Performance data can help you understand your workload and the effect it has on
your system’s resources. You can observe changes and trends over time, which
will help you plan for future upgrades. Some counters in Performance Monitor
will help you diagnose problems and target components or processes for

Using Performance Monitor

To start Performance Monitor, go to Start
| Administrative Tools | Performance. Windows Server 2003 uses the
Microsoft Management Console (MMC) to administer Performance Monitor, as shown
in Figure A, so the screen has a
different look than it does in Windows NT. You’ll also notice a slight difference
from the Performance Monitor in Windows 2000.

Figure A

Windows Server 2003’s Performance Monitor runs under the Microsoft
Management Console.

You should configure the performance logs and alerts to
report data for the counters at regular intervals. The logs should be retained
over an extended period of time. A database can use this data to perform

To get a good snapshot of your server’s performance, you
should take the following actions:

  • Disable
    any screensaver program that is running on the server.
  • Stop
    any services that are not essential.
  • Increase
    the size of the paging file to the total amount of RAM plus 100 MB.

Performance Monitor itself can create unnecessary overhead.
You should not run Performance Monitor in Graph view all of the time.
Monitoring too many counters at once or sampling at intervals less than three
seconds apart can degrade system performance. It’s also a good idea to log your
information to a disk other than the one you’re monitoring.

Performance objects and counters

Windows Server 2003 gathers performance data from components
in your computer. A performance object is usually named for the component that
generates the data. Some of the objects you will typically monitor are cache,
memory, paging file, process, processor, server, and system. Some software
applications, such as SQL Server, add additional objects that can be monitored.

Each object has multiple counters that represent data on
specific aspects of a system. For information about a specific counter, click
Explain in the Add Counters dialog box. While Performance Monitor has many
different counters that you can monitor, you should monitor the activity of the
following components first:

  • Memory
  • Processors
  • Disk
  • Network

While in the Performance Monitor application, click the plus
(+) sign in the right-hand pane to add a performance counter. When you do, you’ll
see the screen shown in Figure B.

Figure B

You can easily add performance counters.

At a minimum, you should start monitoring the following


  • Available
  • Cache
  • Pages/sec
  • Page Reads/sec


  • %
    Processor Time (all instances)
  • Interrupts/sec


  • Physical
    Disk\Avg. Disk Queue Length (all instances)
  • Physical
    Disk\Disk Reads/sec
  • Physical
    Disk\Disk Writes/sec


  • Network
    Segment\% Net Utilization
  • Network
    Interface\Bytes Total/sec
  • Network
  • Server\Bytes


  • Paging
    File\% Usage Object (all instances)
  • Cache\Data
    Map Hits %
  • Server\System\Processor
    Queue Length (all instances)

Some network counters require that you install the Network
Monitor driver for Network Monitor in order to use them. Some of the counters
listed here may not be available on your computer because a necessary service
has not been installed or you have not activated the counters. For instance, in
order to capture logical-disk counter data, you must type diskperf –yv at the command prompt, which allows the disk
performance statistics driver to report data for logical drives. After you’ve
selected your counters and start tracking events, you can watch Performance
Monitor track the counters and draw a graph representing them.

Establishing a baseline

A baseline is a performance level that you determine to be
acceptable. You should monitor your server over a period of time during normal
work conditions to begin creating your baseline. Once you gather the data, you
can analyze it to determine where there might be problems or bottlenecks.
Microsoft has outlined some recommended baselines for different counters. The
ones below will give you a good start for creating a baseline that meets your

  • Disk—Physical Disk\% Disk Time:
  • Disk—Physical Disk\Disk Reads/sec,
    Physical Disk\Disk Writes/sec:
    Depends on manufacturer’s
    specifications (Check the specified transfer rate for your disks to verify
    that this rate doesn’t exceed the specifications. In general, Ultra Wide
    SCSI disks can handle 50 I/O operations per second.)
  • Disk—Physical Disk\Current Disk Queue
    Number of spindles plus 2 (This is an instantaneous counter;
    observe its value over several intervals. For an average over time, use Physical
    Disk\Avg. Disk Queue Length.)
  • Memory—Memory\Available Bytes:
    Less than 4 MB (Research memory usage and add memory if needed.)
  • Memory—Memory\Pages/sec: 20
    (Research the paging activity.)
  • Network—Network Segment\% Net
    Depends on the type of network (You must determine the
    threshold based on the type of network you are running. For Ethernet
    networks, 30% is the recommended threshold.)
  • Paging File—Paging File\% Usage:
    99% (Review this value in conjunction with Available Bytes and Pages/sec
    to understand paging activity on your computer.)
  • Processor—Processor\% Processor Time:
    85% (Find the process that is using a high percentage of processor time.
    Upgrade to a faster processor or install an additional processor.)
  • Processor—Processor\Interrupts/sec:
    Depends on the processor (A dramatic increase in this counter value
    without a corresponding increase in system activity indicates a hardware
    problem. Identify the network adapter that’s causing the interrupts.)
  • Server—Server\Bytes Total/sec: If
    the sum of Bytes Total/sec for all servers is roughly equal to the maximum
    transfer rates of your network, you may need to segment the network.
  • Server—Server\Pool Paged Peak:
    Amount of physical RAM (This value is an indicator of the maximum paging
    file size and the amount of physical memory.)
  • Server—Server Work Queues\Queue
    4 (If the value reaches this threshold, there may be a
    processor bottleneck. This is an instantaneous counter; observe its value
    over several intervals.)
  • Multiple Processors—System\Processor
    Queue Length:
    2 (This is also an instantaneous counter; observe its
    value over several intervals.)

Addressing problems identified by Performance Monitor

Performance Monitor can help you identify performance
problems and allow you to analyze the data. If your servers’ resources are
insufficient, you may need to upgrade components such as RAM, hard disks,
paging files, etc. It may also be necessary to balance workloads among
resources. Some programs monopolize a resource and won’t allow other programs
to use it. Those programs may need to be reconfigured or rewritten. The premier
problem that your server will experience is a lack of memory.

It’s important that you approach any performance problem
systematically. Make only one change at a time. If you make too many changes at
once, it may be impossible to accurately assess the impact of each change. Many
performance problems generate errors that you can display using Event Viewer.

After you make a change, you should resume monitoring and
compare the before and after data to determine if the change made an impact on
the problem. If you think that performance problems may be due to network
components, you can compare the performance of applications run over the network
with the performance of locally run applications.

The type of performance problems you are having determines
the type of corrective action you should take. Let’s look at some problems and
common performance tweaks you can make.

  • You
    can correct disk problems by installing additional drives or upgrading to
    faster drives.
  • Use Windows
    Server 2003 Distributed File System (DFS) to balance the workload.
  • Run
    disk defragmenters to optimize your disk space.
  • Overcome
    memory problems by increasing physical memory, increasing the page file
    size, or creating multiple paging files.
  • Add
    or upgrade processors to improve performance.
  • Network
    problems can be the result of unneeded protocols. Remove protocols that
    are not used and be sure to place the protocol used most frequently at the
    top of the binding list.
  • Use
    a 32-bit adapter instead of a 16-bit adapter for a significant increase in
    network performance.

Troubleshooting Performance Monitor

If you set up a counter but receive no data, you should
check to see if the counter’s associated DLL file has been deleted. Performance
Monitor will not detect if the counter has been deleted once it is in use, but
it will continue to report the counter data as zeros.

A counter may also report zeros if you do not have the appropriate
permissions with which to monitor the computer. You’ll get an error message
when you attempt to set up the counter, but if you ignore the message, it will
allow you to proceed.

You may notice gaps in your line graphs if the processing
activity on a system becomes too heavy. The graphing will resume when adequate
resources are available. The graph is also limited to 100 samples, so all
values recorded in a log may not appear in the Graph view.

If Task Manager shows that a process is running but is still
not reporting data, you can use the Exctrlst.exe utility included with the Windows
Server 2003 Support Tools to verify that the counter DLL is

To monitor a 16-bit application, you must monitor the
application via the NTVDM process. Only 32-bit processes appear in the
Instances list. If you plan to use Microsoft Excel to analyze the log files,
you will have to stop the performance logs and alerts because Excel requires
exclusive access to the log files.