Windows Performance Management Analysis
Speaking of performance management in the Windows environment, many people think of may be ubiquitous Performance Monitor tools. As early as the Windows NT era, Performance Monitor is the main tool for obtaining performance information. Of course, the WINDOWS Management Instrument (Windows Management Instrument) also belongs to the common tools, which can not only provide performance data, but also provide others. Performance related management information. This article introduces some techniques that give full play to these classic tools, and introduce new tools for Windows XP to explore how to use them to evaluate the performance of the system. First, what is performance management?
For many administrators, Windows performance management does not focus on the "Perform Monitor program," the Performance Monitor program, then checks the CPU utilization, busy status, memory pressure, and usually only You will be checked when performing performance issues, such as server response suddenly slowing, or users cannot access servers. This performance management method is completely remedial, only to the role of firefighters, due to lack of detailed, clear prior assessment, planning, and countless strategies. To achieve effective performance management, you must master the performance of your system before you have problems.
Only the effective performance management strategy is taken in advance to fully grasp the performance characteristics of the system. On this basis, it is estimated that performance issues and specific performance of the problem can be estimated. Pre-collected performance data can also be used to plan future computing power requirements, for example, there is an IIS web server, when the number of concurrent users is 200, the utilization rate of the CPU is 60%, accordingly, it can be inferred to when the system load reaches the limit And the number of concurrent users that can support when the load limit is reached. In addition, according to the growth of the website, it is also possible to estimate when to add hardware devices.
The overall performance of the system is determined by many factors, such as CPU utilization, CPU queue length (ie, how many tasks are waiting for CPU services), and the disk is busy (ie, how much time for the disk drive for response requests), available The use of physical memory, network interface, and so on, the table has summarized the most common performance counters.
Table 1: Important Performance Counter Performance Object Counters Information Memory Available Bytes Available Bytes Displays the current amount of physical memory that is currently idle. When this value is changed, Windows starts to frequently call disk page files frequently. If this value is small, for example, less than 5 MB, the system will consume most of the time on the operation page file. Memory% committed bytes in us% committed bytes in us is Memory: committed bytes and memory: commit limit ratio between COMMIT LIMIT. (Committed Memory means if the physical memory in use in the paging file is required when you need to write a disk. Commit limit is determined by the size of the paging file. If the paging file is expanded, the proportion will be reduced) . This counter only displays the current percentage; rather than an average. Memory Page Faults / Sec Page Faults / Sec to refer to the overall rate of processor handling error pages. Use the error pages / second to calculate. When the processor requests a page error that occurs when code or data in its work set (in physical memory). This counter includes hard errors (those who need disk access) and soft error (found in other parts of physical memory). Many processors can continue to operate with a large amount of soft errors. However, hard errors can result in significant delays. This counter displays the difference between the difference between the values observed in the upper two instances. Network interface Bytes Total / sec Bytes Total / sec is the rate of sending and receiving bytes, including frame characters. Network interface packets / sec packets / sec is the rate of sending and receiving a packet. Physical Disk% Busy Time% Busy Time refers to the percentage of the time that the disk drive is busy providing a service for a service to a service. Physical Disk Avg. Disk Queue Length Refers to the average of the read and write requests (for the selected disk in instance intervals). Physical Disk Current Disk Queue Length Current Disk Queue Length refers to the number of requests that are not completed on disk when collecting operational data. It includes a request that provides services in its service during snapshot memory. This is an instant length rather than a sense of a certain interval. A multi-spindle disk device can have multiple request operations at a time, but other simultaneous requests are waiting. This counter may reflect a temporary high or low column length, but if there is a continuous load in the disk drive, it may always be high. The request time is minus the spindle proportional to the length of the track. This difference should be less than 2 to maintain good performance. Processor% Processor Time% Processor Time refers to a percentage of a processor performs a non-idle thread time. This counter is designed to be used as a main indicator for processor activity. It measures the processor for performing idle processing threads in each example interval, and subtracts this worthwhile. (Each processor has an idle thread that consumes during run without other threads). It can be regarded as an example interval for use in a percentage of useful work. Processor% User Time% User Time refers to a percentage of non-idle processor time for user mode (user mode is a limited processing mode for application, environmental division system, and integer system design. Another mode is privileged, it is Designed for operating system components and allow you to access hardware and all memory. The operating system converts the application thread into privileged mode to access the operating system service). This count value is displayed as part of the instance time when it is averaged. Server Work Queues Queue Length Queue Length refers to the length of the CPU current server job queue. The queue length exceeds four may indicate the processor to block. This value is an instant count, not a time average.
System Processor Queue Length Processor Queue Length refers to the number of threads in the process of handling the queue. Even if there is a plurality of processor's computer, there will be a single queue. Unlike disk counters, this counter only counts the ready thread without counting threads in the run. If there are always more than two threads in the processor queue usually represent processor clogs. This counter only shows the value of the previous observation; rather than an average. The TCP Segments Retransmitted / Sec Segments retransmitted / sec referred to the rate, that is, the transmitted block contains one or more previously transmitted bytes. Second, custom performance monitor
In Windows 2K / XP, Performance Monitor is still the most commonly used performance management tool. Of course, the new version of the tool has improved, adding a lot of functions. In WIN 2K, performance monitors are implemented in the form of a management console (MMC) unit. To start WIN 2K / XP performance monitor, you can see the interface similar to Figure one.
Figure one
In WIN XP, performance monitor is loaded with three counters by default: Pages / Sec, AVG. Disk Queue Length,% Processor Time. These three counters cannot be deleted directly, but they have been reducing the monitor startup speed. If you do not load any counter when the monitor is started, you first want to clear the read-only attribute of the Perfmon.msc file in /% systemroot% / system32 directory: Go to the command window, go to the System32 directory, execute the command Attrib R. Msc. Then restart the counter, select a counter, click on the Black "X" button on the toolbar to delete a counter. Select menu "File" → "Save" to save the changed management console to disk. If you want to mark the management console into read-only, just perform Attrib R Perfmon.msc on the command line.
In NT 4.0, the Performance Monitor contains a real-time chart, and there is also a log and alarm function, but in Win 2K and XP, these functions are separated. In WIN 2K / XP, real-time performance charts become "system monitor", under system monitors are logs and alarm tools. System Monitor can be seen as a pure real-time performance data check tool, can only be seen, can not be saved, click the " " button on the toolbar to add a new performance counter. Performance logs and alarm tools have functions of operating history.
If you want to create a management console that only the system monitor, without a performance log, alarm tool, you can follow the steps: Execute the MMC command, open a blank MMC window, select the menu "→" Add / Delete Management unit, click "Add", select "ActiveX Control", click "Add", select System Monitor Control in the wizard, confirm it.
Third, performance logs and alarm tools
System Monitor can only simply view real-time performance data, and if you need long, persistent performance data, you must use performance logs and alert tools. Performance Log Tools can focus on a log file to record performance data from local or remote, which can be viewed or otherwise with other tools with a system monitor. Extend the "Performance Logs and Alert" nodes in the console, you can see the three branches: Counter logs, trace logs, alerts. The function of the alarm tool is simple, that is, when a counter performance data reaches the specified value, perform a certain action, such as sending email or sending messages with the NET Send command. Below we will focus on log tools.
To illustrate how to use the counter log, we have to create a log session. Right-click the "Counter Log" node, select New Log Settings, specify the name of the log setting, click "OK", and the Dialog box appears, where set the counter to be recorded in the log. Figure II
The default save path for log files is a c: / perflogs directory, you can modify the "log file" page of the dialog, but first set the objects and counters to be recorded to go to the Log File page. Click the "Add Object" button to add all counters of a monitor object to log record, or click the "Add Counter" button to join a single counter. Regardless of which addition option is selected, monitoring the target (object or counter) can be local or a remote machine.
If you want to collect performance data for a long time, it is best to adjust the sampling interval - especially, if you want to monitor a lot of counters, and from different machines, if the sampling interval is set too small, the log file will become very big. . Sampling once every 15 minutes, trial run, see how much log file is getting better, and then make a corresponding adjustment.
If you want to connect the remote machine, you can provide the user name of the logged in the remote machine in the "Run Mode" input box.
Collecting performance monitoring data requires certain permissions, HKEY_LOCAL_MACHINE / SOFTWARE / Microsoft / Windows NT / CURRENTVERSION / PERFLIB registered sub-key controls access to performance monitoring data, performance monitoring data is currently streaming to system monitoring through this registered subscript Tool of. Use the right click to click the registry key, select the menu "Permissions", as shown in Figure 3, adjust the permission assignment here to adjust the user who has access to performance data.
Figure three
After setting the objects and counters to be monitored, you can adjust the log file in the Log File page, set the startup and stop the log in the Plan page. If set to manually start, the startup method is to right-click the log session in the MMC window and select "Start".
In the Log File page, as shown in Figure 4, the Performance Counter log except the default binary.blg format, can be saved as other formats, such as comma-separated text files (ie, CSV files), or even save To SQL Server Table - This is the functionality of Windows Server 2003 and XP. If SQL Server is selected, you have to specify a SQL Server data source and a table that saves data. Although it is troublesome, if you want to collect a lot of performance data and analyze, SQL Server is still a good choice.
Figure four
Once the log is started, you can see a 65 kb log file in the log directory. Every time you turn off and restart the log, you will generate a new log file, and the serial number in the file name is increased. WIN XP and 2K support a very practical feature, even when performance monitor tools are not running, you can continue to write performance data to logs. If it is NT 4.0, you need to install the NT 4.0 Resource Kit's Datalog service to use this unattended log logging. Win 2K and XP itself have Performance Logs and alerts service, which is automatically launched when the log session is started, and the log session is automatically stopped.
Another improvement in the Win 2K / XP performance log is to save the log session function. In NT 4.0, if you want to reuse a set of selected performance objects and counters for a log session, you must recreate the workbench file for each server that you want to monitor. If you want to configure a set of logs, you are more The server is running locally, and the cumbersome configuration operation must be repeated. However, in WIN 2K / XP, all profiles (including logs and alerts) are saved in the form of HTML files, which is easy to modify and reuse. To save a log session configuration, just right click on the session in the MMC window, then select the menu "to save the settings as". Fourth, command line tool
XP provides a new tool called Logman, which can not only start and stop log sessions on the command line, but also create new log sessions from the command line.
For example, the first logman command below has created an IISLogGing session, and the log file is saved in the default c: /perflogs/iislogging.blg, the log file is added to the Process /% Processor Time counter on the INetInfo.exe process on the local server, collect performance data. The time interval is 15 minutes. The second command launched an IISLogging log session. After running these commands, if the MMC Performance Monitoring tool is started, you can see that the log session that has just been created in the counter log.
Logman Create Counter Iislogging -c "/ Process (inetinfo) /% processor time" -si 15: 00Logman Start Iislogging
Use the Logman's -s option to start the log on the remote machine, use the form class such as "-S // ServerName". When using this option, the logmn launched log will run on the remote server instead of the local machine to execute the logman command.
Five, WMIC
The WMIC is the command line tool for the Windows management specification, and the WMIC environment can be activated on the command to perform WMIC. When the WMIC command was performed for the first time, WMIC first installed himself to the WMI namespace. Although Microsoft launched WMIC's intention to simplify WMI, but WMIC's command line syntax is more complicated. WMIC relies on alias to describe WMI classes that are often accessible, for example, WMIC alias PageFile is equivalent to WMI query Select * from win32_pagefileusage, if you enter the PageFile command at the WMIC prompt, WMIC will display the current page file usage.
Unfortunately, WMIC does not provide an alias for WMI-based performance monitoring data, so you must query performance monitor data, you must directly call the corresponding WMI class. For example, if you want to view the current physical memory usage of the server, you can perform Path Win32_PerFformORMATTEDDATA_PERFOS_MEMORY on the WMIC command line, which requires WMIC to return data for WMI WIN32_PERFFORMATTEDATA_PERFOS_MEMORY, and the output contains each attribute that specifies the WMI memory object. If you just want to view the Available Bytes property, you can change the command to Path Win32_PerFformattedData_Perfos_Memory Get AvailableBytes.
In addition, the WMIC command can also be executed directly from the Windows command line, for example, to view the Available Bytes, you can perform the WMIC PATH WIN32_PERFFORMATTEDATA_PERFOS_MEMORY GET AVAILABYTES command, if you want to return multiple attribute values, simply list the individual properties, with a comma partition For example, "AvailableBytes, Availablembytes, Cachebytes". So how do you get the WMI class name of various performance monitor counters? The best way is to use WMI Tools. WMI Tools is a free tool for Microsoft, which can be downloaded from http://www.microsoft.com/downloads/details.aspx?displaylang=en&familyid=6430f853-1120-48db-8cc5-f2abdc3ed314, as shown in Figure 5, it The name, attribute, method of each class can be clearly displayed.
Figure 5
All in all, in a multi-layer application environment, if you want to find the specific location of the performance bottleneck, performance monitoring data is undoubtedly a valuable basis, as long as you make full use of performance tools provided by Win 2K / XP, we can construct a functional management system .
