How to ensure that performance counters continue after a restart

• September 19, 2007
• James Skemp
• software, tutorials / guides

A few days ago my server was restarted in the early morning hours. I had been logging network and processor usage using Windows built-in performance monitoring, but when the server restarted, the logs did not.

A bit of research later, it appears that there is a way to have Windows restart the logging after a system restart.

To enable this, it seems you just need to have the log stop after a certain amount of time (for example, after x hours, or x days). Then, check the box stating that "When a log file closes," "Start a new log file."

This has the added benefit of keeping your log files manageable in size.

Information to log

Unfortunately, I haven't found much in the way of information regarding what counters should be logged. I believe I read a Microsoft article that suggested Bytes Total/sec for the Network Interface, and Processor(_Total)\% Processor Time.

I was doing this for a couple of weeks, but have decided to try out the following instead, for a couple of weeks. Once I've got a baseline (looking at the old numbers and the new), I'll disable the logging for a bit, or decrease the polling time, and then start it back up to see if that baseline remains.

Memory\Available MBytes
Network Interface(x)\Bytes Received/Sec
Network Interface(x)\Bytes Sent/sec
Processor(_Total)\% Processor Time

(Some information removed, to protect the innocent.)

Once you have these logging, it's easy to use LogParser and avg(), min(), max() to generate some meaningful information.

Example SQL query 

See the below example (some data replaced with 'xxx'). Modify to taste, and save as a sql file, running it through Log Parser with 'file'.

/* 2007.09.19    J.Skemp        Created query. */
SELECT count(*) AS TotalCounters,
    -- Get the initial and final datetime
    min([(pdh-csv 4.0) (eastern daylight time)(240)]) as DateFirst,
    max([(pdh-csv 4.0) (eastern daylight time)(240)]) as DateLast,
    -- Processor information
    avg(to_real([\\xxx\Processor(_Total)\% Processor Time])) as ProcAvg(%),
    min(to_real([\\xxx\Processor(_Total)\% Processor Time])) as ProcMin(%),
    max(to_real([\\xxx\Processor(_Total)\% Processor Time])) as ProcMax(%),
    -- Memory information
    avg(to_int([\\xxx\Memory\Available MBytes])) as MemAvailAvg(MB),
    min(to_int([\\xxx\Memory\Available MBytes])) as MemAvailMin(MB),
    max(to_int([\\xxx\Memory\Available MBytes])) as MemAvailMax(MB),
    -- Network (in) information
    avg(div(to_real([\\xxx\Network Interface(xxx)\Bytes Received/Sec]),1024)) as NetRecAvg(K),
    min(div(to_real([\\xxx\Network Interface(xxx)\Bytes Received/Sec]),1024)) as NetRecMin(K),
    max(div(to_real([\\xxx\Network Interface(xxx)\Bytes Received/Sec]),1024)) as NetRecMax(K),
    -- Network (out) information
    avg(div(to_real([\\xxx\Network Interface(xxx)\Bytes Sent/sec]),1024)) as NetSentAvg(K),
    min(div(to_real([\\xxx\Network Interface(xxx)\Bytes Sent/sec]),1024)) as NetSentMin(K),
    max(div(to_real([\\xxx\Network Interface(xxx)\Bytes Sent/sec]),1024)) as NetSentMax(K)
-- Change file names accordingly
INTO temp_report.txt
FROM ServerInfo_*.csv

Add/remove as necessary, for your logs.

• windows
• iis
• analytics
• log parser