more, it indicates that the processor cannot keep up with the number of requests for processing and has become a bottleneck.
System	Context Switches	Rate at which the processor is switched from one thread to another. If this value is high (that is, more than 500), you may have an inefficient application that uses too many threads or a problem with a device driver.
Process	% Processor Time	The percent of processor time used by all the threads of a particular process.

Important Disk Counters

Before you can effectively manage disk concerns in Windows XP, you need to be aware of the following concepts:

Physical disk A physical disk corresponds to a hard disk in the system. If there are two hard disks in a computer, it has two physical disks. Monitoring a physical disk gives an overall indicator of hard disk performance.
Logical disk A logical disk is a volume on a physical disk. A physical disk can have multiple logical disks. Monitoring a logical disk gives an indicator of how often that volume is being accessed by applications or how much disk space is available on that volume.
Disk reads A disk read operation occurs when the operating system requests information from the disk. After information is read from the disk, it can be stored in file system cache. On a system with sufficient memory to support file system caching, the number of disk reads should be relatively low because most read requests are serviced from cache (fast reads).
Disk writes A disk write operation occurs when the operating system receives a request to save data to the hard disk. Windows XP supports write-behind caching, which permits the operating system to gather many disk write requests together and write them to the disk simultaneously, reducing the overall number of disk writes performed.
Disk queue The disk queue is where disk read and write requests are stored while waiting to be processed by the hard disk. The more requests waiting in the queue, the more difficulty the disk has meeting the computer’s needs.

You can detect disk bottlenecks by monitoring and evaluating several important physical and logical disk counters. Physical disk counters provide information on the activity of a hard disk as a whole. Logical disk counters report statistics on the volumes (drive letters) that are created on the disks. Table 12-4 lists and briefly describes these counters.

Table 12-4: Important Disk-Related Counters
Object	Counter	Description
Logical Disk	% Free Space	Ratio of free disk space that is available to total usable disk space on a particular logical disk.
Physical Disk	% Disk Time	The percentage of time that the selected physical disk is busy servicing read or write requests. If this value is consistently over 50 percent, the hard disk is having trouble keeping up with the load that is being placed on it.
Logical Disk Physical Disk	Disk Bytes/sec	The rate at which bytes are being transferred. The higher the number, the better the disk is performing.
Logical Disk Physical Disk	Avg. Disk Bytes/Transfer	Measures the size of I/O operations. A higher value indicates more efficient disk usage.
Physical Disk	Avg. Disk Queue Length	The average number of both read and write requests that are queued for the selected disk. If this value averages two or more, the disk is a bottleneck.

Lesson Review

The following questions are intended to reinforce key information presented in this lesson. If you are unable to answer a question, review the lesson materials and try the question again. You can find answers to the questions in the “Questions and Answers” section at the end of this chapter.

Which of the following pieces of information can you view by using Task Manager?
1. Current CPU usage
2. The percentage of time that a physical disk is busy
3. The amount of available physical memory
4. The percentage of the paging file currently in use
You are using the Performance tool to monitor the performance of a user’s computer. You notice that the processor regularly averages over 80 percent utilization when the computer is used normally. You also notice that the Pages/sec counter for the memory object averages around 4. What does this indicate to you?
1. The processor is a potential bottleneck.
2. The physical disk is a potential bottleneck.
3. The memory is a potential bottleneck.
4. This value is within the acceptable range for normal computer use.

Lesson Summary

Task Manager provides information about applications and processes currently running on a computer, and also provides real-time performance information about processor, memory, and network usage.
You can use the Performance tool to collect more detailed performance information than Task Manger provides. In addition, the Performance tool allows you to monitor other systems remotely, log information for future analysis, and configure alerts to notify you of potential error conditions.
In the Performance tool, an object represents a major computer component. An instance represents an occurrence of an object. A counter represents a particular aspect of an object that you can measure directly.