Measuring individual component performance
Now it’s time for some real-time charting of the activity on your network. Start the Performance Monitor from the Administrative Tools program folder. With the Performance Monitor open, pull down the Chart View (default) and add the counters listed in the next section to the display for the selected system. It will default to the current computer on which you are running Performance Monitor. Choose a server or use your own workstation. The objects listed in the next section can be added using the + icon on the toolbar or Edit®Add to Chart from the menus.
REDIRECTOR SERVICE COUNTERS
This group of Redirector counters determines if it is a network component that is bottlenecking the network.
Bytes Total/sec: This object gives the total number of data bytes being processed by the Redirector. This includes all packet data and protocol overhead, and gives an accurate measure of the amount of work Redirector is performing. This number should not reach the maximum rated speed of the network medium (the maximum speed achievable by a particular network technology, such as MB10MB Ethernet, or MB100MB FDDI) or a sustained value greater than 50 percent of its capacity over a sustained amount of time. Such a high utilization on the network medium indicates that the network is being pushed too hard. Consider NT-based or hardware-based segmentation either by using a router (small scale, rather complex) or employing switches (fast and relatively simple).
Current Commands: This counts the number of requests to the Redirector that are currently queued for service. Ideally, this value should not be more than one command per installed NIC. If a value higher than one is present, the redirector may be the bottleneck. This can happen if there is an asymmetry between the speed of server and the redirector which is causing inefficient communication between the local and remote systems. This can also indicate that the network capacity is being pushed to its limits and that it may be necessary to break the network into subnetworks to reduce traffic.
Network Errors/sec: Counts the number of serious errors that generally indicate the Redirector and one or more servers are having serious communication difficulties. For example, an SMB (Server Manager Block) protocol error will generate a Network Error. These result in an entry in the system Event Log, so look there for details. If errors appear in the chart, check the Event Log for more detailed error messages. This can be a sign of problems with the NIC or NIC driver, the hub or switch, or the cabling.
Reads Denied/sec: This specifies the number of read attempts to the server, which rejected requests for RAW Reads. When the Redirector read request is larger than the server’s negotiated buffer size, the Redirector will request a RAW read instead. When the server permits RAW reads, the performance of the connection can be significant because it occurs without all of the protocol overhead on every packet. RAW reads are accomplished by locking out all other requests and giving the transfer its full attention. The server will deny RAW read transfers if it is too busy to lock out other requests.
Writes Denied/sec: Like Reads Denied/sec, this is a request for a RAW write to the server, which if granted can permit a high degree of performance. If the server is busy, it will reject the request. Both Reads and Writes Denied/sec are measures of how efficient the server you are monitoring is performing and how busy it is.
SERVER SERVICE COUNTERS
This group of server counters determines if it is the server network component that is bottlenecking the network. This is the service primarily responsible for conveying client data from the server to the client computers.
Bytes Total/sec: Specifies the total number of bytes the server has sent and received over the network. The values this object monitors gives a good idea of how busy a server is. If this number is consistently at or above 50 percent of the network capacity, you may need to break the server off onto a faster switch or hub, or you could subnetwork using NT’s routing capability and a second NIC.
Work Item Shortages: This is the number of times that a “STATUS_DATA_NOT_ACCEPTED” message was returned. When no work items are available to service the network request, this message is returned to the system making the request. This value specifies whether modifications need to be made to InitWorkItems or MaxWorkItems parameters. A busy server that is getting close to its limits for memory will suffer more shortages, so this can be used to indicate a very busy server and a lack of physical memory resources. You may want to take off some services from the server to better service the remaining requests.
Blocking Requests Rejected: This server counter measures the number of times that a blocking SMB request has been rejected as a result of insufficient free work items. This can help to determine if the MaxWorkItem or MinFreeWorkItems parameters may need to be modified. A busy server will reject blocking requests for RAW transfers more often, giving an indication of how busy the server is.
Context Blocks Queued/sec: This server counter measures the rate at which work context blocks were placed in the server’s FSP queue because they could not be executed immediately. High values reflect a server component bottleneck.
Pool Nonpaged Failures: This counter measures the number of errors experienced by the server service due to exhausting memory resources that were originally allocated. Increasing numbers of this counter indicate a physical memory shortage.
Pool Paged Failures: This counter measures the number of allocation errors experienced by the server service due to an insufficient pagefile. Failures indicate that the pagefile is too small and needs to be increased. This counter in combination with the Pool Nonpaged Failures and Context Blocks Queued/sec can indicate a bottleneck in the server component as a result of an improper server optimization level (minimize, balance, maximize).
NETWORK INTERFACE
This group of counters is only available if you install SNMP support with TCP/IP. Network Interface determines if it is the network itself that is congested and bottlenecked. The Network Interface object will have one instance for each NIC installed.
Output Queue Length: This is the number of packets in the output queue. This value should not sustain more than 2 or the network is bottlenecked and the underlying hardware may need to be reconfigured or replaced. Contrary to documentation that states that this counter always remains at zero, it does, indeed, give useful information.
Bytes Total/sec: This counter reflects the number of bytes that are sent and received through the interface, including all framing characters. This counter measures all net traffic that moves through the NIC and includes overhead from media access protocol and transport protocol. If this counter is observed to sustain (converted) 390 to 586K and grow above these rates while your output queue lengths continue to increase, the NIC and media access protocol is bottlenecking the system and segmentation/subnetworking may be required.
Current Bandwidth: This counter is an estimation of the current bandwidth on the interface in bps (bits per second). For interfaces that do not vary in bandwidth (like Ethernet and FDDI), this is a nominal bandwidth value.
NETWORK SEGMENT
This group of counters is only available when you install the Network Monitor Agent. Unlike the other counters, this group actually uses the agent and converts the information for Performance Monitor.
% Network Utilization: This is the percentage of the network bandwidth that is in use. By comparing this counter’s value to that of the Network Interface object, Current Bandwidth counter, you can determine how much of the network capacity is actually being used.
% Broadcast Frames: This counter counts the percentage of frames that are broadcast traffic (and potentially wasted bandwidth) as opposed to multicast and unicast traffic. If this or % Multicast Frames reaches anywhere near 100 percent (combined) in a second, you should look for the source of the traffic immediately. Large numbers of broadcasts can be caused by a misconfigured bridge, a chattering NIC, or a large NT network using transport protocols that are resolving NetBIOS names to physical addresses. Segmenting the network using subnetworks or switches can reduce this traffic. Other changes include using transport protocols, which do not generate as many broadcasts (TCP/IP).
Total Bytes Received/sec: This counter indicates the total number of bytes received from a particular network segment. This is a good indicator of the amount of work that the server is doing. If the total is getting close to the maximum for the speed of the medium (MB10MB Ethernet, MB100MB Ethernet, TokenRing 16) pay close attention to the Output Queue length counter of the Network Interface object. If the number is too high, you may add NICs and subnetwork the network, or you may choose to add switches. Sustained numbers of more than half the rated maximum speed of the network medium is an indication of overutilization and need for breaking the network up and/or adding faster network components.
Once you have monitored your network for a few days and gotten a feel for what each counter is indicating and how the Performance Monitor objects interrelate, you should be able to start identifying problem areas and isolating whether the bottleneck is occurring at the network segment, the network interface, or within the network components themselves.
XREF: See Chapter 10, “Tuning NT Server Performance” for additional Performance Monitor objects related to server performance.
Identifying network interface card bottlenecks
The Network Interface counter (installed when you choose to install SNMP support under TCP/IP options) is the best tool for determining whether your bottleneck is on the network interface controller, on the network itself, or caused by improperly configured or overtaxed network software components. From the Network Monitor, you can also view the percentage of network utilization as well as the frames/second and bytes/second. Consistently high numbers from either tool monitoring the appropriate objects (those for Network Segment and Network Interface) indicate that the performance problem is being caused by a source outside of NT’s network subsystem software.
Other measures for determining if the NIC itself is causing trouble include measuring System Total Interrupts/sec and Network Interface packets/sec. Sustained figures of 150 interrupts per second are troublesome. A high packet rate with a processor interrupt rate in the sub-100 range is ideal. Six hundred interrupts per second or higher is a good indication of a hardware level problem with the NIC or NIC driver. Context switches (thread service switching) will also reflect a high number, which will be close to the rate of interrupts per second from miniport driver servicing by the processor(s). As mentioned, queue lengths are the most important measure for determining bottlenecking. If a component is getting close to 100 percent usage while the output queue remains empty, the component is providing work at the rate it is requested without having to delay service by placing the request in the queue. If the network interface queue is four or higher, then your network interface is becoming the bottleneck. Causes for this include a slow NIC or a very busy network in which the NIC must wait to transmit/retransmit.
A good NIC will incorporate features to reduce contention on the network as well as provide good performance with the minimum interrupt generation. Busmastering PCI NICs provide the best performance with the lowest processor utilization. The efficiency of an NIC is the measure of raw throughput divided by the processor utilization as a percentage. A higher efficiency rating is indicated by the lowest processor usage accompanied with throughput rates at close to the rated speed of the medium in a switched environment using cached data transfers. The driver should fully support the latest NT networking component revisions and the other network hardware installed on the network.
Because NT now supports the enhanced NDIS 4.0 spec, get in touch with your vendor to find out if they have updated NDIS 4.0 miniport drivers for the NIC you already use. All the major vendors now support this specification, though older NICs may not have an updated driver that supports NDIS 4.0. Most good NICs have a driver setup utility that allows you to set up the parameters for the NIC explicitly. As already described, it’s good to leave nothing to chance, and if you are reading this book you are probably not one for allowing much in the way of automatic configuration.
For large networks, you may want to keep your duplexing and line speed set for autonegotiate. This should prevent serious problems from occurring if you move machines around on the network and add or remove switches.
Though it isn’t possible to tell you all of the possible driver parameters for all of the available network cards, cards based on the Digital Semiconductor network accelerator chips tend to have very high performance and are found on some of the highest rated cards (like the Adaptec Quartet Fast Ethernet adapters). Intel and 3COM also make very good cards, with driver parameters that are generally more tweakable than those based on the Digital chipset. Parameters such as send and receive buffers should be increased in small increments. Map registers (when available) allocate memory for the driver and give the best performance. If you see this parameter, try to increase it as much as you can without logging errors (memory used is often less than 32K).
MONITORING NETWORK PERFORMANCE WITH NETWORK MONITOR
Windows NT’s included monitoring tools are great for quick and easy identification of network bottlenecks. You don’t have to buy an expensive third-party tool for providing information on network performance, even if your investigation leads you down to the packet level. For this kind of low-level network monitoring, you can use the Network Monitor utility included with Windows NT Server. To use Network Monitor, you have to install the agent and the Network Monitor tool from within Control Panel\Networks. See Figure 9-7 for a view of the Network Control Panel, Services tab.
Network Monitor interface
Network Monitor automatically opens to the Capture Window. The screen is divided into four frames: the graph pane, the session pane, the station statistics pane, and the total statistics pane.
Order Your SQL Fundamentals CD Today! Learn how to use SQL Server, understand Office integration techniques and dive into the essentials of SQL Express and Visual Basic with this free SQL Fundamentals CD.
You've Deployed SharePoint...Now What? This one-day free online conference delivers the technical knowledge needed to kick MOSS up a notch. In one information-packed day, independent SharePoint experts will present practical, real-world information and provide take-away, ready-to-use solutions
What Would You Do If You Ran Microsoft? ITTV's 2008 inaugural video contest, "If I Ran Microsoft..." is your chance to tell it like it is. Be goofy or be serious, but don"t miss this chance to have fun, win prizes, and go viral in a major way.
Maximize Your SharePoint Investment This web seminar discusses how true bi-directional replication of SharePoint content from one server to another enables branch offices to maintain access to current SharePoint content.
Windows IT Pro
Register
