Great tool for Windows 2003: Server Performance Advisor (SPA)
First off you can download SPA 2.0 here. I'm going to explain how to quickly use SPA, and then what type of data is returned in this post.
What is SPA?
So what is SPA and how can you use it? Well the official overview is:
Microsoft ® Windows Server ™ 2003 Performance Advisor is the latest version of Server Performance Advisor, which is a simple but robust tool that helps you diagnose the root causes of performance problems in a Microsoft Windows Server 2003 deployment. Server Performance Advisor collects performance data and generates comprehensive diagnostic reports that give you the data to easily analyze problems and develop corrective actions
Microsoft ® Windows Server ™ 2003 Performance Advisor provides several specialized reports, including a System Overview (focusing on CPU usage, Memory usage, busy files, busy TCP clients, top CPU consumers) and reports for server roles such as Active Directory, Internet Information System (IIS), DNS, Terminal Services, SQL, print spooler, and others.
Really I think of it as network monitor and performance monitor wrapped into one package so that you can correlate which clients might be causing load on your system.
Some nifty things about SPA:
1) It's XML based so the reports that are collected get organized "automagically" by date and server so you can drill down on a particular server. You could have a thousand reports on your reporting server and its quite easy to navigate via IE to the server and date that you are looking for.
2) You can setup SPA on your servers in "Data" mode and then setup a member server as a SPA "reporting" server, then you can schedule your servers to collect at a certain time and send that data to the reporting server. You can also have SPA (with version 2.0) take the data from those servers and put it in a SQL database for trending purposes. This is what we do internally, we setup the jobs to run at 10 and 2 to get peak utilization trending on our domain controllers. There is a chm file with SPA with more details on this.
3) Doesn't require a reboot to install.
4) Was deemed so awesome it is built right into Vista and Windows Server 2008 (Data Collection Sets)
I'm not going to dabble into the trending and reporting server side of SPA as that would require a lot more typing but like I said if you install SPA, you can read the chm about scheduling tasks and trending. I just wanted to point it out because some people might not have a monitoring solution where you can do some rudimentary trending and this could be a free solution.
The install
Double click MSI, leave defaults.
How and when to use
We're going to be focusing on how to use SPA to troubleshoot, lets look at an example of that. SPA is useful at narrowing down resource issues on a system with regards to processor, memory, network, and disk.
Last week we had a WINS server that was throwing database errors and so our team was engaged. I installed SPA using the steps above,I then could have used the GUI to launch SPA and start a collection (default 300 seconds), but this is the faster way (the way I use).
1) Navigate to the SPA directory, if you installed on an x64 system it will be under "Program Files (x86)", otherwise just "Program Files\Server Performance Advisor"
2) Since I want just a system overview report I ran spacmd start "system overview"
a) At this point the collection starts and you should see some processes labeled plahost running in task manager. You can let this run for 300 seconds but in my case I just needed a quick 30 second snapshot since the repro was constantly happening.
b) If you installed this on a domain controller you could do spacmd start "active directory" or spacmd start * which would start all the templates you have installed.
3) Now stop the collection: spacmd stop "system overview"
a) At this point as long as you left the defaults during install you should see a new folder under c:\perflogs with the server name and a few files underneath that.
C:\PerfLogs\Data\System Overview\Current\BRAD-SERVER_200706211545>dir
Volume in drive C is C_Drive
Volume Serial Number is 70C4-9FFDDirectory of C:\PerfLogs\Data\System Overview\Current\BRAD-SERVER_200706211545
06/21/2007 03:49 PM <DIR> .
06/21/2007 03:49 PM <DIR> ..
06/21/2007 03:49 PM 1,673 global_reg.xml //Some registry settings are checked by SPA there saved here
06/21/2007 03:49 PM 1,441,792 system_kernel.etl //A trace file that SPA analyzes during the capture.
06/21/2007 03:49 PM 1,638,400 system_perf.blg //Perfmon binary log file that SPA analyzes from the capture.
3 File(s) 3,081,865 bytes
2 Dir(s) 960,020,480 bytes free
4) Now we need to compile the data we captured into a report: spacmd compile "system overview"
a) Once this is complete, you should see the report in the reports directory. If using the GUI then the report will show up under reports under System Overview.
C:\PerfLogs\report\System Overview\Current\BRAD-SERVER_200706211545>dir
Volume in drive C is C_Drive
Volume Serial Number is 70C4-9FFDDirectory of C:\PerfLogs\report\System Overview\Current\BRAD-SERVER_200706211545
06/22/2007 09:35 AM <DIR> .
06/22/2007 09:35 AM <DIR> ..
06/22/2007 09:24 AM 1,721 global_reg.xml
06/22/2007 09:35 AM 2,365 obelisk.ip
06/22/2007 09:35 AM 608,594 report.xml //Double click this one.
06/22/2007 09:34 AM 62,417 report.xsl
06/22/2007 09:35 AM 656 summary.xml
06/22/2007 09:24 AM 6,881,280 system_kernel.etl
06/22/2007 09:24 AM 6,094,848 system_perf.blg
7 File(s) 13,651,881 bytes
2 Dir(s) 963,108,864 bytes free
Analyzing the report
So now that we have the report we can open it up and start looking at it, just double click report.xml and IE should open. You'll want to allow scripts and ActiveX so that you can adjust the data in the xml doc as it is dynamic. For example, if you look in the second JPG below on the top right its says "3 of 15" if you wanted to see the top 15 of 15 you could just click the 3 and type in 15, and the report would change.
The first part of the report is a summary, and links to other sections pertaining to CPU, Network, Disk, and Memory. Below that is any performance advisories that SPA flagged for you and then how each of the components were doing. In the first JPG below, on the right there is a little help icon, if you click the icon it will open a chm file with further steps you can take to narrow down the issue.
I can't go through each area of concern but you get the idea. As I was going through the network section I noticed this:
This seemed odd so I filtered my network monitor capture that I took during the same time period for vm-lab-machine and it came back with a ton of 1F registrations and releases for the 1F record for that server like so:
13861 5.703125 BRAD-SERVER VM-LAB-MACHINE NbtNs NbtNs: Registration Response, Success for VM-LAB-MACHINE <0x1F> NetDDE Service, xxx-xx-xxxx-xx
13863 5.703125 VM-LAB-MACHINE BRAD-SERVER NbtNs NbtNs: Release Request for VM-LAB-MACHINE <0x1F> NetDDE Service, xxx-xx-xxxx-xx
13864 5.703125 BRAD-SERVER VM-LAB-MACHINE NbtNs NbtNs: Release Response, Success for VM-LAB-MACHINE <0x1F> NetDDE Service, xxx-xx-xxxx-xx
13865 5.703125 VM-LAB-MACHINE BRAD-SERVER NbtNs NbtNs: Registration Request for VM-LAB-MACHINE <0x1F> NetDDE Service, xxx-xx-xxxx-xx
13866 5.703125 BRAD-SERVER VM-LAB-MACHINE NbtNs NbtNs: Registration Response, Success for VM-LAB-MACHINE <0x1F> NetDDE Service, xxx-xx-xxxx-xx
13867 5.703125 VM-LAB-MACHINE BRAD-SERVER NbtNs NbtNs: Release Request for VM-LAB-MACHINE <0x1F> NetDDE Service, xxx-xx-xxxx-xx
13868 5.703125 BRAD-SERVER VM-LAB-MACHINE NbtNs NbtNs: Release Response, Success for VM-LAB-MACHINE <0x1F> NetDDE Service, xxx-xx-xxxx-xx
13869 5.703125 VM-LAB-MACHINE BRAD-SERVER NbtNs NbtNs: Registration Request for VM-LAB-MACHINE <0x1F> NetDDE Service, xxx-xx-xxxx-xx
13870 5.703125 BRAD-SERVER VM-LAB-MACHINE NbtNs NbtNs: Registration Response, Success for VM-LAB-MACHINE <0x1F> NetDDE Service, xxx-xx-xxxx-xx
13871 5.718750 VM-LAB-MACHINE BRAD-SERVER NbtNs NbtNs: Release Request for VM-LAB-MACHINE <0x1F> NetDDE Service, xxx-xx-xxxx-xx
13872 5.718750 BRAD-SERVER VM-LAB-MACHINE NbtNs NbtNs: Release Response, Success for VM-LAB-MACHINE <0x1F> NetDDE Service, xxx-xx-xxxx-xx
13873 5.718750 VM-LAB-MACHINE BRAD-SERVER NbtNs NbtNs: Registration Request for VM-LAB-MACHINE <0x1F> NetDDE Service, xxx-xx-xxxx-xx
13874 5.718750 BRAD-SERVER VM-LAB-MACHINE NbtNs NbtNs: Registration Response, Success for VM-LAB-MACHINE <0x1F> NetDDE Service, xxx-xx-xxxx-xx
13875 5.718750 VM-LAB-MACHINE BRAD-SERVER NbtNs NbtNs: Release Request for VM-LAB-MACHINE <0x1F> NetDDE Service, xxx-xx-xxxx-xx
13876 5.718750 BRAD-SERVER VM-LAB-MACHINE NbtNs NbtNs: Release Response, Success for VM-LAB-MACHINE <0x1F> NetDDE Service, xxx-xx-xxxx-xx
13877 5.718750 VM-LAB-MACHINE BRAD-SERVER NbtNs NbtNs: Registration Request for VM-LAB-MACHINE <0x1F> NetDDE Service, xxx-xx-xxxx-xx
13878 5.718750 BRAD-SERVER VM-LAB-MACHINE NbtNs NbtNs: Registration Response, Success for VM-LAB-MACHINE <0x1F> NetDDE Service, xxx-xx-xxxx-xx
13879 5.718750 VM-LAB-MACHINE BRAD-SERVER NbtNs NbtNs: Release Request for VM-LAB-MACHINE <0x1F> NetDDE Service, xxx-xx-xxxx-xx
13880 5.718750 BRAD-SERVER VM-LAB-MACHINE NbtNs NbtNs: Release Response, Success for VM-LAB-MACHINE <0x1F> NetDDE Service, xxx-xx-xxxx-xx
13881 5.718750 VM-LAB-MACHINE BRAD-SERVER NbtNs NbtNs: Registration Request for VM-LAB-MACHINE <0x1F> NetDDE Service, xxx-xx-xxxx-xx
13882 5.718750 BRAD-SERVER VM-LAB-MACHINE NbtNs NbtNs: Registration Response, Success for VM-LAB-MACHINE <0x1F> NetDDE Service, xxx-xx-xxxx-xx
13883 5.718750 VM-LAB-MACHINE BRAD-SERVER NbtNs NbtNs: Release Request for VM-LAB-MACHINE <0x1F> NetDDE Service, xxx-xx-xxxx-xx
13884 5.718750 BRAD-SERVER VM-LAB-MACHINE NbtNs NbtNs: Release Response, Success for VM-LAB-MACHINE <0x1F> NetDDE Service, xxx-xx-xxxx-xx
13885 5.718750 VM-LAB-MACHINE BRAD-SERVER NbtNs NbtNs: Registration Request for VM-LAB-MACHINE <0x1F> NetDDE Service, xxx-xx-xxxx-xx
13886 5.718750 BRAD-SERVER VM-LAB-MACHINE NbtNs NbtNs: Registration Response, Success for VM-LAB-MACHINE <0x1F> NetDDE Service, xxx-xx-xxxx-xx
13887 5.718750 VM-LAB-MACHINE BRAD-SERVER NbtNs NbtNs: Release Request for VM-LAB-MACHINE <0x1F> NetDDE Service, xxx-xx-xxxx-xx
13888 5.718750 BRAD-SERVER VM-LAB-MACHINE NbtNs NbtNs: Release Response, Success for VM-LAB-MACHINE <0x1F> NetDDE Service, xxx-xx-xxxx-xx
I then popped the query 1F Wins Server into live.com and the first hit was the issue.
SPA roles:
There is more than just the "system overview" template, there are templates for AD, print servers, terminal servers, etc. Each one of these templates focuses on that role and collects different counters depending on the role. For example, on a DC SPA will capture the DS perfmon counters and then analyze the output from those counter and flag issues it finds for follow-up.
Conclusion:
Using SPA I was able to easily find the network client causing the issue on our WINS server and then correlate that with the network capture. This is only one example of where SPA has really assisted in narrowing down the issue for me. One caveat, SPA is CPU intensive when it compiles the report, so if the system is already pegged at 100% its best to compile the report off the the system in question.
If you run into any issues with SPA (only supported on Win2k3), send me an e-mail or drop a comment and I'll try to help you out.
Technorati tags: Windows 2003, SPA
IceRocket tags: Windows 2003, SPA
Comments
Anonymous
January 01, 2003
Performance Analysis of Logs (PAL) tool Project Description: Ever have a performance problem, but don'tAnonymous
January 01, 2003
Yep sounds like the install didnt land Michael. If it did you would see the SPA info in SQL.Anonymous
January 01, 2003
Hi John the only thing I can think of is that the SPA jobs run under the system account of each machine, you need to create a group that includes all these machines and give that group read/write/modify perms on the reporting server. Or run the SPA scheduled jobs under an account which has rights to write to the reporting server.Anonymous
January 01, 2003
Any events in eventvwr.msc that are SPA related, they migth give you some clues. We got it working interally for sure.Anonymous
January 01, 2003
Background: In an earlier post I talked about some new features for Windows 2008 and Vista.  OneAnonymous
January 01, 2003
Sounds like its not compiling the data. I'd look in the directory where the data resides for the reprot.xml file if its not there its not compiling. Easises tthing to do first is to run: "spacmd compile *" and see if anything is generated.Anonymous
January 01, 2003
This is Good tool, and most important thing...It is cmd based which makes things much easier you know, that going through GUI and wait till that page with intensive graphic tools gets loaded. BTW my report.xml file was under C:perflogsReportFileCurrent What are the possibility of using this tool remotely, you know I can't keep this installing on every server.Anonymous
January 01, 2003
Jason, installing SPA install a CHM file which has detailed information on how to setup trending correctly. Check that out.Anonymous
January 01, 2003
Preetamz, dont see a way to use this remotely as the dlls need to run locally on the system. Since it is an MSI package you can deploy it remotely using many difernet methods like GPO and SMS.Anonymous
January 01, 2003
Tom, check the SPA CHM file, that has the exact steps you need to get the SQL trending working.Anonymous
January 01, 2003
Hi Brian. I think for true trending purposes perfmon is still the correct choice (Or MOM :)). SPA is good for trending against a small number of systems but lrage number might be a bit cumbersome.Anonymous
September 11, 2007
I am having trouble getting the trending to work. It never sends anthing to the SQL serverAnonymous
November 05, 2007
Has anyone installed this on a TS server? When I look at the reports the data is missing?Anonymous
January 16, 2008
The chm file is not very detailed at all. How is the DB supposed to be setup in terms of the tables? Is there something being assumed here or has something failed during the install process for me?Anonymous
April 03, 2008
Did anyone ever get trending to work. I have setup up report trending as instructed in the chm file however the sql db is never populated...Anonymous
July 15, 2008
I have used SPA to analyse a couple of servers and it was excellent. Now I want to role it out to a few more and configure it with different roles. However I have tried to setup a data/report configuration and I cannot get the report server to pick up the files. I have created a transfer share, set the role and the generate setting but no joy. Any ideas would be appreciated.Anonymous
August 08, 2008
I've got the tool setup and running nicely, and now want to graduate from storing reports locally on the few servers I'm piloting, to sending all data to a dedicated Report Server running SQL Express 2005. If everything is set up properly (SPA server roles, designating the correct SQL Server name, databse, and account the Data Collector jobs will run under, etc.) is it enough to just designate the database name and SQL server name and expect that SPA and SQL on the Report server will create the tables first time the Transfer data is fetched from a remote SPA Data server? I have zilch experience with SQL but did quickly figure out how to enable TCP and Named Pipes. I do see in Event Viewer that the SPA Data Server is successfully logging on to SQL Express each time I manually start a collection job, but the data never leaves the Transfer folder on the SPA Data Server. I created a new database in SQL Express and ensured that is the db name the job is supposed to send its data to. I am wondering if SPA is expected to create the tables in that database with the first upload of data, or if I'm supposed to do more than just create an empty database?Anonymous
September 02, 2008
Tom - I can see your posts all over the web asking for help on this issue. Any luck? I too can't seem to get this working. The chm file is useless since it doesn't give any detailed instructions. Unless you can do that for us here Brad? Thanks.Anonymous
September 09, 2008
Hi Nev. You must be in the same boat as me. There is no useful information I can find on setting up SQL to work with SPA, least of all in the SPA CHM. So as far as I'm concerned SPA Trending will have to wait until someone with the proper know-how posts some documentation, but in the meantime I am having fun with SPA basic.Anonymous
October 02, 2008
Hello Brad, Thanks for the info. My question is does this "replace" perfomance monitor as far as setting a baseline for server system performance and day-forward monitoring of server performance? I was trying to set up performance counters for specific server roles such as file, print, domain controller, email, database(DOn't think DB is possiblebased on some previos questions) and web server when I came across this utiliy. Should I still go ahead and configure performance logging or is Server Performance Advisor a turn-key solution? Any help, suggestions and advice would be greatly appreciated.Anonymous
October 10, 2008
Hello Brad, Thanks for your help. Would you recommend that I use the counters in SPA as a baseline for setting up the counters in performance monitor (Based on each server role, of course.)? If not, do you know of a resource that list recommended counters for different servers roles? Thank You, Sincerely, BrianAnonymous
February 17, 2009
Hi all, As stated in the help file I think you def need SQL 2000 or the MSDE. Struggled with SQL 2005 until reverting to SQL 2000 install and the SPA DB was then created first time!Anonymous
March 12, 2010
The comment has been removedAnonymous
June 02, 2010
The Server Performance Advisor (SPA) is capable of much more than tracking LDAP activity and it is certainly worth spending more time exploring the feature set.is a simple but robust tool that helps administrators diagnose the root causes of performance problems in a Microsoft Windows Server 2003 deployment <a href="http://www.cheapspadays.com">cheap spa days</a>Anonymous
November 14, 2012
The comment has been removed