Establishing a Performance Monitor Baseline for Windows NT Server 4.0

Establishing a Performance Monitor Baseline for Windows NT Server 4.0

December 27, 2000

Chris Trawick


Today, network administrators and IT support staff are faced with a tremendous amount of routine activities that must be accomplished on a regular basis. In addition to resolving normal user issues and problems, the average IT staff member today is often charged with many additional responsibilities such as verifying and testing network backups, applying service packs and hotfixes, as well as ensuring that network security measures keep unwanted visitors at bay. Over the course of an eight hour day, these tasks can consume a substantial amount of time.

Perhaps one of the most critical responsibilities that an administrator faces on a daily basis is that of ensuring that the organizations NT servers are operating at peak efficiency. Even with the enormous number of tools provided with a standard NT Server installation, this can be a daunting task. Choosing the right tool has a direct relationship to the timeliness of monitoring NT Server, as well as the usefulness of the information that is gathered. For keeping a pulse check on an NT box, Performance Monitor is as good as it gets. In the following sections, I will explain how to establish a solid performance baseline that, in a couple of minutes per day, can give you a good understanding of exactly how your NT Server is performing.

One of the most challenging aspects of setting up a baseline for Performance Monitor is deciding what objects and counters to use. With a standard NT Server installation, a default set of objects are installed and made available. With the addition of additional software applications (particularly BackOffice products) to the NT Server, additional objects and counters are added. Exchange Server 5.5 and SQL Server 7.0 add several key objects to Performance Monitor that enable you to monitor application-specific activities.

When deciding upon objects, I recommend that you select the counters that are relevant to the following key system components:  Processor, memory, disk space, and network. At the latter portion of this article, I will list what I consider to be a good set of counters to use when monitoring an NT Server. In the meantime, let's discuss each of these key components and what their usage within a perfmon session can tell you about your NT Server.


Without a doubt, the most important component of a server is its processor(s). It is obvious that a well rounded baseline for Performance Monitor would include at least a few key processor counters. Two relevant counters I advise administrators to consider implementing here are the System: % Total Processor Time and System: Processor Queue Length.

  • The System: % Total Processor Time counter provides an averaged value of the amount of time a systems processor (or multiple processors) are being used to execute non-idle threads. This counter is able to take into account systems that are make use of symmetric multiprocessing (SMP.)

  • The System: Processor Queue Length counter provides valuable insight into the performance of the processor(s) by giving you the length of the processor queue. A good rule of thumb is to not be greatly concerned unless this value hovers over 4. Resource intensive applications can push the queue length up periodically, but the queue should not stay higher than 4 for a prolonged period. If it does, you may need to look into a processor upgrade, or adding additional ones.


Physical RAM plays an integral role in the overall health and performance of Windows NT Server. Providing the operating system and associated applications with adequate RAM is perhaps one of the best (and least expensive) hardware investments you can make. Given all of this, there are two Performance Monitor counters within the Memory object that simply must be included in a solid NT Server baseline: Memory: Pages/sec and Memory: Available Bytes.

  • The Memory: Pages/sec counter provides the administrator with an overall picture of how the servers usage of physical (and virtual) memory is being used. It indicates the number of data pages that move between physical RAM and the hard disk paging file(s) per second. This is a key performance indicator, and should be watched closely. If the average value for this counter stays (for a prolonged period of time) higher than 75%, physical RAM may be inadequate for the server's workload.

  • Memory: Available Bytes simply provides a representation of how much memory is awaiting usage. This too, should be analyzed over a prolonged period of time to determine if the trend shows consistently low values for this counter. If it does, a RAM upgrade may be in order.

Disk Space:

In this grouping, I like to take into consideration both physical and logical disk information. Each of the two can provide information that the other cannot. For example, it is a good practice to monitor your physical drives that contain mission critical data files to ensure that the drive does not reach capacity. It is also a good practice to monitor your system partition to ensure that it has the necessary disk space available to promote safe booting of NT. Both of these tasks require a somewhat different approach. Given this, here are a couple of the counters I particularly recommend.

  • Logical Disk: % Free Space: This counter should be specified especially toward the C: partition (or whichever partition your system boots from). Because applications seem to default their installation directory to C:, this counter is important to keeping tabs on the real estate that remains available.

  • Logical Disk: % Disk Time: Measures the amount of time that the partition is busy servicing read and write requests. If this value averages over 80% for a long period, there may be need for further investigation.

  • Physical Disk: Avg. Disk Queue Length: This indicates a measurement of the activity of the disk subsystem. A faster disk may be warranted if this value averages over 4 for a protracted time period.


Developing a solid foundation for a performance baseline would be incomplete without including in that baseline NT counters that give indications of overall network health. Windows NT Server provides several useful objects for monitoring how effective network requests are being serviced. While there are third party tools on the market that provide a more detailed and systematic approach to network monitoring, these NT counters provide a broad overview of server performance, and can be useful in giving administrators a snapshot view of how NT is handling network requests. If further analysis is needed, you will likely want to look into a third party application offering. Specifically, here are the network counters I regularly use:

  • Redirector: Network Errors/sec: This counter provides information that could help administrators identify communications failures between NT servers. If this value remains high for a long period, you may want to invoke the usage of a network monitor to monitor the overall health of the network itself.

  • Network Interface: Output Queue Length: A value higher than 3, over a protracted period of time, would tend to suggest a possible transmission error situation. This counter is relevant as its name would imply. The output queue on a file/application server is largely assessed based upon its ability to "serve" resources. A constantly high queue length would suggest that there is a bottleneck inherent in the server's performance.

In Closing...

Several years ago, I bought and read The Microsoft Windows NT 4.0 Workstation Resource Kit. Most administrators would rank this book as required reading (and so would I!) Somewhere around Chapter 8 or 9, I remember glancing at the chapter name. It was titled "The Art of Performance Monitoring." I thought that to be a somewhat unusual title. After all, there's no "art" involved in information technology, how absurd.

Over the course of a few additional years of NT experience, I've now come to the conclusion that effectively monitoring NT performance is indeed an art form. There is so much information readily available, it truly takes an artist to gather together the relevant data items and make them useful for decision making. I hope this article has helped to give you some additional insight that will be helpful as you continue to expand your "artistic endeavors."