Resouce Guides / Windows Server 2003 / Performance Monitoring

Use System Monitor to find bottlenecks in Windows Server 2003

Windows Server 2003 comes with two performance monitoring tools: System Monitor, and Performance Logs and Alerts. These tools provide information that administrators can use to find bottlenecks and for troubleshooting Windows.

You can open the Performance console from the Administrative Tools by selecting Start -> Programs -> Administrative Tools -> Performance. You can also open it from the command line by typing perfmon.msc.

When a new Performance console is opened, it loads a blank system monitor graph into the console. The Performance console contains two utilities: System Monitor and Performance Logs and Alerts.

This article will discuss System Monitor, then we'll discuss Performance Logs and Alerts in a separate article.

System Monitor periodically takes a snapshot of system performance characteristics and displays the information as a graph, which can then be used to monitor the behavior of the system, predict future resource requirements, measure the load on system components, and trigger an alert to inform you of potential failures of these components.

Here are some key terms used in performance monitoring that will help clarify the function of the System Monitor and how it ties into software and system functionality. The three components noted in the System Monitor are object, counter and instance.

• Components contained in a system are grouped into objects. Objects are grouped according to system functionality or association within the system. Objects can represent logical entities such as memory or a physical mechanism such as a hard disk drive.


• Counters are subsets of objects. Counters typically provide more detailed information for an object, such as queue length or throughput for an object. The System Monitor can collect data through the counters, with data being collected and displayed in graphical or text log formats.


• If a server has more than one similar object, each is considered an instance. For example, a server with multiple processors has individual counters for each instance of the processor. Counters with multiple instances also have an instance for the combined data collected for the instances.

The histogram and graph view can be used to view multiple counters at the same time. However, each data point displays only a single value that is independent of its object. The report view is better for displaying multiple values. Data sources can be obtained by clicking the View Current Activity button on the button bar. On the other hand, clicking View Log Data displays data from completed or running logs.

Adding counters

System Monitor is ideal for diagnostics and short-term views of performance output. Before counters can be displayed, they have to be added. Counters can be added simply by using the button bar. The Counter button on the button bar includes Add, Delete and Highlight. You can use the Add Counter button to add new counters to be displayed.

The Delete Counter button removes unwanted counters from the display. The Highlight button is helpful for highlighting a particular counter of interest; a counter is highlighted with a white or black color around the counter. The Highlight button cannot be used with Report view.

Note: It's possible to display the function of a button in the button bar by placing the mouse cursor on the button.

When the Add Counter button is selected, a dialog box appears. The top section of this property page allows you to either choose the server being worked on or connect to a different server on the network. System Monitor allows you to connect to a remote computer and to monitor system performance of the server. This process is referred to as remote monitoring.

It's important to collect all the monitored data for analysis. Clicking the Freeze Display button or pressing Ctrl+F freezes displays, which in turn suspends data collection. Data collection can be resumed by pressing Ctrl+F or clicking the Freeze Display button again. Click the Update Data button to display an updated data analysis.

Importing displays

You can also possible to import or export a display by using the Cut and Paste buttons. For example, a display can be saved to the Clipboard and then imported into another instance of System Monitor. This is done to obtain system information and view or analyze that information on a different system rather than performing analysis on a production server.

System Monitor enables you to save log files in comma-separated (csv) or tab-separated (tsv) format, which you can then analyze by using third-party tools such as Seagate Crystal Reports. You can also import csv or tsv files into an Excel spreadsheet or a database application such as Access.

Windows Server 2003 also allows you to collect data in SQL database format, which is useful for performance analysis at an enterprise level rather than a per-server basis. Reports displayed in Excel can help you better understand the data as well as provide reports to management. Once the log file is saved in csv format, it can be opened using Excel.

Note: If a server stops responding, it's possible to run System Monitor from another computer to monitor the troubled server.