[Fuller08] Windows Performance Counters Monitor

Windows Performance Counters Monitor
TheWindows Performance Counters monitor collects data from a Windowsoperating system or application performance counter and reacts to thatdata. There are two key types of Windows Performance Counters monitors,which we discuss in the following sections:
Static Thresholds
Self-Tuning Thresholds
The Static Thresholds Monitor
TheStatic Thresholds monitor is the simplest monitor type. It is used tomonitor for changes in a static threshold, such as exceeding athreshold of 90% CPU utilization. With that said, you can still createfive distinct types of Static Threshold monitors for additionalgranularity in the monitoring process:
Average Threshold
Consecutive Values over Threshold
Delta Threshold
Simple Threshold
Double Threshold
The first four of these are of the Single Threshold type.
Average Threshold
TheAverage Threshold monitor takes the average value of a performancecounter over a certain number of samples. The state changes if theaverage is above the specified threshold.
Thismonitor is particularly useful when you need to receive an alert when aperformance counter is running near to or over a threshold for adefined period, rather than every time the performance exceeds athreshold.
displays the average threshold configuration screen.
Figure 14.19. Specifying threshold settings for the average threshold configuration screen.
[View full size image]

Consecutive Values over Threshold
Usethe Consecutive Values over Threshold monitor when you need to reflectthe state of a computer that consistently and repeatedly exceeds athreshold (so monitoring the average threshold is not appropriate).This capability is useful for systems that may occasionally have spikeson performance counters that do not indicate a problem, although it isan issue if a spike does not return to normal.
We have configured this monitor using the settings shown in .We check for a value greater than or equal to 20 (the threshold), butcollect four samples for comparison before defining it as a concern.
Figure 14.20. Specifying the threshold to compare in the Threshold Comparison Settings screen.
[View full size image]

Delta Threshold
ADelta Threshold monitor does not measure the actual value of aperformance counter but rather the change in value. For example, if youwere measuring a change of 50, a performance counter change from 75 to20 would be of interest, whereas a change from 75 to 30 would not. Youcan also configure the monitor to measure for a percentage drop ratherthan a physical value change.
shows the configuration screen for this monitor.
Figure 14.21. Configuring settings for a change in threshold value at the Delta threshold screen.
[View full size image]

Simple Threshold
TheSimple Threshold monitor does exactly what is says. It simply monitorsa performance counter and changes the status of the monitor when thethreshold is exceeded. This is the most basic and easiest to configurePerformance Threshold monitor in OpsMgr 2007.
displays the Threshold Value screen for configuring the Simple Threshold monitor.
Figure 14.22. Simple Threshold monitor configuration screen.
[View full size image]

Double Threshold
OpsMgrallows you to configure a double threshold where a single monitorchecks both a high and low threshold. For example, you can configurethe health state of the monitor to be affected if a performance counterfalls below a “low” value or exceeds a “high” value.
Self-Tuning Thresholds
TheMOM 2000 and MOM 2005 products were somewhat static, reacting toperformance issues only if the particular counters deviated outside ofa predefined value. Although this method of monitoring is effective, ithas its drawbacks. The main issue is the fact that not all serversperform equally, even servers that fulfill the same role (Exchangeservers being a good example).
Whenservers perform differently, a performance value appropriate for oneserver may not be applicable for another system, making it necessary tocreate separate performance thresholds for different servers. This canbe very time consuming and difficult to manage in large and complexenvironments, especially when you consider previous versions of MOM didnot have the luxury of sealed management packs! It was not uncommon formanagement packs to become very messy with changes often accidentallyoverwritten, especially when the vendor released a new version of itsmanagement pack.
Withself-tuning thresholds, this is no longer the case. Self-tuningthresholds are a completely new feature in Operations Manager. Usingself-tuning thresholds enables dynamic monitoring of performancecounters, where OpsMgr adapts the thresholds as appropriate. As anexample, if you monitor an Active Directory Domain Controller (DC) forCPU utilization using a self-tuning threshold, the threshold will“learn,” noticing repeating CPU fluctuations on the server, such as theextra demand placed when users log in at the same time on a Mondaymorning. The monitor will then ignore these CPU fluctuations, and thestate of the monitor will only change if the fluctuations aresufficient to move outside of the baseline that the monitor has learned.
Aself-tuning threshold is also particularly useful to simply collect abaseline of a particular performance counter. When you view theassociated performance graph, you can overlay the baseline, which givesyou an overview of the trend of the counter in addition to the exactvalues.
Baselines
OpsMgr2007 uses baselines to continually monitor and collect the usualrunning values for a performance counter. This allows it toautomatically set and adjust alert thresholds to limit the amount ofextraneous alerts that appear.
Inaddition, baselines are available in performance graphs to show thetrend of a particular performance counter. To access a baseline from aperformance view graph (where available), simply generate the graph,right-click, and select Show Baseline.
Theprocess for configuring a self-tuning threshold is similar to that ofconfiguring a normal threshold. The only real difference is inconfiguring the logic for the self-tuning threshold to “learn.” Youdefine this using the wizard when you initially create the thresholdmonitor, or by creating an override or editing the InnerSensitivity andOuterSensitivity values directly in the monitor.
Changing sensitivity using the wizard is straightforward. Perform the following steps:
1.
After you select the performance counter you will use, the Baselining Configuration screen appears, shown in .
Figure 14.23. Self-tuning threshold Baselining Configuration screen.
[View full size image]

2.
From this screen, you can configure your business cycle, meaning what you consider a unit of time to monitor. A business cycle is defined in terms of days or weeks; the default is 1 week.
The screen also allows you to configure how many business cycles should pass before generating alerts. This is useful because the monitor is able to learn efficiently before it starts generating alerts for exceeded thresholds.
3.
You can also specify how sensitive (or insensitive) the threshold monitor will be. Moving the sensitivity slider automatically adjusts the sensitivity, or you can configure it in more detail by clicking the Advanced button. Selecting Advanced displays the screen shown in .
Figure 14.24. The Baselining Advanced threshold sensitivity configuration screen.

4.
From the Baselining Advanced screen, you can configure the two settings for the sensitivity manually: the learning rate and time sensitivity settings. The learning rate is the rate at which the baseline is adjusted based on frequency of occurrences, and time sensitivity is the rate at which the baseline is adjusted based on a time interval.
There are a number of different self-tuning thresholds:
2-state Above
The 2-state Above baseline is used to generate a status change and an alert when the performance counter strays above the learned baseline. When it is below the baseline, the status of the monitor is normal.
2-state Baselining
This monitor is very much the same as the 2-state Above threshold monitor except that the baseline information is recorded for use in performance graphs.
2-state Below
The 2-state Below baseline is the opposite of the 2-state Above baseline. If the counter strays below the learned baseline, the status is updated and an alert generated.
3-state Baselining
The 3-state Baselining monitor collects the baselining information. It also allows the monitor to update the health state when the performance deviates both above and below the learned baseline.
Issues with Self-Tuning Thresholds
Despitethe benefits of self-tuning thresholds, there are still drawbacks tousing this new technology. Currently, self-tuning thresholds are unableto take into account periods of prolonged inactivity, such as weekendsand holidays. As an example, OpsMgr may calculate a baseline for aserver during the month of November. The baseline is automaticallycalculated over the period of a month, and is thus assumed relativelyaccurate.
However,during December many businesses close or run reduced operations overthe Christmas period, which negatively affects the baseline. Themonitored servers are less heavily utilized during the holiday period,and the baseline adjusts to reflect this. When everyone returns to workthe server has a more typical load, and its new baseline is no longeraccurate. When the server now becomes busy, it will have unnecessaryalerts generated for performance counters outside the baseline, becauseOpsMgr still thinks the server should not have that much activity.
Currently,the only way to work around this issue is by temporarily disabling thebaseline rule using an override for the periods of extended inactivity,or putting the machine or class object the performance counter appliesto in maintenance mode. However, we do not recommend the latter methodbecause it results in the computer or class object no longer beingmonitored.

Create Bookmark (Key: b)Create Bookmark
Create Note or Tag (Key: t)Create Note or Tag
Download (Key: d)Download
PrintPrint
Html View (Key: h)Html View
Zoom Out (Key: -)Zoom Out
Zoom In (Key: +)Zoom In
Toggle to Full Screen (Key: f)
Previous (Key: p)Previous
Next (Key: n)Next
Related Content

Monitoring disk counters
From: IBM TotalStorage DS8000 Series: Performance Monitoring and Tuning
Using System Monitor
From: Microsoft® Windows® Small Business Server 2003 Administrator's Companion
Using System Monitor
From: Microsoft® Windows Server 2003: Administrator’s Companion
Comprehensive System Monitoring
From: Microsoft® Windows Server™ 2003 Inside Out
Adding Objects to the Monitor
From: Sams Teach Yourself Windows® Server 2008 in 24 Hours
Monitoring System Performance
From: Microsoft® Windows Server 2003 Unleashed, R2 Edition
Selecting and Understanding Counters
From: Sams Teach Yourself Windows® Server 2008 in 24 Hours
Useful Processor Counters
From: Sams Teach Yourself Windows® Server 2008 in 24 Hours
Utilizing WCF Performance Counters
From: Pro WCF: Practical Microsoft SOA Implementation
Using Windows System Monitor with Configuration Manager
From: Microsoft® System Center Configuration Manager 2007 Administrator's Companion