Establishing a Performance Monitor Baseline for Windows NT Server 4.0

Chris Trawick

Overview:

Today, network administrators and IT support staff are faced
with a tremendous amount of routine activities that must be accomplished on a
regular basis. In addition to resolving normal user issues and problems, the
average IT staff member today is often charged with many additional
responsibilities such as verifying and testing network backups, applying service
packs and hotfixes, as well as ensuring that network security measures keep unwanted
visitors at bay. Over the course of an eight hour day, these tasks can consume a
substantial amount of time.

Overview:
Today, network administrators and IT support staff are faced with a tremendous amount of routine activities that must be accomplished on a regular basis. In addition to resolving normal user issues and problems, the average IT staff member today is often charged with many additional responsibilities such as verifying and testing network backups, applying service packs and hotfixes, as well as ensuring that network security measures keep unwanted visitors at bay. Over the course of an eight hour day, these tasks can consume a substantial amount of time.

Perhaps one of the most critical responsibilities that an
administrator faces on a daily basis is that of ensuring that the organizations
NT servers are operating at peak efficiency. Even with the enormous number of
tools provided with a standard NT Server installation, this can be a daunting
task. Choosing the right tool has a direct relationship to the timeliness of
monitoring NT Server, as well as the usefulness of the information that is
gathered. For keeping a pulse check on an NT box, Performance Monitor is as good
as it gets. In the following sections, I will explain how to establish a solid
performance baseline that, in a couple of minutes per day, can give you a good
understanding of exactly how your NT Server is performing.

One of the most challenging aspects of setting up a baseline for
Performance Monitor is deciding what objects and counters to use. With a
standard NT Server installation, a default set of objects are installed and made
available. With the addition of additional software applications (particularly
BackOffice products) to the NT Server, additional objects and counters are
added. Exchange Server 5.5 and SQL Server 7.0 add several key objects to
Performance Monitor that enable you to monitor application-specific activities.

When deciding upon objects, I recommend that you select the
counters that are relevant to the following key system components: 
Processor, memory, disk space, and network. At the latter portion of this
article, I will list what I consider to be a good set of counters to use when
monitoring an NT Server. In the meantime, let’s discuss each of these key
components and what their usage within a perfmon session can tell you about your
NT Server.

Processor:

Without a doubt, the most important component of a server is its
processor(s). It is obvious that a well rounded baseline for Performance Monitor
would include at least a few key processor counters. Two relevant counters I
advise administrators to consider implementing here are the System: %
Total Processor Time and System: Processor Queue Length.

• The System: % Total Processor Time counter provides an
  averaged value of the amount of time a systems processor (or multiple
  processors) are being used to execute non-idle threads. This counter is able
  to take into account systems that are make use of symmetric multiprocessing
  (SMP.)

• The System: Processor Queue Length counter provides valuable
  insight into the performance of the processor(s) by giving you the length of
  the processor queue. A good rule of thumb is to not be greatly concerned
  unless this value hovers over 4. Resource intensive applications can push
  the queue length up periodically, but the queue should not stay higher than
  4 for a prolonged period. If it does, you may need to look into a processor
  upgrade, or adding additional ones.

Memory:

Physical RAM plays an integral role in the overall health and
performance of Windows NT Server. Providing the operating system and associated
applications with adequate RAM is perhaps one of the best (and least expensive)
hardware investments you can make. Given all of this, there are two Performance
Monitor counters within the Memory object that simply must be included in a
solid NT Server baseline: Memory: Pages/sec and Memory:
Available Bytes.

• The Memory: Pages/sec counter provides the administrator
  with an overall picture of how the servers usage of physical (and virtual)
  memory is being used. It indicates the number of data pages that move
  between physical RAM and the hard disk paging file(s) per second. This is a
  key performance indicator, and should be watched closely. If the average
  value for this counter stays (for a prolonged period of time) higher than
  75%, physical RAM may be inadequate for the server’s workload.

• Memory: Available Bytes simply provides a representation of
  how much memory is awaiting usage. This too, should be analyzed over a
  prolonged period of time to determine if the trend shows consistently low
  values for this counter. If it does, a RAM upgrade may be in order.

Disk Space:

In this grouping, I like to take into consideration both
physical and logical disk information. Each of the two can provide information
that the other cannot. For example, it is a good practice to monitor your
physical drives that contain mission critical data files to ensure that the
drive does not reach capacity. It is also a good practice to monitor your system
partition to ensure that it has the necessary disk space available to promote
safe booting of NT. Both of these tasks require a somewhat different approach.
Given this, here are a couple of the counters I particularly recommend.

• Logical Disk: % Free Space: This counter should be specified
  especially toward the C: partition (or whichever partition your system boots
  from). Because applications seem to default their installation directory to
  C:, this counter is important to keeping tabs on the real estate that
  remains available.

• Logical Disk: % Disk Time: Measures the amount of time that
  the partition is busy servicing read and write requests. If this value
  averages over 80% for a long period, there may be need for further
  investigation.

• Physical Disk: Avg. Disk Queue Length: This indicates a
  measurement of the activity of the disk subsystem. A faster disk may be
  warranted if this value averages over 4 for a protracted time period.

Network:

Developing a solid foundation for a performance baseline would
be incomplete without including in that baseline NT counters that give
indications of overall network health. Windows NT Server provides several useful
objects for monitoring how effective network requests are being serviced. While
there are third party tools on the market that provide a more detailed and
systematic approach to network monitoring, these NT counters provide a broad
overview of server performance, and can be useful in giving administrators a
snapshot view of how NT is handling network requests. If further analysis is
needed, you will likely want to look into a third party application offering.
Specifically, here are the network counters I regularly use:

• Redirector: Network Errors/sec: This counter provides
  information that could help administrators identify communications failures
  between NT servers. If this value remains high for a long period, you may
  want to invoke the usage of a network monitor to monitor the overall health
  of the network itself.

• Network Interface: Output Queue Length: A value higher than
  3, over a protracted period of time, would tend to suggest a possible
  transmission error situation. This counter is relevant as its name would
  imply. The output queue on a file/application server is largely assessed
  based upon its ability to “serve” resources. A constantly high
  queue length would suggest that there is a bottleneck inherent in the
  server’s performance.

In Closing…

Several years ago, I bought and read The Microsoft Windows
NT 4.0 Workstation Resource Kit. Most administrators would rank this
book as required reading (and so would I!) Somewhere around Chapter 8 or 9, I
remember glancing at the chapter name. It was titled “The Art of
Performance Monitoring.” I thought that to be a somewhat unusual title.
After all, there’s no “art” involved in information technology, how
absurd.

Over the course of a few additional years of NT experience, I’ve
now come to the conclusion that effectively monitoring NT performance is indeed
an art form. There is so much information readily available, it truly takes an
artist to gather together the relevant data items and make them useful for
decision making. I hope this article has helped to give you some additional
insight that will be helpful as you continue to expand your “artistic endeavors.”