A Guide for Getting Started in Windows NT/2000

Performance Monitoring

Object Name Counter Name Usage Notes

System Processor Queue Length Probable bottleneck when Processor Queue Length > 3 * # CPUs
% Total Processor Time As Processor % busy approaches 75-95%, the Processor Queue
Length will tend to elongate nonlinearly.
% Total User Time Among the Counters moved to _Total instance of Processor Object
in Win2K
% Total Privileged Time Operating system functions running in Ring 0 or kernel mode run in
Privileged mode.
% Total DPC Time Included in % Total Privileged Time. Deferred Procedure Calls
represent Interrupt-related processing that is performed after the CPU
is re-enabled for interrupts. DPCs are scheduled to run at higher
priority than all kernel or user threads. See Chapter 3.
% Total Interrupt Time High priority Interrupt Service Routines perform device-dependent
processing while lower priority device interrupts are masked.

System Up Time Used to track system availability.

Context Switches/sec INT instructions which trap to Ring 0 Kernel mode from Ring 3
count as context switches in Intel architecture. Unfortunately, context
switches which flush Processor cache TLBs due to reloading the TSS
cannot be counted separately.
Memory Available Bytes Process Working Set growth becomes constrained when Available
Bytes < 4 MB (approximately); the system is under severe stress
when Available Bytes < 1 MB.
Pool Nonpaged Bytes The System's nonpageable (fixed) memory.

Pool Paged Resident Bytes The System's pageable memory that is currently resident.
System Code Resident Bytes
System Driver Resident Total system resident bytes = Pool Nonpaged Bytes + Pool Paged
Bytes Resident Bytes + System Code Resident Bytes + System Driver
Resident Bytes + System Cache Resident Bytes.
System Cache Resident The current amount of RAM used for the file cache; limited to 512
Bytes MB in NT 3-4, about 960 MB RAM maximum in Win2K.

Page Faults/sec Can be a grossly misleading number. Page Faults/sec = "soft"

Transition Faults + application file Cache Faults + hard page
faults.
Page Reads/sec Hard page fault rate!

Page Writes/sec Updated "dirty" pages must be flushed to disk before they can be
reused by a different application.
Object Name Counter Name Usage Notes
Committed Bytes Represents virtual memory pages backed in either RAM or
secondary storage (paging files). Calculate a virtual:real memory
contention index = Committed Bytes / Total RAM. Consider adding
RAM when this ratio starts to approach 2:1.
Commit Limit Maximum number of virtual memory pages that can be allocated
without extending the paging file(s).

% Committed Bytes in Use Committed Bytes / Commit Limit. Consider adding RAM when
consistently > 70% on a Server. On a Workstation, please close some
applications.
Cache Bytes Actually, the System address space working set, but includes the file
cache.
Transition Faults/sec "Soft" page faults resolved without having to access the disk.
Interesting number to track, but there is nothing you can do about the
Transition Fault rate. Consider them a by-product of the NT page
stealing algorithm, discussed in Chapter 6.
Cache Faults/sec Normal application file I/O operations are diverted to use the paging
subsystem.
Demand Zero Faults/sec The rate at which applications require brand new pages.
Write Copies/sec Private Copy on Write pages from shared DLLs.
Pages Input/sec Calculate the bulk paging rate: Pages Input/sec / Page Reads/sec.
Pages Output/sec Try to limit Pages Input/sec + Pages Output/sec to 10-20% of total
disk bandwidth, if possible. Disk bandwidth absorbed for paging
operations is unavailable for application processes.
Pool Paged Bytes Calculate a virtual:real memory contention index = Pool Paged
Resident Bytes / Pool Paged Bytes. Compare to Page Reads/sec to
anticipate real memory bottlenecks.
Cache Copy Reads/sec Inefficient Copy interface used by applications not specifically
designed for NT.

Copy Read Hits % Target > 80% for efficient application file processing. However, if
application files resist caching, there is very little you can do about it.
Lazy Write Flushes/sec The Lazy Write algorithm used to cache disk file updates in memory
means that you should never leave a critical Windows NT/2000
server unprotected without an Uninterruptible Power System (UPS).
Lazy Write Pages/sec
Data Maps/sec Cache mapping interface used primarily by NTFS and Redirector.
Data Map Hits % Target > 90% for efficient NTFS processing.

Data Map Pins/sec

Pin Reads/sec
Pin Read Hits % Target > 90% for efficient NTFS file metadata update processing.
Data Flushes/sec The rate at which NTFS requests pages containing file metadata be
written to disk.
Object Name Counter Name Usage Notes
Data Flush Pages/sec
MDL Reads/sec Efficient cache interface used by networking applications like (file)
Server and IIS.
MDL Read Hits % Target > 90% for efficient IIS static html, gif, and jpeg file
processing.
Read Aheads/sec Sequential prefetching triggered by a detected pattern of forward
sequential access. Disk prefetching justifies regular use of a disk
defragmenter utility (built-in in Win2K).
Fast Reads/sec NTFS supports Fast Read interface that bypasses the IO Manager on
Read hits.
Process % Processor Time per Process CPU usage; capped at 100% by default.
Page Faults/sec Indirect indicator of per Process I/O activity in NT 4.0; but includes
"soft" transition fault activity.
IO Data Bytes/sec new in Win2K. Tracks logical requests, so do not expect to match
thiese new per Process IO Counters with disk activity measurements.
IO Data Operations/sec new in Win2K.
% User Time
% Privileged Time

Virtual Bytes per Process contribution to Committed Bytes. Cautionary note:

shared DLL virtual bytes counted as part of the Virtual Bytes of
each associated Process.
Working Set Pages from resident shared DLLs counted as part of the Working
Set of each associated Process.
Elapsed Time Used to track application availability.
Thread % Processor Time
Thread State State = 1 means thread is Ready and Waiting in the system's
Processor dispatching queue.
Thread Wait Reason Most waiting threads are Waiting for a Component of the NT
Executive: Wait Sate Reason Code = 7.
Logical Disk, Avg. Disk sec/Read Measured response time of disk Read requests.
Physical Disk
Avg. Disk sec/Write Measured response time of disk Write requests.
Avg. Disk sec/Transfer Overall measured average response time of all disk requests.
Disk Reads/sec Poor response time only matters if disks are active. SCSI disks with
on-board cache buffers paradoxically tend to have faster Read
service times as I/O rates increase.
Disk Writes/sec
Disk Transfers/sec
Avg. Disk Queue Length Calculated average number of active disk requests = Disk
Transfers/sec * Avg. Disk sec/Transfer.
Object Name Counter Name
Avg. Disk Read Queue
Length
Avg. Disk Write Queue
Length
Current Disk Queue Length Instantaneous count of queued I/O requests. Systematically
undersampled on a uniprocessor, but a good number to compare to
the calculated value for the Avg. Disk Queue Length.
% Disk Read Time
% Disk Write Time
% Idle Time
Disk Read Bytes/sec
Disk Write Bytes/sec
Avg. Disk Bytes/Read
Avg. Disk Bytes/Write
Processor % Processor Time
% User Time
% Privileged Time
Interrupts/sec
% Interrupt Time
Network Total frames received/second
Segment
Total bytes received/second
Broadcast frames
received/second
Multicast frames
received/second
% Network utilization
Usage Notes
Calculated average number of active disk requests = Disk Reads/sec
* Avg. Disk sec/Read.
Calculated average number of active disk requests = Disk Writes/sec
* Avg. Disk sec/Write.
Misleading indicator of Disk Busy, capped at 100%. Calculated as
the product of Disk Reads/sec * Avg. Disk sec/Read. Same as Avg.
Disk sec/Read, except offset by two decimal points.
Misleading indicator of Disk Busy, capped at 100%. Calculated as
the product of Disk Writes/sec * Avg. Disk sec/Write. Same as
Avg. Disk sec/Write, except offset by two decimal points.
New in Win2K.
Used to calculate: Disk utilization = 100 - % Idle Time.
Disk service time = Disk utilization / Disk Transfers/sec.
Disk Queue time = Avg. Disk sec/Transfer - Disk service time
Disk read throughput, normally limited to about 50% of SCSI bus
capacity.
Disk write throughput, normally limited to about 50% of SCSI bus
capacity.
Calculated average block size = Disk Read Bytes/sec / Disk
Reads/sec.
Calculated average block size = Disk Write Bytes/sec / Disk
Writes/sec.
With Symmetric Multiprocessing, individual processor statistics tend
not to vary significantly.
Watch for sudden increases; could be a malfunctioning device or
device driver.
Shared Ethernet network segments tend to saturate at > 30-50%
Object Name Counter Name Usage Notes
busy; switched segments can run at close to 90% utilization without
degradation.
For file and print servers:
Server Bytes Received/sec
Bytes Transmitted/sec
Server Sessions
Work Item Shortages Increase MaxWorkItems if Work Item Shortages > 0, unless
Processor % Processor Time is also > 80%
Context Blocks Queued/sec The rate of individual file server requests sent by networking clients
Print Queue Jobs New performance Object in Windows 2000. Current number of jobs
in a print queue.
Bytes Printed/sec
Total Jobs Printed
Total Pages Printed
For network clients using NT Server’s file and print sharing services
Redirector Bytes Received/sec
Bytes Transmitted/sec
Read Bytes Network/sec Measures the network traffic from networked file read requests.
Write Bytes Network/sec Measures the network traffic from networked file write requests.
Current Commands Counts the number of commands queued for network file processing.
Should never be more than one per NIC.
File Data Operations/ sec The total rate of individual networked file requests sent by this client.
For machines using Microsoft’s IIS Web server

Internet File Cache Hits % Caching static html files in memory saves on disk I/O and improves
Information performance.
Services Global
Current Files Cached
Current File Cache Memory
Usage
BLOB Cache Hits % Caching Binary Large Objects (BLOBs, gifs and jpegs associated
with html requests) in memory saves on disk I/O and improves
performance.
Current BLOBs Cached

Total Blocked Async I/O These represent requests blocked by the bandwidth throttling feature.
Requests See Chapter 11.
Web Service Total Method Requests/sec The http Method defines the type of http request. This is the total
Web service request rate per Web site.
Get Requests/sec Get is the http Method used to request static html pages and
embedded gig and jpeg requests.
CGI Requests/sec CGI scripts are involved in many Forms processing applications.
ISAPI Extension ISAPI requests predate Microsoft’s Active Server Pages server host
Object Name Counter Name Usage Notes
Requests/sec scripting facility to support dynamic html pages.
Current Connections
Current CGI Requests
Current ISAPI Extension
Requests
Service Uptime Uptime for each Web site instance for tracking availability.
Active Server Request Execution Time Execution time for the last ASP request
Pages
Request Queue Time Queue time delay for the last ASP request.
Requests Executing
Requests Queued

Requests/sec Calculate average response time = (Requests Executing + Requests

Queued) / Requests/sec (from Little’s Law). Compare this value to
the reported Request Execution Time + Request Queue Time,
which reports the execution and queue time of the last completed
ASP request only.
Transactions/sec

Transactions/pending