Chapter 3 MONITORING MICROSOFT WINDOWS SERVER 2003 potx

1 MONITORING MICROSOFT WINDOWS SERVER 2003 Chapter 3 Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2003 2 CHAPTER OVERVIEW • Use Event Viewer to monitor system logs. • Configure Task Manager to display performance data. • Use System Monitor to display real-time performance data. • Create counter logs and alerts. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2003 3 SERVER MONITORING PRACTICES Real-time monitoring • Uses tools that display a continuous stream of statistics about what the system is doing right now Logged monitoring • Enables administrators to observe trends that develop over longer periods of time than those observed in a typical real-time monitoring session Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2003 4 BASIC MONITORING SUBSYSTEMS • Processor • Disk • Memory • Network Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2003 5 ESTABLISH A BASELINE WHAT IS A BASELINE? WHAT IS THE PURPOSE? Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2003 6 USING EVENT VIEWER TO MONITOR ERROR Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2003 7 EVENT VIEWER LOGS Application • Information about specific programs running on the computer System • Events generated by components such as services and device drivers Security • Security-related events such as failed logons and attempts to access resources Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2003 8 UNDERSTANDING EVENT TYPES E E v v e e n n t t T T y y p p e e I I c c o o n n D D e e s s c c r r i i p p t t i i o o n n Error A significant problem, such as loss of data or loss of functionality Warning An event that might not be significant but might indicate a future problem Information An event that describes the successful operation of an application, driver, or service Success Audit An audited security access attempt that succeeds Failure Audit An audited security access attempt that fails Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2003 9 VIEWING EVENTS Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2003 10 EVENT LOG RETENTION SETTINGS [...]... value Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 22 USING SYSTEM MONITOR Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 23 MODIFYING THE GRAPH VIEW Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 24 HISTOGRAM VIEW Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 25 REPORT VIEW Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 26 ADDING COUNTERS Chapter 3: MONITORING MICROSOFT WINDOWS. .. MONITORING MICROSOFT WINDOWS SERVER 20 03 17 MONITORING PROCESSES Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 18 MONITORING PERFORMANCE LEVELS Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 19 MONITORING NETWORK ACTIVITY Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 20 MONITORING USERS Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 21 USING THE PERFORMANCE CONSOLE System Monitor • Displays.. .Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 11 USING FILTERS Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 12 FINDING SPECIFIC EVENTS Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 13 ACCESSING REMOTE EVENT LOGS • • Allows you to view event logs on another system Select Connect To Another Computer from the Action menu Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 14 ARCHIVING... applications Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 15 USING TASK MANAGER • Real-time monitoring tool • Displays information on: • • • • Processor and memory performance Applications and processes Network utilization Users connected to the system Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 16 WORKING WITH APPLICATIONS Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 17 MONITORING. .. be > 20% Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 33 MONITORING NETWORK PERFORMANCE Network Interface: Bytes Total/sec • Should be equal to baseline readings or higher Network Interface: Output Queue Length • Preferably 0, < 2 acceptable Server: Bytes Total/sec • Should be < 50 percent of the total bandwidth capacity Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 34 MONITORING SERVER. .. issues Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 29 WHAT ARE YOU DRINKING? WHAT IS A BOT TLENECK? Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 30 MONITORING PROCESSOR PERFORMANCE Processor: % Processor Time • Should be < 85% System: Processor Queue Length • Should be < 10 Server Work Queues: Queue Length • Should be < 4 Processor: Interrupts/sec • Varies depending on configuration Chapter. .. 20 03 34 MONITORING SERVER ROLES • • • • Different server roles place different demands on underlying hardware Different server roles require different components to be monitored Be aware of over monitoring SERVER ROLES Application Backup Database Domain controller File and Print Mail/Messaging Web Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 35 USING PERFORMANCE LOGS AND ALERTS Counter logs... MONITORING MICROSOFT WINDOWS SERVER 20 03 26 ADDING COUNTERS Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 27 CREATING AN EFFECTIVE DISPLAY • • • Limit the number of counters Modify the counter display properties Choose counters with comparable values Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 28 SAVING A SYSTEM MONITOR CONSOLE • • • Allows you to access commonly used counters more easily... Should always be less than the physical RAM in the computer Memory: Pool Non-Paged Bytes • Should be a stable number that does not grow without a corresponding growth in server activity Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 32 MONITORING DISK PERFORMANCE PhysicalDisk: Disk Bytes/sec • Should be equivalent to the levels established in the original baseline readings or higher PhysicalDisk: Avg... Should be < 85% System: Processor Queue Length • Should be < 10 Server Work Queues: Queue Length • Should be < 4 Processor: Interrupts/sec • Varies depending on configuration Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 31 MONITORING MEMORY PERFORMANCE Memory: Page Faults/Sec • Should be < 5 Memory: Pages/Sec • Should be < 20 Memory: Available Bytes • Should not fall below 5 percent of the system’s . system Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 16 WORKING WITH APPLICATIONS Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 17 MONITORING PROCESSES Chapter 3: MONITORING MICROSOFT WINDOWS. WINDOWS SERVER 20 03 18 MONITORING PERFORMANCE LEVELS Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 19 MONITORING NETWORK ACTIVITY Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 20 MONITORING. that fails Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 9 VIEWING EVENTS Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 20 03 10 EVENT LOG RETENTION SETTINGS Chapter 3: MONITORING MICROSOFT WINDOWS