| This section summarizes the tools and procedures used to monitor and optimize the performance of a Windows Server 2003 server. Items covered include Event Viewer, Task Manager, Performance Monitor, System Monitor, disc quotas, and print queues. Event Viewer The Event Viewer is used to view event log files that are updated by the operating system and various services and applications running on your server. Typically, events will be written to the logs for any significant occurrence that a user or administrator should be aware of. All Windows Server 2003 systems have at the very least these three logs: The System log file Records events related to system operation, most often associated with device drivers and services such as DHCP or WINS. Most of the information you will find here is related to the stopping and starting of services or the failure of a system component. The Application log file Records events related to applications, programs, and utilities, usually not native Windows Server 2003 components. Examples are database programs, email servers, and print messages. The information that is recorded here is determined by the application developer, and it will usually consist of informational messages, errors, or warnings. This log is also used to store the alerts that are generated by the Performance Logs and Alerts tool. The Security log file Records events related to security and auditing. Typical events include valid and invalid logon attempts and the accessing of resources, such as opening, reading, or deleting a file or folder. The types of events recorded in this log can be configured via the audit policy. In previous versions of Windows, the Security log would not record any information until an audit policy was enabled. In Windows Server 2003, security logging is enabled by default.
If the DNS service is installed on your server, the DNS log will be available. The DNS log file records events related to the operation of the DNS service. If you're having name-resolution problems on your network, this is the first place to look. In addition, Active Directory domain controllers will have the following logs: The Directory Service log file Records events related to the operation of the Active Directory service. Typical events you will see in this log are related to communication between domain controllers and Global Catalog servers. The File Replication Service log file Records events related to the replication of the SYSVOL folder.
Auditing Auditing is the process of recording user and system activities on the network. These events are recorded in the Windows Server 2003 Security log, which is one of the logs contained in the Event log. When you configure auditing, you decide which events you want to track and against what object. Typical activities that can be tracked are valid and invalid logon attempts, creating and opening files, and changes in user rights. A typical entry in the Security log will show the following: The time and date the event occurred The event performed The user account that performed the event The success or failure of the event
An audit policy is used to define the events that will be recorded in the Windows Server 2003 Security logs. Audit policies are created and applied in ways similar to the other types of policies using the Group Policy snap-in. Auditing is turned on by default in Windows Server 2003. Task Manager The Task Manager can be used to monitor and manage the state of active applications, including a real-time view of the system resources assigned to each application. Task Manager also allows you to observe applications that have stopped responding, to increase or decrease their priority, and to terminate them. Windows Server 2003 subdivides processing time to applications using different classes of priority levels. Priority levels are assigned numbers from 0 to 31. Applications and noncritical operating system functions are assigned levels of 0 to 15, whereas real-time functions such as the operating system kernel are assigned levels of 16 to 31. The normal base priority is 8. Task Manager does not allow you to set a process to a specific number; it allows you only to set priority classes. The priority classes are as follows: Realtime Priority 24 High Priority 13 AboveNormal Priority 9 Normal Priority 8 BelowNormal Priority 7 Low Priority 4
Performance Monitor The Performance Monitor tool is actually made up of two separate Microsoft Management Console (MMC) snap-ins: System Monitor and Performance Logs and Alerts. System Monitor Each subsystem within Windows Server 2003 has more than one object that exists in System Monitor. Each object has several monitoring functions called counters. Each counter offers insight into a different aspect or function of the object. The System Monitor snap-in allows you to view real-time performance data contained in the counters from your system. In addition, System Monitor allows you to review performance data that is stored in a log file created with the Performance Logs and Alerts snap-in. Here's a list of the objects you need to monitor closely for performance issues: Memory Processor Physical disk Network
Performance Logs and Alerts The Performance Logs and Alerts MMC snap-in allows you to log performance data over a period of time and save it to a log file for later viewing. Two logging options are available: Counter Logs and Trace Logs. Counter logs allow you to record data about hardware usage and the activity of system services from local or remote computers. You can configure logging to occur manually or automatically based on a defined schedule. Trace logs record data as a certain activity, such as disk I/O or a page fault, occurs. When the event occurs, the provider sends the data to the log service. The log data can be saved in the following file formats: Text file (CSV) Comma-delimited format, for import into spreadsheet or database programs. Text file (TSV) Tab-delimited format, for import into spreadsheet or database programs. Binary file This is the default for use with the System Monitor snap-in. Data is logged into this file until it reaches the maximum limit. The default maximum file size is 1MB, but this can be changed when you configure settings for the file from the Log Files tab of the Log Properties dialog box by clicking the Configure button. Binary circular file Data is logged into this file until it reaches the maximum limit. Then the file is overwritten, starting at the beginning of the file. The default maximum file size is 1MB, but this can be changed when you configure settings for the file from the Log Files tab of the Log Properties dialog box by clicking the Configure button. SQL Data is logged directly into an existing SQL database.
The Alerts container is used to define threshold alerts. These can be used with real-time measurements or with historical log files. An alert is issued when a specific counter crosses a defined threshold value. When this occurs, a trigger event is initiated. You can select several actions to be performed when an alert threshold is reached: Log an Entry in the Application Event Log If a threshold is reached, Windows Server 2003 will create an entry in this log and you can view it in the Application event log found in the Event Viewer. Send a Network Message To This allows you to send a message to a user or computer via the Messenger service. Start Performance Data Log This starts logging to a predefined counter log. This is useful if you are trying to see what happens to system performance when a specific event occurs. Run This Program This can be any program that can be run from a command line. For example, it might be a program that performs some type of system maintenance, such as compressing files.
Monitoring Memory Performance Here are some counters to watch to monitor memory performance: Memory: Cache Faults/sec This condition usually indicates an insufficient amount of RAM on your system. However, it can also be caused by running a combination of apps, such as running a read-intensive application at the same time as an application that is using an excessive amount of memory. Memory: Page Faults/sec If this counter averages above 200 for low-end systems or above 600 for high-end systems, excess paging is occurring. Memory: Available Bytes Less than 4MB indicates insufficient RAM on the system, thus causing the system to perform excessive paging. Paging File: % Usage Peak If this number nears 100% during normal operations, the maximum size of your paging file is too small, and you probably need more RAM.
Monitoring Disk Performance Unlike in previous versions of Windows, Windows Server 2003 enables the disk counters by default. Here are some key performance counters for the disk subsystem: PhysicalDisk: Avg. Disk Queue Length The number of queued requests should not exceed the number of spindles in use, plus 2. PhysicalDisk: % Disk Time It is not uncommon for this counter to regularly hit 100% on active servers. Sustained percentages of 90% or better, however, might indicate that a storage device is too slow. This usually is true when its Avg. Disk Queue Length counter is constantly above 2. PhysicalDisk: Avg. Disk sec/Transfer Indicates the average time, in seconds, for a disk transfer.
Monitoring Processor Performance To identify problems with the processor, you should monitor the following counters: Processor: % Processor Time If this counter remains above 80% for an extended period, you should suspect a CPU bottleneck. (There will be an instance of this counter for each processor in a multiprocessor system.) Processor: % Total Processor Time If this value remains consistently higher than 80%, at least one of your CPUs is a bottleneck. System: Processor Queue Length A sustained value of 2 or higher for this counter indicates processor congestion.
Monitoring Network Performance To identify performance problems with the network interface, you should monitor the following counters: Network Interface: Bytes Total/sec If the highest observed average is less than 75% of the expected value, communication errors or slowdowns might be occurring that limit the NIC's rated speed. Network Interface: Output Queue Length If this averages above 2, you are experiencing delays. Network Interface: Packets/sec Sharp declines that occur while the queue length remains nonzero can indicate protocol-related or NIC-related problems.
File Server Resource Manager The File Server Resource Manager (FSRM) is a new MMC snap-in available in Windows Server 2003, starting with the R2 release. The FSRM MMC contains the following snap-ins: Quota Management Used to create and manage quotas on volumes and folders. File Screening Management Used to create file screens that prevent users from saving blocked file types in managed volumes and folders. Storage Reports Management Used to create and schedule storage reports.
Although the domain can still be Windows 2000 or Windows Server 2003 without R2, the server on which the FSRM is installed and all the servers that will be managed via the FSRM must be at R2 or later. Implementing and Monitoring Disk Quotas Disk quotas provide a method of controlling the amount of space a user has access to on a file server. You can also use the disk quota feature to monitor the space in use by your users. Disk quotas are disabled by default. All events related to disk quotas are sent to the event logs. There are two types of disk quotas in Windows Server 2003 starting with the release of version R2: NTFS Disk Quotas Here are some of the key points to remember about NTFS disk quotas: Disk quotas do not apply to members of the local Administrators account. The files contained on a volume converted from FAT to NTFS will not count against user quotas, because they will initially be owned by the local administrator and will count against the administrator's quota. Files created or moved to the volume after the conversion has been completed are owned by the user. Disk quotas cannot be applied on a per-folder basis. They can only be applied on a per-volume basis. If a physical disk has multiple volumes, a quota must be applied separately to each volume. Disk usage is based on all files that the user creates, copies, or takes ownership of. File compression cannot be used to prevent a user from exceeding his or her quota. Disk quotas are based on the actual file size, not the compressed file size. Disk quotas affect the free size that an installed application will see during the installation process. Disk quotas can be enabled on local or network volumes and on removable drives formatted with NTFS. Disk quotas are not available on any volume or partition formatted using a version of Windows prior to Windows 2000. Disk quotas are available only on NTFS volumes or partitions formatted by Windows 2000 or later.
File Server Resource Manager Quotas Although NTFS Quotas are still available in Windows Server 2003 R2, it is much better to implement your quotas using the File Server Resource Manager (FSRM). The differences are as follows: Quotas can be set at both the folder and the volume level. Quotas are calculated using the actual disk space used, so compressed files are now calculated using the actual size on disk, not the uncompressed size. Quotas can be implemented on multiple servers by copying a template between servers. Quotas can be automatically created for subfolders as they are added. Notifications have been enhanced to include not only Event Logging, but also the capability to send an email, run a file or script, or generate a storage report.
The following are some key points to remember about FSRM Quotas: Space The allowed disk space can be defined in any increment from kilobytes to terabytes. Quotas can be applied to either new or existing volumes or folders. Limits Quotas can be set to either Hard or Soft. A hard quota will prevent the user from saving any more files. Unlike some third-party software, there is no grace period; when the limit is reached, the user is effectively blocked from using any more space. A soft quota will warn users but will let them continue to save files. The soft quotas are typically used for space monitoring purposes. Notifications You can configure notifications to let the user and/or administrator know when the users' space nears or reaches their quota limit. These notifications can be saved to the event log or be emailed, or they can cause a program or script to be run.
File Screening with the FSRM The second major feature that the File Server Resource Manager brings to the table is file screening. File screening enables you to prevent users from saving blocked file types to your servers. File screens are configured through the use of File Groups. A File Group defines the files that should or should not be blocked. In addition, a File Group can be configured for specific exceptions that will override the blocking rule. Windows Server 2003 includes the following prebuilt file groups: Audio and Video Files Backup Files Compressed Files E-Mail Files Executable Files Image Files Office Files System Files Temporary Files Text Files Web Page Files
When there is a need to allow files that other file screens are blocking, you need to create a file screen exception. A file screen exception is a file screen that is used to override the screening for a folder and its subfolders. This is done by attaching a file group to the file screen. Managing and Monitoring Print Queues Here are some key terms to remember with regard to print queues: Print job The sequence of data and print device commands sent to the print device Spooler The service that manages the documents that are waiting to be printed Spool file The file that stores the print data while it's waiting to be printed Print queue The list of print jobs currently in the spooler Print server A computer, usually a Windows Server 2003 machine, which you install and share the print drivers on Printer driver The software that enables the operating system to communicate to the printing device Print device The physical printer Local printer Any print device that is directly attached to and controlled by the print server Network printer Any print device that is directly attached to the network
Printer pooling is a form of load balancing in that two or more print devices are represented by a single virtual printer. The users send their print jobs to what looks like a single printer. The print server then queues the print jobs in the order that they were submitted. For printer pooling to work successfully, the following conditions must be met: The printers must use the same print driver They don't all have to be the same exact model, just as long as they will give the same results using a common printer driver. They must all be connected to the same print server This is because they have to share the same driver and print queue. They should be located in close proximity to each other Because the user will have no way of knowing which printer the print job ends up on, it's best to have them all in the same room.
You can set up several logical printers connected to a single physical printer. Each logical printer can have slightly different configurations (but use the same print driver) and can be assigned to different people. For example, different users could be assigned different logical printers with different priorities. The priority sets the default importance of the print jobs in the queue. Priorities can be set from 1 to 99. The job assigned the highest number will be printed first. Table 8 shows the given predefined roles. Table 8. Group-Specific RolesGroup | Print | Manage Documents | Manage Printer |
|---|
Administrators | X | X | X | Creator Owner | | X | | Everyone | X | | | Power Users | X | X | X | Print Operators | X | X | X | Server Operators | X | X | X |
A printer can be configured with various advanced properties. A summary of these properties is listed in Table 9. Table 9. Configurable Advanced Printer PropertiesSetting | Description |
|---|
Always available and Available from | Enables you to specify the hours of the day when the printer is available. For example, you can configure a printer that accepts large jobs to print only between 6:00 p.m. and 8:00 a.m. so that shorter jobs can be printed rapidly. Jobs submitted outside the available hours are kept in the print queue until the available time. | Priority | Enables you to assign a numerical priority to the printer. This priority ranges from 1 to 99, with higher numbers receiving higher priority. For example, you can assign a printer for managers with a priority of 99 so that their print jobs are completed before those of other employees. | Spool print documents so program finishes printing faster | Enables spooling of print documents. Select from the following: Start printing after last page is spooled. Prevents documents from printing until completely spooled. Prevents delays when the print device prints pages faster than the rate at which they are provided. Start printing immediately. The default option, causes documents to be printed as rapidly as possible.
| Print directly to the printer | Documents are sent to the print device without being spooled first. Recommended only for unshared printers. | Hold mismatched documents | The spooler holds documents that do not match the available form until this form is loaded. Other documents that match the form can print. | Print spooled documents first | Prints documents in the order that they finish spooling, rather than the order in which they start spooling. Use this option if you have selected the Start printing immediately option. | Keep printed documents | Retains printed jobs in the print spooler. Enables a user to resubmit a document from the print queue rather than from an application. | Enable advanced printing features | Enable additional options such as page order and pages per sheet. | Printing Defaults command button | Selects the default orientation and order of pages being printed. Users can modify this from most applications if desired. Additional print device-specific settings may be present. | Print Processor command button | Specifies the available print processor, which processes a document into the appropriate print job. | Separator Page command button | Enables you to specify a separator page file, which is printed at the start of a print job to identify the print job and the user who submitted it. This is useful for identifying printed output when many users access a single print device. |
The print spooler is part of the operating system and runs as the Print Spooler service. The print spooler manages the print queues for all local or network printers that are managed by the server. By default, the spool file is located at %systemroot%\System32\Spool\Printers. Large print jobs can generate a significant impact on the network and print server loads. The print spooler files on a Windows Server 2003 print server can be relocated to a dedicated hard disk if these loads are going to be high. The Print Management Console is an updated Microsoft Management Console (MMC) snap-in that you can use to view and manage printers and print servers in your organization. You can use Print Management from any computer running Windows Server 2003 R2 or later, and you can manage all network printers on print servers running Windows 2000 Server, Windows Server 2003, or Windows Server 2003 R2. Print Management Console The Print Management Console is an updated MMC snap-in, first included in Windows Server 2003 R2, that you can use to view and manage printers and print servers in your organization. You can use Print Management from any computer running Windows Server 2003 R2 or later, and you can manage all network printers on print servers running Windows 2000 Server, Windows Server 2003, or Windows Server 2003 R2. The Print Management Console is not installed by default. It must be manually installed after your initial installation of Windows Server 2003 R2. In addition, the schema additions for R2 must be installed to support the new Fast Query lookup via LDAP in Active Directory. The PMC includes the Printer Filters feature. Printer Filters can be used to group your printers according to various criteria, so that they can be found and managed easily There are three preconfigured printer filters: All Printers This list contains all printers in your organization. Printers Not Ready This list shows any printer with a not ready condition because of error, being paused, out of paper, and so on. Printers with Jobs This list shows all printers with print jobs currently in their print queues.
The following are some additional things to remember about printers: When the wrong printer driver is installed, the output is garbled. A print device can be associated with multiple printers to enable custom settings and priorities. A printer pool is a single printer that is associated with multiple print devices in order to simplify the use of identical printers (or similar printers that can use the same print driver) and increase the output performance.
|
