Analyzing performance data

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

Analyzing performance data

Analyzing your monitoring data consists of examining counter values that are reported while your system is performing various operations. You should determine which processes are most active and which programs or threads, if any, are monopolizing a resource. Using this type of performance data analysis, you can understand how your system is responding to workload demands.

As a result of this analysis, you may find that your system performs satisfactorily at some times and unsatisfactorily at others. Depending on the causes of these variations and the degree of difference, you may choose to take corrective action or to accept these variations and delay tuning or upgrading resources for a later time.

The level of system performance that you consider acceptable when your system is handling a typical workload and running all required services is its baseline. The baseline performance is a subjective standard that the administrator determines based on the work environment. It may correspond to a range of counter values, including some that are temporarily unacceptable but which generally indicate the best possible performance under the administrator's specific conditions. The baseline can be the measure used for setting performance standards for your users and can be included in any service agreements you put in place.

Determining acceptable values for counters

In general, deciding whether or not performance is acceptable is a subjective judgment that varies significantly with variations in user environments. The following table containing threshold values for specific counters can, however, help you determine whether values reported by your system indicate a problem. If System Monitor consistently reports these values, it is likely that bottlenecks exist on your system and you should take action to tune or upgrade the affected resource. Counters that show usage ratios over an interval are a more informative measurement than averages of instantaneous counter values. In performance data measurements, one or two data points that fall outside normal operating conditions for a brief period of time, for example, during the startup period of a service, can skew the average. This gives a false impression of the overall operating performance during the collection period.

Resource	Object\Counter	Suggested threshold	Comments
Disk	Physical Disk\% Free Space Logical Disk\% Free Space	15%
Disk	Physical Disk\% Disk Time Logical Disk\% Disk Time	90%
Disk	Physical Disk\Disk Reads/sec, Physical Disk\Disk Writes/sec	Depends on manufacturer's specifications	Check the specified transfer rate for your disks to verify that this rate does not exceed the specifications. In general, Ultra Wide SCSI disks can handle 50 to 70 I/O operations per second. Note that whether or not the I/O is sequential or random can have a strong impact on values for disk reads/sec and disk writes/sec.
Disk	Physical Disk\Current Disk Queue Length	Number of spindles plus 2	This is an instantaneous counter; observe its value over several intervals. For an average over time, use Physical Disk\Avg. Disk Queue Length.
Memory	Memory\Available Bytes	For larger memory computers, greater than 4 MB	Research memory usage and add memory if needed.
Memory	Memory\Pages/sec	n pages/sec per pagefile	Research paging activity. Note the amount of I/O going to the disks with pagefiles.
Paging file	Paging File\% Usage	Above 70%	Review this value in conjunction with Available Bytes and Pages/sec to understand paging activity on your computer.
Processor	Processor\% Processor Time	85%	Find the process that is using a high percentage of processor time. Upgrade to a faster processor or install an additional processor.
Processor	Processor\Interrupts/sec	Depends on processor; 1,000 interrupts per second is a good starting point	A dramatic increase in this counter value without a corresponding increase in system activity indicates a hardware problem. Identify the network adapter, disk, or other hardware causing the interrupts.
Server	Server\Bytes Total/sec		If the sum of Bytes Total/sec for all servers is roughly equal to the maximum transfer rates of your network, you may need to segment the network.
Server	Server\Work Item Shortages	3	If the value reaches this threshold, consider adding the DWORD entries InitWorkItems (the number of work items allocated to a processor during startup) or MaxWorkItems (the maximum number of receive buffers that a server can allocate) to the registry (under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters). The entry InitWorkItems can range from 1 to 512 while MaxWorkItems can range from 1 to 65,535. Start with any value for InitWorkItems and a value of 4,096 for MaxWorkItems and keep doubling these values until the Server\Work Item Shortages threshold stays below 3. For information about modifying the registry, see Registry Editor overview. Caution Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.
Server	Server\Pool Paged Peak	Amount of physical RAM	This value is an indicator of the maximum paging file size and the amount of physical memory.
Server	Server Work Queues\Queue Length	4	If the value reaches this threshold, there may be a processor bottleneck. This is an instantaneous counter; observe its value over several intervals.
Multiple processors	System\Processor Queue Length	2	This is an instantaneous counter; observe its value over several intervals.

For tuning and upgrade suggestions, see Solving performance problems.

For a more detailed discussion of performance-data analysis, see "Part One: Operating System Performance" in the System Performance and Troubleshooting Guide, available at the Microsoft Windows Resource Kits Web site.