Monitoring and Analysing System Events

Table of Contents

1. Monitoring and Analysing System Events
2. Event Viewer
3. System Monitor
   1. The Memory Subsystem
   2. Managing the Page File
   3. The Processor Subsystem
   4. The Processes Subsystem
   5. The Disk Subsystem
   6. The Network Subsystem
   7. System Monitor SAQs
4. Real-Time Monitoring
5. Logged Monitoring
6. Managing Software Updates and Site Licensing
7. Managing Servers Remotely
8. Monitoring File and Print Servers
9. Monitoring Application Performance
10. Managing a Web Server

System Monitor

The System Monitor (perfmon.exe) is a tool that monitors and logs any of the processes running on your computer. Perfmon is GUI-based but can also be started by typing Perfmon at a command prompt. It can display performance data about the local computer or one or more remote computers in real time and can also log a history of performance results over time for local or remote computers.

To monitor system performance, you must specify performance objects, counters and instances of those objects so that the System Monitor knows which areas of system performance to track and display.

• Performance Objects are logical collections of performance metrics associated with a computer resource (CPU, disk, memory) or service that can be monitored, eg: Processor, Memory, PhysicalDisk and Paging File.

• Performance Object Instances provide a method of identifying multiple performance objects of the same type, eg: if a computer has more than one processor, its processor performance object displays multiple to monitor each processor separately.

• Performance Counters are data items that tell System Monitor which areas of to track and display. Each performance object has a number of performance counters associated with it, eg: Pages/sec, Available Bytes and %Committed Bytes in Use are all counters for the Memory performance object.

Analysing data allows you to determine whether any resources are placing an excessive load on your computer, leading to a system slowdown. Causes of poor system performance can include:

• A resource is insufficient to handle the load being placed upon it and may need to be upgraded or additional components may be required, eg: if the processor is a bottleneck, you can upgrade the processor or add an additional processor.

• If a resource has multiple instances, the system may not be balancing the workload evenly, and it may need to be spread more effectively.

• If a resource is malfunctioning it should be repaired or replaced.

• A specific program might have resources allocated inefficiently, in which case the program should be rewritten or an alternative application used.

• A resource might be configured improperly and be causing excessive resource usage, in which case it should be reconfigured.

The five main subsystems that should be monitored are the memory subsystem, the processor subsystem, the processes subsystem, the disk subsystem and the network subsystem. Each of these is examined in greater detail in the following sections.

Next: The Memory Subsystem