perflogs

实验十九网络监视器、性能监视器（Experiment19networkmonitor,

performancemonitor）

Experiment19networkmonitor,performancemonitorexperiment

19networkmonitor,performancemonitorreturn

[experimentalpurpose]

1)applicationofeventviewerandperformancemonitor.

2)mastertheinstallationandusageofNetworkmonitorNetwork

monitor.

3)understandthepackagingrelationshipofeachlayerofdata

inthenetworkhierarchy.

4)capturethedatapacketsofthepingcommandrelatedprotocol

andanalyzethestructure.

[experimentalenvironment]

IISWindows2000Servercomputer,LAN,Windows2000Server

installationCD.

[keypointsanddifficulties]

Keypoints:graspthemethodofnetworkmonitor,deeply

understandthepackagingrelationofeachlayerdatainnetwork

hierarchy,andlearntoanalyzethestructureofcommondata

packets.

[experimentalcontent]

Monitoringevents

WebsitesinIISareimplementedbyIISservices,suchasWeb

sitesthatrelyontheWWWservice,andeventssuchasfailed

servicelaunchestendtoimplythatthesiteisnotworking

tion,sucheventsasTCP/IPerrors,and

networkhardwaredevices,areoftenthemainculpritfor

ystemprompts

anerrororanIISoccurrenceofanexception,anexperienced

administratorusuallycheckstheeventsrecordedbytheevent

viewer.

Click[start],[program],[managementtool],[eventviewer]

nts

aresavedinthreeeventlogs:applicationlog,securitylog,

andsystemlog,

Thetypesofeventsthatareincludedareasfollows:

FortheIISserver,theeventsrecordedinthesystemlogare

ninthefigure,selectthesystemlog

intheeventviewercontroltree,andtherightpanelistsall

theeventsthathavebeenrecorded,andtheeventsaredivided

into:errors,warnings,information,andsoon.

Thelisttodisplayonlytherelevanteventstookplace,origin,

classification,andtheuser,suchaslimitedinformation,in

ordertoviewaneventdescribedindetailorinformationcode,

shoulddouble-clickeventonthelist,consulttheevent

nintherightimage,detailsof

theoccurrenceofeventsandpossiblecausesaredescribedin

detailintheeventpropertiesdialogbox,andthetypicalevent

heupand

downarrowsintheeventpropertiesdialogtocontinuetoview

thedetailsofthepreviousornextevent.

Second,performancemonitor

Long-termmonitoringoftheserverthroughlogfiles,the

averagecharacteristicsofthesystemobjectareobtained.

Themethodsofusinglogfilesforandmonitoringareas

follows:

[systemlogandalarm]nodesinperformancemonitor,

rightclick[counterlog],select[newlogSettings].

EnterthenewlognameinthedialogboxforthenewlogSettings.

Clickok.

3,asshowninthenewlogpropertiesdialogboxinthe"regular"

TAB,clickadd】【openedcounterdialog,specifythelogfile

recordsofcounter,click[sure]toreturn.

[datasamplinginterval],howlongthecounterdatais

specifiediscollectedonce,anditisnotedthattheover-dense

collectionintervalwillaffectthenormaloperationofthe

systemandcausehugelogfiles.

[plan]TAB,specifythelogstartandstoptime,which

canbeselectedby:manually,specifyingstartingorending

k.

electthemanualstartandstoplog,ifyouselect

themanualstart-stoplog,youcanright-clicktheloginthe

loglistandselect[start],andthelogiconturnsgreen.

Addthefollowingcounterstoobservethechartchanges.

1)findmemorybottlenecks

Usethefollowingcountersintheperformancetooltoidentify

thememoryresourcesthathavebottlenecks:

(a)SystemProcessorQueueLength

(b)MemoryPages/SEC

2)finddiskbottlenecks

Usethefollowingcountersintheperformancetooltoidentify

diskresourcesthathavebottlenecks:

(a)PhysicalDisk%DiskTimeand%IdleTime

(b)PhysicalDiskDiskReads/SECandDisk/SEC

(c)eueLength

(d)LogicalDisk%FreeSpace

Alsomonitorthememorycountertodetermineifthereistoo

muchmemorypagingtomakediskusenervous.

Note:unlikephysicaldiskcounters,thelogicaldiskcounter

gettheperformancecounterdataforalogicaldriveorstorage

volume,youmusttypediskperfatthecommandprompt

sultsinadiskperformancestatisticsdriverfor

collectingdiskperformancedatatoreportlogicaldrivesand

ult,theoperatingsystemUSES

diskperf-yd

e

informationaboutusingthediskperfcommand,typediskperfat

thecommandprompt-?Itis.

3)findprocessorbottlenecks

Usethefollowingcountersintheperformancetooltoidentify

theprocessorresourcethathasthebottleneck:

(a)ProcessorInterrupts/SEC

(b)Processor%ProcessorTime

(c)Process%ProcessorTime

(d)SystemProcessorQueueLength

4)findanetworkbottleneck

Usethefollowingcountersintheperformancetooltoidentify

thenetworkresourcethathasthebottleneck

(a)NetworkInterfaceBytesTotal/SEC,BytesSent/SECandBytes

AReceived/SEC

(b)theProtocol_layer_objectisReceived/SEC/SEC

Sent/SEC,FramesSent/SECandFramesReceived/SECforNWLink

Theperformanceobject,whichisassociatedwiththeframe,

tagrambasedcounterforthese

objects.

(c)ServerBytesTotal/SEC,BytesReceived/SECandBytes

Sent/SEC

(d)NetworkUtilization

ThesystemmonitorsavesthecounterdataintheformofaBLG

file(thedefaultlocationisthePerfLogsdirectoryofthe

systempartition).Oncetherecordisstarted,thecounterdata

isperiodicallyloggedin(accordingtothesamplinginterval)

untilthelogiscompletedorthelogrecordisstopped

manually.

ishperformancealarms

Systemmonitorcancontinuetorecordacountervalue,butin

somecases,weonlyneedtimelylearnacountervalueexceed

thespecifiedlimitorlowerlimit,thisisabouttouse

hodtocreateanalarminthesystem

monitorisasfollows:

thesystemmonitor[performancelogandalarm]node,

rightclick[alarm],select[newalarmSettings].

ythenameofthenewalarm,andclickok.

lertpropertiesdialogbox,click[add]toopenthe

addcounterdialogbox.

ytheobjectsandcountersthatneedtocreatethe

alert,andthecounterinstance,andthenclickadd.

5,

Selectthecounterinthe[counter]listtospecifyanalarm

range,thatis,whenthevalueoftheselectedcounteris

exceededorbelowthelimitvalue,thealarmisactivated.

Specifyarestrictionfromthedrop-downlistto[exceed]or

[lower],andspecifythelimitvalueinthe[limit]column.

6,atthebottomofthe"regular"TABtospecifycounterdata

samplinginterval,forreal-timedatatypes,themonitortothe

specifiedsamplingintervalasabenchmarkfortheaveragedata,

andcomparetolimittodeterminewhethertheaveragealert.

7,

ClickontheplanTAB,

Specifyaneffectivetimeperiodforanalertservicejob,which

canbeselectedbyspecifyingthestartingandendingtime,

specifyingacontinuousworkingtime,andstartingmanually.

Forcontinuousalarmrequirements,thealarmshouldbestarted

manuallyuntilthealarmisnotneeded.

Eight,

ClickontheTAB,asshownontheright,towherethealarmwill

lly,you

shouldselectthe[entryapplicationeventlog]checkboxto

[sendnetworkinformation

to]checkboxandspecifythecomputertosendalertstothe

alsochoosetoexecutethe

programandspecifyaprogramthatwillbeautomatically

executedafterthealertisissued,oryoucanclickonthe

commandlineparametertospecifythesystemcommandthatwill

beautomaticallyexecutedafteranalertisissued.

ktoclosethedialogbox.

Manuallystartthealarmserviceaccordingtotheneed.

Right-clickonthealertinthelistandselectstartalert.

Oncestartedthealarm,thesystemwillcontinuetomonitorthe

monitoralarmcounter,founditsvalueexceedslimitalarm

informationimmediatelysenttothespecifiednetworklocation

orperformpredefinedapplication,atthesametimeinthe

tcommonalert

isthemonitoringserver'savailablediskspacealert,which

givestheadministratorinformationaboutinsufficientdisk

spaceintimetoavoidtheresultingloss.

Monitorthenetwork

lnetworkmonitor

1)click"start"andselectthecontrolpanel

2)opentheadd/removeprogramdialogbox

3)select"add/removeWindowscomponents"

4)selectmanagementandmonitoringtoolsintheWindows

componentwizard,andthenclickdetails

5)selectthenetworkmonitoringtoolcheckbox,andthenclick

ok

6)ifthesystempromptsforotherfiles,inserttheWindows

2000ServerCD,ortypethefilelocationpathonthenetwork

arwithsoftwareinterface

1)grabwindow:analyzetheoverallperformanceofthenetwork,

andcanstartandstopthenetworkfetchingfunction,savethe

viewandgrabthefilter

indow4areas:

Graphicspane:graphicaldisplayofnetworkactivity.

Sessionstatisticspane:summarizetheinformationtransferred

betweentwohoststoindicatewhichhostissendingthe

broadcastormulticastinformation.

Aggregatedatapane:displaystatisticsofallcaptured

information,captureddataframestatistics,network

utilizationpersecond,andnetworkadaptercardstatistics.

Workstationstatisticspane:summarizingthehostsendingthe

numberoftotalnumberandreceivingdataframes,sendand

receivedataframesandthenumberofbytes,andsendthenumber

ofbroadcastframesandmulticastframes

2)grabsummaryinformationwindow:grabtheinformationand

checkthecontent.

eanddisplaynetworkinformation:noticethe

informationthatshowsinterestandthemethodtosetup

fetchingfilter.

ThecaptureanddisplayinstanceoftheinformationoftheARP

(anaddresstranslationprotocolthatisinvolvedinthePing

command)

1)click"start","program",andselect"networkmonitoring

tool".

2)ifthisisthefirsttimetovisitthe"networkmonitoring

tool",thesystemwillpromptyoutoselectanetwork."Capture"

thenetworkthatselectsyourserverconnection.

3)the"networkmonitoringtool"grabsthewindow,andonthe

"capture"menu,clickstart.

4)sendthepingcommandtoacomputeronthelocalsubnetat

thecommandwindow.

5)select"stopandview"onthe"capture"ture

summaryinformationwindowofthenetworkmonitorappears.

6)onthedisplaymenu,click"color",select"ARP_RARP",

selectabackgroundcolor,clickok,andallARPdataframes

aredisplayedusingthiscolor.

7)double-clicktheARPdataframetoviewthecontent.

8)usethecontrolbuttontocontrolthecontentandform

displayed.

9)theARPresponseframeisalsodisplayedtoseetheresults

ofthetransformation.

10)usethefilemenutosavefetchinginformation.

4,grabthedefaultdirectoryfilewinntsystem32netmon

captures

Click[start],[program],[managementtool],[networkmonitor],

[capture]menu,select[start],startthenetworkmonitor

capturefunction.

Checktheleftupper-sidepaneforinformationaboutnetwork

physicalfeaturessuchasnetworkutilizationandnumberof

formationiscriticaltodetermine

rkthatisofteninhigh

utilizationshouldobviouslyupgrade.

Therightpanedisplaysstatisticsonnetworkmonitors,

includingnetworkstatistics,statisticspersecond,capture

statistics,anderrorstatistics.

Thelowerpaneofthenetworkmonitorprovidesmonitoringtools

foreachnetworkhosttolearnabouttheworkofothercomputers

andtofindunauthorizedcomputers.

Checkthecapturefilterforthenetworkmonitor,asshownin

nfilteristhehostaddress,and

double-clickthe[addresspair]inthedialogbox,asshownin

thefigurebelow,tospecifythepackettocapturethespecial

host.