1 MONITORING MICROSOFT WINDOWS SERVER 2003 Chapter 3 Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2 003 2 CHAPTER OVERVIEW • Use Event Viewer to monitor system logs. • Configure Task Manager to display performance data. • Use System Monitor to display real-time performance data. • Create counter logs and alerts. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2 003 3 SERVER MONITORING PRACTICES Real-time monitoring • Uses tools that display a continuous stream of statistics about what the system is doing right now Logged monitoring • Enables administrators to observe trends that develop over longer periods of time than those observed in a typical real-time monitoring session Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2 003 4 BASIC MONITORING SUBSYSTEMS • Processor • Disk • Memory • Network Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2 003 5 ESTABLISH A BASELINE WHAT IS A BASELINE? WHAT IS THE PURPOSE? Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2 003 6 USING EVENT VIEWER TO MONITOR ERROR Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2 003 7 EVENT VIEWER LOGS Application • Information about specific programs running on the computer System • Events generated by components such as services and device drivers Security • Security-related events such as failed logons and attempts to access resources Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2 003 8 UNDERSTANDING EVENT TYPES E E v v e e n n t t T T y y p p e e I I c c o o n n D D e e s s c c r r i i p p t t i i o o n n Error A significant problem, such as loss of data or loss of functionality Warning An event that might not be significant but might indicate a future problem Information An event that describes the successful operation of an application, driver, or service Success Audit An audited security access attempt that succeeds Failure Audit An audited security access attempt that fails Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2 003 9 VIEWING EVENTS Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2 003 10 EVENT LOG RETENTION SETTINGS [...]... in order to view in Event Viewer Save as txt or csv (commas separated values) files to import into other applications Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2 15 003 USING TASK MANAGER • Real-time monitoring tool • Displays information on: • • • • Processor and memory performance Applications and processes Network utilization Users connected to the system Chapter 3: MONITORING MICROSOFT WINDOWS... NETWORK ACTIVITY Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2 20 003 MONITORING USERS Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2 21 003 USING THE PERFORMANCE CONSOLE System Monitor • Displays real-time performance data collected from performance counters Performance Logs and Alerts • Records data from performance counters over a period of time and executes specific actions when counters reach a... 20 Memory: Available Bytes • Should not fall below 5 percent of the system’s total physical memory Memory: Committed Bytes • Should always be less than the physical RAM in the computer Memory: Pool Non-Paged Bytes • Should be a stable number that does not grow without a corresponding growth in server activity Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2 32 003 MONITORING DISK PERFORMANCE PhysicalDisk: . Monitor to display real-time performance data. • Create counter logs and alerts. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2 003 3 SERVER MONITORING PRACTICES Real-time monitoring • Uses. observe trends that develop over longer periods of time than those observed in a typical real-time monitoring session Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2 003 4 BASIC MONITORING. computer System • Events generated by components such as services and device drivers Security • Security-related events such as failed logons and attempts to access resources Chapter 3: MONITORING MICROSOFT