Overview of Performance Monitoring

Investigating Other Issues with Performance Tools

You might occasionally believe that data reported by the performance tools is invalid, that data is incomplete, or that the tools are not operating properly. This section addresses some problems you might encounter with the tools and how to correct them.

Data seems to be missing.

System Monitor might show gaps in its line graphs because data collection was subordinated to higher-priority processing activity on a system with a heavy load. When the system has adequate resources to continue with data collection, the graphing will resume as usual. A message appears describing this. Note also that you might see delays in display of data for some counters. Counters that display an average must wait for two samples to elapse before displaying a value. For ways to reduce the performance overhead of system monitoring, see "Controlling Performance Monitoring Overhead" later in this chapter.
Values recorded in a log do not appear in the graph view. This is because the graph is limited to 100 samples. Reducing the size of the Time Window on the Data property tab can allow you to see a more complete range of data.

Objects, counters, or instances seem to be missing or invalid.

In some cases you might find that you cannot find an object you want to monitor. This might be caused by the following:

You have not started or installed the process that starts the object counters. Use Task Manager to verify that the process is running. If so, use Exctrlst.exe on the Windows 2000 Resource Kit companion CD to verify that the counter DLL is running.
You have not enabled the counters (such as with the Network Segment object counters). If you do not see a counter that you want to monitor, make sure that the service or feature that provides the counter has been installed or configured. For information about how to install or configure the service or feature, see online Help for the service or feature.
If counters have been disabled, then they will not appear in the Add Counters dialog box. There are several reasons that a counter DLL might be disabled:
- A user disables counter DLLs using Exctrlst.exe on the Windows 2000 Resource Kit companion CD.
- The Performance Library's built-in testing routines have found problems with the counter DLLs and have disabled them to prevent them from interfering with operation of the Performance console. If this has occurred, the Application Log in Event Viewer contains a message to this effect.
To re-enable the counters for debugging purposes, locate the Performance subkey under the subkey for the service (typically, HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
\service_name\Performance\) and change the value for the Disable Performance Counters entry from 1 (disabled) to 0 (enabled). Notice that a counter DLL that the system has automatically disabled is likely to contain errors and may cause the system to slow.
You lack permissions on the computer being monitored. If you do not have appropriate permissions to monitor the computer, an error message will be displayed when you attempt to select the computer. An administrator must ensure that your user account has permissions to use the performance tools. If you are trying to monitor a remote system, for information about security issues, see "Monitoring Remote Computers" later in this chapter.
The DLL that installs the counters is generating errors. An example is if the counter does not handle localization functions correctly. Check Event Viewer to see if the counter DLL or the Performance Data Helper (PDH) library reported any errors. If necessary, you can disable counter DLLs that are causing errors by using Exctrlst.exe on the Windows 2000 Resource Kit companion CD.
You are trying to monitor a 16-bit or MS-DOS application. Only 32-bit processes appear in the Instances box. Active 16-bit processes appear as threads running in a Windows NT Virtual DOS Machine (NTVDM) process. (Virtual DOS Machine is an environment system for MS-DOS and 16-bit Windows emulation.) If you want to monitor a 16-bit application, see "Monitoring 16-bit Windows Applications" later in this chapter.

Note

When trying to monitor administrative tools hosted in MMC, note that they appear as instances of MMC in the Add Counters dialog box.

The instance you want to monitor is not currently active. If you are configuring System Monitor to collect real-time data, you can only select active instances for data collection. (If you are viewing logged data, you can select inactive instances for which the log contains data.) If you select the process and it stops after you have selected it, it will continue to appear in the list box but the reported data will be zeroes.
You might see situations where an instance seems inappropriate for the counter—such as the _Total instance for the Process\ID Process counter. All counters for an object have the same instances.

Data seems invalid.

There are several reasons that counters might report unlikely values:

You sometimes see an extremely high value for one instance and not the other when you are monitoring processes of the same name. This is because the performance tools sometimes misrepresent data for separate instances of processes with the same name by reporting the combined values of the instances as the value of a single instance. Using the instance index and tracking the Process\ID Process and Process\Creating Process ID counters can help you get around this problem.
Also, when monitoring several threads and one of them stops, the data for one thread might appear to be reported for another. This is because of the way threads are numbered. For example, you begin monitoring and have three threads, numbered 0, 1, and 2. If one of them stops, all remaining threads are resequenced. That means that the original thread 0 is now gone and the original thread 1 is renamed to 0. As a result, data for the stopped thread 0 could be reported along with data for the running thread 1 because old thread 1 is now old thread 0. Again, using the instance index can help you to track these threads.

Problems with System Monitor and MMC

If you are trying to create a custom console with System Monitor and another tool, you might have a problem because System Monitor is not listed in the Add Standalone Snap-in dialog box. This is because System Monitor is not designed as an extension snap-in but as an ActiveX control. To create a custom console containing System Monitor, you select ActiveX Control in the Add Standalone Snap-in dialog box and select System Monitor Control in the Insert ActiveX Control dialog box. System Monitor Control will appear as the name of the utility in your custom console; you can change it as needed.
Help for System Monitor does not appear in MMC; only Performance Logs and Alerts is shown in MMC Help. Because System Monitor is designed as an ActiveX control, it is unlike other MMC snap-ins. For example, System Monitor Help is not available by clicking Help Topics on the Help menu or by right-clicking System Monitor and selecting Help in the shortcut menu. Instead, click Help on the System Monitor display toolbar.

Problems with logs

Trace log data is not output as readable text. You must use a parsing utility to interpret the trace log output. Developers can create such a utility with the APIs provided in the Platform Software Development Kit.
An error message appears if you try to export log data to Microsoft Excel while the Performance Logs and Alerts service is actively collecting data to that log. The service must be stopped because Excel requires exclusive access to the log file. Other programs are not known to require this exclusive access; therefore, in general, you can work with data from a log file while the service is collecting data to that file.
Data from a running log does not seem to be updating. If you are working in System Monitor with a log file that is currently collecting data, you will need to click Select Time Range and keep moving the Time Range bar to the right to update the display with new samples.
Processes that started while a log was running do not appear in my exported log. Logged data can be saved as comma-separated or tab-separated files that are easily viewed with Microsoft Excel. However, some limitations apply when you use this format. Instances that start after the log is started will not be reflected. You need to use the binary log format to see data for these instances.
Errors occur regarding counter log size. This could be because your counter log has consumed the available space on the hard drive that you specified in the log file path. In addition, counter logs have a maximum size of 2 GB, and a message will appear when the log reaches this limit. Note that logs this size are unwieldy and slow to work with.
An exported monitoring configuration is collecting data from the wrong computer. This is probably because you selected the Select counters from computer option when you saved the console and installed it on another system. Instead, select Use local computer counters.
The Performance Logs and Alerts service stops and does not restart. If a network connection is lost during remote monitoring, or if there is a problem with a counter DLL, this could cause the Performance Logs and Alerts service to shut down. The service is configured to restart only once after the first failure. Thereafter, you need to start the service manually. To avoid recurrence of this problem, modify the startup properties of the services in Services under Administrative Tools. Also make sure to investigate the cause of the shutdown by reviewing the event log and disabling problem DLLs. To do this, use Exctrlst, a utility included on the Windows 2000 Resource Kit companion CD.
Workspace (.pmw) files that were created with Windows NT 4.0 Performance Monitor are not fully compatible with Windows 2000 System Monitor. Only one of the views saved in the workspace is available in System Monitor. System Monitor can read log files created with earlier versions of Performance Monitor when you use the following syntax at the Windows 2000 command prompt:

perfmon.exe log_file_name

This command does not invoke Windows NT 4.0 Performance Monitor, but instead a shell program that starts System Monitor. Windows NT 4.0 Performance Monitor is available as Perfmon4.exe on the Windows 2000 Resource Kit companion CD.