taken from: by ray rankins, paul jensen and paul bertucci by … · 2009-09-04 · table of...

Taken from:

Microsoft® SQL Server™ 2000 Unleashed, Second Editionby Ray Rankins, Paul Jensen and Paul BertucciCopyright © 2002 by Sams PublishingA Pearson Education CompanyIndianapolis, Indiana 46290

Microsoft® SQL Server™ 2000 DBA Survival Guide, Second Editionby Mark Spenik and Orryn Sledge Copyright © 2003 by Sams Publishing.

Microsoft® SQL Server™ Unleashedby Ray Rankins, Paul Jensen and Paul Bertucci Copyright © 2002 by Sams Publishing

MCSA/MCSE Managing and Maintaining a Microsoft® Windows® Server 2003 Environment Exam Cram™ 2 (Exam70-290)by Dan BalterCopyright © 2004 by Que CertificationA Pearson Education CompanyIndianapolis, Indiana 46290

Proven Portals: Best Practices for Planning, Designing, and Developing Enterprise Portalsby Dan SullivanCopyright © 2004 Pearson Education, Inc.Published by Addison-Wesley, Inc.Boston, Massachusetts 02116

.NET Enterprise Design with Visual Basic® .NET and SQL Server 2000by Jimmy NilssonCopyright © 2002 by Sams Publishing.

Microsoft®.NET Compact Framework Kick Startby Erik Rubin and Ronnie YatesCopyright © 2004 by Sams Publishing.

A First Look at ADO.NET and System.Xml v. 2.0by Alex Homer, Dave Sussman, and Mark FussellCopyright © 2004 Microsoft CorporationPublished by Addison-Wesley, Inc.

MCSE Training Guide (70-229): Designing and Implementing Databases with Microsoft SQL Server™ 2000, EnterpriseEditionby Thomas MooreCopyright © 2002 by Que Publishing

XML and SQL Server: Developing Web Applicationsby Daniel K. Appelquist

®

Copyright © 2002 by Pearson Education, Inc.Published by Addison-Wesley, Inc.

All rights reserved. No part of this book may be reproduced, in any form or by any means, without permissionin writing from the publisher.

This special edition published in cooperation with Pearson Custom Publishing.

Microsoft, Visual Basic, and Windows are registered trademarks of Microsoft Corporation. SQL is a trademark ofMicrosoft Corporation.

Printed in the United States of America

10 9 8 7 6 5 4 3 2 1

ISBN 0-536-84160-8

2004200135

EH

Please visit our web site at www.pearsoncustom.com

PEARSON CUSTOM PUBLISHING75 Arlington Street, Suite 300, Boston, MA 02116A Pearson Education Company

TABLE OF CONTENTS

Chapter 1: Database Design and PerformanceExcerpted from: Microsoft® SQL ServerTM 2000 Unleashed, by Ray Rankins, Paul Jensen, and Paul Bertucci

Basic Tenets of Designing for Performance

Read CommittedNormalization FormsSerializable

Denormalizing the DatabaseDenormalization GuidelinesQuerying the syslockinfo TableViewing Locking Activity with SQL Enterprise ManagerEssential Denormalization Techniques

Indexes and PerformanceEvaluating Index UsefulnessDistribution Data

Index Design GuidelinesClustered Index IndicationsNonclustered Index IndicationsIndex Covering Composite Indexes Versus Multiple Indexes

SQL Server Index Maintenance

Minimizing Locking ContentionFixing Fragmented Tables

Lock Granularitry HintsUpdate in Place

Database File Groups and Performance

Summary

Chapter 2: Monitoring, Optimizing, and Troubleshooting Server Performance ® Server 2003 Environment

Exam Cram 2, by Dan BalterMonitoring and Analyzing System Events

Working with the Event Viewer Working with the System Monitor

Monitoring System Performance Using System Monitoring in Real Time with Task Manager Using Real Time Monitoring with System Monitor

Logical Database Design IssuesNormalization Conditions

Running DBCC SHOWCONTIGExtent Fragmentation

Setting the Fill FactorReapplying the Fill Factor

Updates and Performance Deferred Update

RAID Level 1RAID Level 10

RAID TechnologyRAID Level 0

RAID Level 15

®Excerpted from: MCSA MCSE 70-290: Managing and Maintaining a Microsoft WindowsTM

Monitoring File and Print Services Monitoring General Server Workload with Task Manager Monitoring Disk Quotas with the Event Viewer Troubleshooting Server Bottlenecks with System Monitor

Monitoring and Optimizing Application Server Performance Monitoring Processor Usage Monitoring Memory Usage Monitoring Disk Usage Monitoring Network Usage

Managing Software Site Licensing Understanding Microsoft Licensing Using the Licensing Tools

Administering and Troubleshooting Network Print Queues Setting Printer Priority and Availability Levels Working with Print Queues

Managing Operating System Updates with SUS Installing SUS Server-Side Components Setting Up SUS Automatic Updates for Client Computers Backing Up the SUS Server

Exam Prep Questions Need to Know More?

Chapter 3: Delivering Business Intelligence and Analytics on Demand Excerpted from: Proven Portals: Best Practices for Planning, Designing, and Developing Enterprise Portals, by Dan Sullivan

Understanding Operations: Business Intelligence and Data Warehousing Characteristics of Data Warehouses The Data Warehouse Environment

Source Systems Extraction, Transformation, and Load Systems Data Warehouse Repository Reporting Tools and Portals

Facilitating Operations: Analytic Services Conclusion References

Chapter 4: Configuring, Tuning, and Optimizing SQL Server Options Excerpted from: Microsoft® SQL ServerTM 2000 Unleashed, Second Edition, by Ray Rankins, Paul Bertucci, and Paul Jensen

SQL Server Instance Architecture Configuration Options Fixing an Incorrect Option Setting Setting Configuration Options with SQL Enterprise Manager Obsolete Configuration Options Configuration Options and Performance

Affinity Mask Allow Update AWE Enabled Cost Threshold for Parallelism Cursor Threshold Default Language Fill Factor Index Create Memory (KB) Lightweight Pooling Locks Max Degree of Parallelism Max Server Memory and Min Server Memory

Max Text Repl Size Max Worker Threads Min Memory Per Query Nested Triggers Network Packet Size Open Objects Priority Boost Query Governor Cost Limit Query Wait Recovery Interval Remote Proc Trans Scan for Startup Procs Set Working Set Size Show Advanced Options User Connections User Options

Summary

Chapter 5: Using Stored Procedures and Cursors Excerpted from: Microsoft® SQL ServerTM 2000 DBA Survival Guide, Second Edition , by Mark Spenik and Orryn Sledge

What Is a Stored Procedure? Stored Procedure Pros and Cons How to Create a Stored Procedure How to Modify a Stored Procedure Control-of -Flow Language

The DECLARE Statement The GOTO Statement The BEGIN...END Statement The IF...ELSE Statement The WAITFOR Statement The RETURN Statement The WHILE, BREAK, and CONTINUE Statements The PRINT Statement The RAISERROR Statement Comments

Parameters Used with Stored Procedures Input Parameters Output Parameters

Commonly Used Global Variables How to Debug a Stored Procedure

Transact-SQL Debugger Transact-SQL Debug Statements

What is a Cursor? Creating a Cursor

Step 1: DECLARE the Cursor

Step 3: FETCH the Cursor Step 4: CLOSE or DEALLOCATE the CursorPositional UPDATE and DELETE Global Variables

Putting It All Together Example 1: Loop Through a Table Example 2: Display Object Names and Object Types

Stored Procedure and Cursor FAQ Summary

Step 2: OPEN the Cursor

Other Debugging Tools

Chapter 6: Planning an Installation or Upgrade Excerpted from: Microsoft® SQL ServerTM 2000 DBA Survival Guide, Second Edition, by Mark Spenik and Orryn Sledge

Development an Installation Strategy and Plan Step 1: Determine System Strategy and Plan Step 2: Select the Right Platform Step 3: Answer Required Questions and Understand Why They Are Important Step 4: Install SQL Server

Developing an Upgrade Strategy and Plan Upgrade/Installation Planning FAQ Summary The Upgrade Checklist

Chapter 7: Data Access Excerpted from: .NET Enterprise Design with Visual Basic® .NET and SQL Server 2000, by Jimmy Nilsson

My Proposal for a Data Access Pattern How Stored Procedures Are Normally Called with ADO.NET My Data Access Proposal in Detail The Generated SQL Script External Design of My Data Access Proposal Internal Design of My Data Access Proposal Debugging Connection Strategy OUTPUT Parameters Tricky Cases of SQL Disadvantages with the Proposal

The Data Access Proposal in the Architecture What to Use for Carrying Data

Saying More in Fewer Words When Calling Stored Procedures XLM Other Formats Bitmaps Data Transportation Between Stored Procedures

Server-Side Caching New Server-Side Caching Potential with .NET

Dealing with Schema Changes Using User-Defined Data Types Using Too-Large CHAR and VARCHAR Parameters Dragging Out Parameters from Stored Procedures and Using Them as Constants Using Views and/or UDFs

Evaluation of My Proposal What’s Next References

Chapter 8: ADO.NET- The Data Access Model for the .NET Compact Framework

Introducing ADO.NET on the .NET Compact Framework Caching Data with the DataSet

Looking Inside the DataSet: DataTables, DataRows, and DataColumns Inserting Data into a DataSet Building a DataSet to Hold a Phone Book Extracting Data from a DataSet Altering Data in a DataSet Designing a PhoneBook Application with a DataSet

Excerpted from: Microsoft .NET Compact Framework Kick Start, by Erik Rubin and Ronnie Yates®

Troubleshooting Common DataSet-Related Errors Understanding Constraints

Adding Constraints to a Dataset Adding a UniqueConstraint Working with a UniqueConstraint by Example Preventing NULL Values in a DataColumn

Setting Up Autoincremented Fields Creating Autoincremented Field Code by Example Updating the PhoneBook Application with Constraints and Autoincremented Fields

Modeling Relational Data with the DataSet Deriving DataColumn Values with Expressions and Computed Fields Expressing Parent-Child Relationships in a DataSet

Creating Bindable Views of Data with a DataView Sorting with the DataView Sorting and Filtering Data in a Sample Application Tracking Changes in a DataRow Filtering with the DataView Adding Data into a DataView Using a DataView in a Sample Application: DataView_SortByRowState_AddTables

Binding Data to a Control Binding to a DataGrid Using Data Binding in a Sample Application

Comparing the Compact DataSet with the Desktop DataSet In Brief

Chapter 9: XQuery and SQL Server Excerpted from: A First Look at ADO.NET and System.Xml v. 2.0, by Alex Homer, Dave Sussman, and Mark Fussell

A Very Brief Overview of the XQuery Language Where’s the Data Located? FLWOR Expressions

The XQueryProcessor Class The Properties and Methods of the XQueryProcessor Class The XmlCommand Class Querying an XML Document with the XQueryProcessor Class Querying Multiple XML Documents with the XQueryProcessor Class Using an XQueryProcessor with an XLM View Using an XQueryProcessor with Multiple XML Views Using an XQueryProcessor with Multiple XML Views and Multiple Database

Connections Using an XQueryProcessor with Multiple XML Views and XML Documents

The XsltProcessor Class Transforming XML Documents with the XsltProcessor Class

The Common Query Architecture SQL Server as an XML Database

The XML Data Type in SQL Server “Yukon” Typed and Untyped XML Data Columns The XML Schema Repository in SQL Server “Yukon” Inserting and Selecting Against an XML Data Column Querying and updating the Contents of an XML Data ColumnBinding Relational Data Inside XML Indexing an XML Data Column

Summary Index

Chapter 10: Monitoring and Tuning SQL Server Databases

Introduction Tools Available for Monitoring and Tuning

Stored Procedures Used to Diagnose and Optimize Database Console Command (DBCC) Alternative Mechanisms

Optimizing the OS Configuration Using Performance/System Monitor Counter Values The Event Viewer The Windows Application Log Query Governor Cost Limit

Optimizing SQL Server Configuration Current Server Activity Stored Procedures

Monitor Activity with the ProfilerDefining a Profiler Trace Profiler Traces to Diagnose Locking Using Profiler Results

Trace Playback and Diagnosis Playback Requirements Performing the Replay Templates and Wizards for Specific Monitoring

SQL Server Optimizer Query Analyzer Proactive/Automated Optimization

Security Objects C2 Security Statement and Object Permissions Security Audits Exercises Review Questions Exam Questions Answers to Review Questions Answers to Exam Questions

Part II Final ReviewFast Facts SQL Server 2000 Requirements

SQL Server 2000 Enterprise Edition Database Design for SQL Server 2000

ER Modeling Primary Keys Foreign Keys One-To-One Relationship One-To-Many Relationship Many-To -Many Relationship Entity Integrity Domain Integrity Referential Integrity Advanced Referential Integrity Options SQL Server Data Types

Physical Database Design and Implementation Database Creation Shrinking Files

Excerpted from: MCSE Training Guide (70-229): Designing and Implementing Databases with Microsoft® SQL Server™,2000 Enterprise Edition, by Thomas Moore, MCSE, MCSD, MCDBA, MCT, CTT

Column Properties Check Constraints Clustered Indexing Nonclustered Indexing Encryption Can Secure Definitions Schema Binding Indexed Views Data Integrity Options

Querying and Modifying Data SQL SELECTDATEADD, DATEDIFF, DATENAME, DATEPART Inserting Data Inserting Data Using SELECT Deleting Data Updating Data

Advanced Data Retrieval and Modification Joins Using GROUP BY Using GROUP BY and HAVING Using COMPUTE and COMPUTE BY Using OPENROWSET and OPEN QUERY Linked Server XML Data Transformations

Programming SQL Server 2000 Scripts, Batches, and Transactions Variable Types Global Variables Using Cursors Lock Isolation Levels Designing and Managing Transactions Statement Permissions Object Permissions User Roles Fixed Roles Application Roles

Working with Views Views Partitioned Views Broken Ownership Chains

Use of Triggers Recursive Triggers INSTEAD OF Triggers

Stored Producers and User-Defined Functions Stored Procedures Cursor Status Error Handling User-Defined Functions

Boosting Performance with Indexes Clustered Indexes Nonclustered Indexes Index Selectivity Indexed Views Indexed Views Requirements and Restrictions

Implementing and Understanding Replication Methodologies Monitoring and Tuning SQL Server Databases Tools Simple Network Management Protocol (SNMP)

System Monitor Study Exam Prep Tips Learning Styles Study Tips

Study Strategies Macro and Micro Study Strategies Active Study Strategies Common-Sense Strategies Pre-Testing Yourself

Exam Prep Tips The MCP Exam Exam Format Fixed-Form Adaptive Form Case Study Form Question Types Multiple-Choice Questions Multiple-Rating Questions Simulation Questions Hot Area Questions Drag-and-Drop-Style Questions Ordered List Questions Tree Questions Putting It All Together More Exam Preparation Tips During the Exam Session

Chapter 11: XML and SQL Server 2000 Excerpted from: XML and SQL Server: Developing Web Applications, by Daniel K. Appelquist

Retrieving Data in XML Format FOR XML FOR XML AUTO FOR XML EXPLICIT

Communicating with SQL Server over the Web Under the Hood

Retrieving Data in XML Format-Continued SQL Queries in URLs Template Files XPath Queries HTTP Post Queries XML Views

Defining XML Views Let SQL Server Do the Work Working with XML Documents

OPENXML Summary

Chapter 12: SQL Server Internals Excerpted from: Microsoft® SQL ServerTM 2000 Unleashed, Second Edition, by Ray Rankins, Paul Bertucci, and Paul Jensen

SQL Server Memory Management The Buffer Manager and Memory Pools The Buffer Manager Accessing Memory Buffers The Checkpoint Process The Lazywriter Process

Keeping Pages with Cache Permanently Large Memory Support The Log Manager

SQL Server Process Management SQL Server Threads

SQL Server Disk I/O Asynchronous I/O Scatter-Gather I/O Read Ahead Reads

SQL Server Storage Structures Database Files and Filegroups

Primary Data File Secondary Data Files The Log File Using Filegroups On-Demand Disk Managment

Database Pages Page Types Examining Page Content Data Pages Index Pages Differential Changed Map Pages Bulk Changed Map Pages

Tables Size Limits for Rows and Columns Heap Tables Clustered Tables

Indexes Clustered Indexes Nonclustered Indexes SQL Server Index Maintenance

Data Modification and Performance Inserting Data Deleting Rows Updating Rows

Summary

Merry-Go-Round Scan

1

Introducing the VERITAS “SQL Server Performance Series”

WHAT IS THE “SQL SERVER PERFORMANCE SERIES?”

The VERITAS “SQL Server Performance Series” is a yearlong educational program designedby VERITAS and developed in concert with the Pearson Technology Group. The programprovides expert content on topical SQL Server development and runtime concerns with afocus on application performance management. The foundation of the program is acustom e-book. The e-book consists of twelve unique chapters from twelve different books.Each month a new chapter will be released and promoted. VERITAS will also conduct aWebcast each month with one or multiple authors. Each Webcast will focus on the specificcontent of the chapter released that month and will provide a forum to ask industry expertsSQL Server questions.

CONTENT OF THE E-BOOK

Unlike more traditional e-books that offer content from a single book, the e-book from the“SQL Server Performance Series” is a compilation of content from twelve different books andover twenty different authors. Each chapter will focus on a different aspect of SQL Serverapplication development and deployment.

Chapter 1 Database Design and PerformanceThis chapter will help you understand some of the key application design issues that willensure you have a reliable and high-performance application. These factors include logicaldesign, physical design, choice of hardware, network bandwidth, client and serverconfiguration, data access techniques, and application architecture.

Chapter 2 Monitoring, Optimizing, and Troubleshooting Server PerformanceThis chapter describes how Server performance can degrade over time as more users, moreworkstations, and more demands are placed on server resources and ultimately impact theperformance of SQL Server. Windows Server 2003 offers administrators several built-in toolsfor monitoring, optimizing, and troubleshooting a server's performance

Chapter 3 Delivering Business Intelligence and Analytics on DemandThis chapter provides an overview of data warehousing and analytic applications that supportbusiness intelligence. The design of these systems is fundamentally different from the morecommon transaction-oriented relational databases so we delve into some of theimplementation details of data warehouses.

2

This chapter will delve into what can be done in the SQL Server configurableoptions—particularly, what can be improved that SQL Server isn't automatically tuningalready. By setting the values of several key SQL Server configuration parameters, you canfine-tune SQL Server to provide excellent performance and throughput.

Chapter 5 Using Stored Procedures and CursorsThis chapter will enhance your knowledge of stored procedures and cursors. As a DBA, youuse stored procedures frequently. Microsoft supplies many stored procedures that you use toperform database and system maintenance. You will also find that you are frequentlyrequired to write your own stored procedures to perform specific DBA tasks for yourorganization or to help a group of developers solve a complex business problem.

Chapter 6 Planning an Installation or UpgradeIn this chapter, you will learn to develop plans and strategies to help you correctly install orupgrade SQL Server. Why bother with a planning stage? Why not just skip right to theinstallation or upgrade? SQL Server installation and upgrading is a simple process, but, byplanning, you can make the correct decisions that affect the performance and operation ofSQL Server before the installation.

Chapter 7 Data AccessMost distributed applications rely on a data tier: a single layer where all information resides.The data tier is one of the most critical areas of a distributed application because adisproportionate amount of the weight tends to fall on it. All too often, the data tier becomesthe first bottleneck of a growing system as demand outstrips the system's ability to createconnections or retrieve data.

Chapter 8 ADO.Net – The data access model for the .Net Compact FrameworkThis chapter will first examine the retrieval and update of data from a SQL Server database.It will also examine in detail the process of reconnecting to the data source and sendingupdated data back into the database.

Chapter 9 XQuery and SQL ServerIn this chapter, we'll look in more detail at the XQuery language, the XQueryProcessor class,and how they can be used to perform queries over XML documents loaded into anXPathDocument2 and over SQL Server using XML views.

Chapter 10 Monitoring and Tuning SQL Server DatabasesThis chapter will review how SQL Server and the operating system work together to providea productive database management environment. There are many SQL Server hooks intothe operating system and OS resources available to observe the database server as itoperates. Other tools allow for quick diagnosis of problems that may be affecting the server.

Chapter 4 Configuring, Tuning, and Optimizing SQL Server Options

3

You will come away from this chapter with concrete knowledge of how XML and SQL can bemarried in a powerful way at the level of a relational database server. You can apply thisknowledge to your own projects, using either SQL Server 2000 or some other relationaldatabase server, such as Oracle, that might have similar features.

Chapter 12 SQL Server InternalsThis chapter looks at the internal architecture as well as the storage structures in SQL Serverand how the storage structures are maintained and managed. This information will help youbetter understand various issues associated with migrating from an earlier version or from adifferent RDBMS.

Chapter 11 XML and SQL Server 2000

Monitoring, Optimizing, and Troubleshooting

C H A P T E R

2

BUYBOOKHERE

Server Performance

® Server 2003 Environment Exam Cram 2, by Dan Balter

®Excerpted from: MCSA MCSE 70-290: Managing and Maintaining a Microsoft WindowsTM

http://www.informit.com/sales/ad

Monitoring, Optimizing, andTroubleshooting ServerPerformance

Terms you’ll need to understand:

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

6

✓ Event Viewer ✓ Task Manager✓ System Monitor✓ Performance logs and alerts ✓ Performance objects

✓ Performance counters✓ Performance object instances✓ Network print queues✓ Enterprise licensing✓ Software Update Services (SUS)

Techniques you’ll need to master:✓ Monitoring events with the Event Viewer✓ Monitoring and managing applications,

processes, and current system vital signswith Task Manager

✓ Using the Performance snap-in ✓ Viewing real-time server performance data

with the System Monitor tool✓ Recording logged server performance data

with performance logs and alerts

✓ Choosing Microsoft licensing options: perserver, per device or per user, and perprocessor

✓ Monitoring software licensing compliance✓ Managing and troubleshooting network

printing✓ Monitoring and optimizing server perform-

ance✓ Setting up Software Update Services (SUS)

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Chapter 6214

Server performance can degrade over time as more users, more workstations,and more demands are placed on server resources. Windows Server 2003offers administrators several built-in tools for monitoring, optimizing, andtroubleshooting a server’s performance. The Task Manager tool can tell ushow the server’s memory, network, and processor utilization are doing. TheEvent Viewer snap-in can show us both recent and past events that might beimpacting the server’s robustness. The System Monitor tool can diagramseveral vital aspects (or counters) of computer health in real time as well ascreate a historical log of these various system counters to establish a baselineof performance over a period of time.

You need the Licensing tool along with the Active Directory Sites andServices snap-in to properly set up, manage, and monitor software sitelicensing, which is also covered in this chapter. Network printing and net-work print queues need attention from time to time, so this chapter focuseson how to manage these important services. Finally, we look at the latestdevelopments from Microsoft to help administrators more easily deploy hot-fixes and other operating system updates using SUS—Software UpdateServices.

Monitoring and Analyzing SystemEventsMany different processes are constantly running on computers, especially onserver systems. Operating system and third-party services run in the back-ground, application programs run in the foreground for users on TerminalServer systems, and network applications, such as Microsoft SQL Server orExchange Server, run in the background. Don’t forget about other programsthat run in the foreground that are executed by administrators performingroutine management chores, such as the Active Directory Users andComputers console, Terminal Services Manager, and other utilities.

All the processes that run on a server communicate with the operating sys-tem, which in turn communicates with other subsystems and the computer’shardware devices. The messages that are sent back and forth between appli-cation programs and the operating system can generate different types ofevents. Windows Server 2003 records these events in log files. You can viewthe events stored in these log files by using the Event Viewer snap-in,eventvwr.msc. All the processes that run on a server are executing program-ming code that must be transferred into and out of the computer’s memory.The programming code is executed by the computer’s central processing unit

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Monitoring, Optimizing, and Troubleshooting Server Performance 215

(CPU), often called the “processor,” and the executing code resides withinfiles that are stored on disk subsystems. The data that is manipulated by theseprocesses is also stored on disk subsystems. The System Monitor node of thePerformance snap-in can track processor utilization, memory utilization, anddisk utilization, among several other items.

Working with the Event ViewerYou can launch the Event Viewer snap-in tool by clicking Start, (All)Programs, Administrative Tools, Event Viewer, or simply click Start, Run;type eventvwr.msc; and click OK. Events are recorded into log files by theEvent Log service, which is configured to run at system startup by default.All Event Log files are stored in the %systemroot%\system32\config folder bydefault. Event log files are identified with the .evt filename extension. Theselog files are not text files; you cannot view them using a simple text editorsuch as Notepad. You can easily save the .evt files in various text-readableformats, which are covered later in this chapter. On Windows Server 2003standalone computers and domain member servers, there are just three dif-ferent event logs:

➤ Application—This log records events that are generated by applicationprograms and network application services such as Microsoft SQLServer and Exchange Server. The name of this log file stored on disk isAppEvent.Evt.

➤ Security—This log records success and failure notifications for auditedevents. Administrators can configure various auditing settings throughlocal or group policies; the results of those audited events get recordedin the security log. Only users who have been granted the user rightcalled Manage Auditing and the Security Log may access the securitylog; members of the Administrators group retain this right by default.The name of this log file stored on disk is SecEvent.Evt.

➤ System—This log records events generated by the operating system andits subsystems, such as its device drivers and services. The name of thislog file stored on disk is SysEvent.Evt.

For Windows Server 2003 computers that have been set up as domain con-trollers (DCs), the Active Directory Installation Wizard (DCPROMO.exe) addsthree other event logs, as shown in Figure 6.1. These additional logs moni-tor vital parts of Active Directory, such as the directory service itself, the FileReplication Service, and the DNS (Domain Name System) server (if theDNS Server service is installed on the DC). The three additional event logsfor DCs are

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Chapter 6216

➤ Directory Service—This log records events that are generated by theActive Directory service itself. The name of this log file stored on disk isNTDS.Evt.

➤ DNS Server—This log records DNS queries, DNS replies, and assortedother DNS-related activities. The name of this log file stored on disk isDnsEvent.Evt.

➤ File Replication Service—This log records activities related to the FileReplication Service, including messages about replication problemsbetween DCs. The name of this log file stored on disk is NtFrs.Evt.

Figure 6.1 Looking at system events in the Event Viewer for a domain controller.

Viewing Event LogsAfter you launch the Event Viewer, you can select the log you want to lookat in the left pane; the events then appear in the right (details) pane, as youcan see in Figure 6.1. When you double-click an event, its properties windowappears, as shown in Figure 6.2. An event’s properties window displays thedetails of the event, including the date, time, computer name, event ID, anda description of the event itself. The Event Viewer displays five types ofevents:

➤ Error—These events are recorded whenever significant problems occur,such as the loss of data or the loss of functionality. Unexpected systemshutdowns and the failure of a service to start automatically at boot timeare examples of events that are logged as errors.

➤ Warning—These events are recorded to indicate possible future prob-lems. Low disk space for a drive volume is an example of an event thatmight get logged as a warning.


➤ Information—These events are recorded often. They indicate the suc-cessful operation of a program, a device driver, or a service. For exam-ple, Event ID 6005 indicates that “The Event Service was started”; thisevent usually occurs when the computer is started or restarted.

➤ Failure Audit—These events are recorded each time that any auditedsecurity event fails. For example, if a user attempts to log onto the com-puter without the proper username or password, a failure audit event islogged if the policy setting for Audit Account Logon Events is set toSuccess, Failure or if it’s set only to Failure. You can configure AuditPolicy settings at the local or group policy levels.

➤ Success Audit—These events are recorded each time that any auditedsecurity event succeeds. For example, if a user successfully logs onto thecomputer, a success audit event is logged if the policy setting for AuditAccount Logon Events is set to Success, Failure or if it’s set only toSuccess. You can configure Audit Policy settings at the local or grouppolicy levels.

Figure 6.2 Viewing the event properties dialog.

Audit policy settings are available at the local, site, domain, DC, and organizationalunit (OU) policy levels. You can use the Local Security Settings snap-in, the DefaultDomain Security Settings snap-in, the Default Domain Controller Security Settingssnap-in, or the Group Policy Object Editor snap-in for a site or an OU to affect auditpolicy settings. From one of the snap-ins just mentioned, expand the Security Settingsnode, expand the Local Policies subnode, and select the Audit Policy subnode.Double-click the policy setting listed in the details pane to configure it, as shown inFigure 6.3.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Chapter 6218

Figure 6.3 Configuring Audit Policy settings.

Archiving Event Logs, Setting Options, and Filtering EventsEvent logs fill up over time. By default, the maximum log size for each eventlog is 16,384KB. By default, when the log reaches its maximum size, it over-writes events as needed. If you want to manually clear a log, right-click thelog (in the left pane of the Event Viewer) and select Clear All Events. A mes-sage box asks whether you want to save the events contained in this logbefore you clear them. If you click Yes, the Save As dialog box prompts youto choose a location on disk, a filename for this log, and the file type to savethis log as—Event Log (.evt), Text (tab delimited, *.txt), or CSV (commadelimited, *,csv).

You can open logs saved in the .evt file format within the Event Viewer. Youcan right-click a log in the Event Viewer, select Open Log File, and thenspecify the location and name of the file to open it. You can also right-clickthe Event Viewer root node and select Open Log File to open a log file with-out closing any of the existing logs. You can open logs saved in the .txt fileformat in any text editor or word-processing program. You can open logssaved in the .csv file format in applications such as Microsoft Excel orNotepad. However, the Event Viewer cannot itself open logs saved as .txt or.csv files.

If you right-click one of the Event logs in the left pane of the Event Viewerand select Properties, from the General tab, you can view and configureoption settings for that specific Event Log, as shown in Figure 6.4. You canchange the maximum log size, configure log overwrite settings, specifywhether you’re using a low-speed connection, clear the log, and restore allthe default settings for the log from its properties sheet. The default settingfor event logs is to overwrite events as necessary after reaching the maximumlog size. Also from the log’s properties sheet, you can click the Filter tab tofilter and sort all the different events contained in the log (see Figure 6.5).


Figure 6.4 Configuring Event Log option settings for the System log.

Figure 6.5 Setting sorting and filtering options for the System log.

If you right-click a log, you can take advantage of a new feature of Windows Server2003 called new log view. When you create a new log view, you can specify how theEvent Viewer presents the log instead of always modifying the default display set-tings for the log. You can give this new log view a custom name, and you can man-age it just like any other log. If you create a custom MMC snap-in, your customizedsettings for each new log view are maintained while the settings for the original logon which the new log view is based are left alone.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Chapter 6220

Working with the System MonitorThe System Monitor tool is available as a node within the Performance snap-in, perfmon.msc. The System monitor can display performance data about thelocal computer, or it can display performance data on one or more remotecomputers in real time. The System Monitor tool can also log a history ofperformance results over time for local or remote computers. To monitorsystem performance, you must specify performance objects, counters, andinstances of those objects so that the System Monitor knows which areas ofsystem performance to track and display. These performance specifiers aredefined as follows:

➤ Performance Objects—These items are logical collections of performancemetrics associated with a computer resource (CPU, disk, memory) orservice that you can monitor. Processor, Memory, PhysicalDisk, andPaging File are all examples of performance objects.

➤ Performance Object Instances—These terms provide a method of identify-ing multiple performance objects of the same type. If a computer hasmore than one processor installed, its processor performance object dis-plays multiple distinct instances of this object to monitor each individualprocessor separately.

➤ Performance Counters—These data items direct System Monitor aboutwhich areas of performance to track and display. Each performanceobject has several performance counters associated with it. Pages/sec,Available Bytes, and %Committed Bytes in Use are all examples ofcounters for the Memory performance object.

In Windows Server 2003, the System Monitor tool is preconfigured withthree sets of performance objects, counters, and instances (object:counter:instance) by default each time that you launch the Performancesnap-in, as shown in Figure 6.6:

➤ Memory:Pages/sec—This performance metric is the rate at which pagesare read from or written to disk to resolve hard page faults. Hard pagefaults occur when a process requests a page from memory, but the sys-tem cannot find it and it must be retrieved from disk. This metric is aprimary indicator of the kinds of faults that cause systemwide slow-downs. This value should remain consistently between 0 and 20 but not consis-tently higher than 20.

➤ PhysicalDisk:Avg. Disk Queue Length:_Total—This performance metric isthe average number of both read and write requests that were queued(waiting) for the selected disk during the sample interval. This valueshould remain consistently between 0 and 2 but not consistently higher than 2.


➤ Processor:% Processor Time:_Total—This performance metric is the per-centage of elapsed time that the processor spends to execute a non-idlethread. It is calculated by measuring the duration that the idle thread isactive in the sample interval and subtracting that time from intervalduration. (Each processor has an idle thread that consumes cycles whenno other threads are ready to run.) This metric is the primary indicatorof processor activity and displays the average percentage of busy timeobserved during the sample interval. It is calculated by monitoring thetime that the service is inactive and subtracting that value from 100%.This value should remain consistently below the 85% mark.

Figure 6.6 Watching the System Monitor in graph view with the default performance objects, coun-ters, and instances.

The diskperf.exe -y command is no longer required under Windows Server 2003 toenable either LogicalDisk or PhysicalDisk objects and counters. All disk objects andcounters are automatically enabled on demand for Windows Server 2003 andWindows XP computers.

Monitoring System PerformanceYou can monitor system performance in one of two ways—real-time moni-toring and logged monitoring. Real-time monitoring measures the currentperformance of the server’s processors, memory, physical disks, and networkutilization, among other metrics. You can find out what type of usage load aserver is currently experiencing by monitoring subsystems in real time. Youuse logged monitoring to analyze server performance over an extended peri-od of time. By recording historical performance data into log files during“normal” usage periods, you can establish a baseline of performance datathat you can use to compare against future performance data to help diag-nose and alleviate performance bottlenecks that might occur.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Chapter 6222

Using System Monitoring in Real Time withTask ManagerYou can use either the Task Manager tool or the System Monitor tool tomeasure system performance in real time. You can access the Task Managerin any one of three ways:

➤ Right-click the taskbar and select Task Manager.

➤ Press Ctrl+Shift+Esc on the keyboard.

➤ Press Ctrl+Alt+Del on the keyboard and select Task Manager.

The Task Manager utility under Windows Server 2003 displays five tabs—Applications, Processes, Performance, Networking, and Users, as shown inFigure 6.7. The Applications tab shows the application programs that arecurrently running in the foreground; background services do not appear onthis page. The Processes tab displays the processes currently running on thecomputer; to view all processes from all users logged onto the computer,mark the Show Processes from All Users check box. The Performance tabshows current usage of the CPUs, the CPU Usage History charts, currentPage File usage, Page File Usage History chart, and current memory usagestatistics. The Networking tab is new for Windows Server 2003; it charts thecurrent network adapters’ network traffic utilization (see Figure 6.8). TheUsers tab lists the users who are currently logged onto the console or loggedon via Remote Desktop connections (see Figure 6.9).

Task Manager offers you a quick glimpse at the following items:

➤ Applications currently in use

➤ Processes currently running

➤ Current processor usage

➤ Current paging file usage

➤ Overall current memory usage

➤ Current network utilization

➤ Currently logged-on users

For any other vital statistics on a system, or for more detailed and in-depthinquiries, you should use the System Monitor and the Performance Logs andAlerts tools.


Figure 6.7 Monitoring system performance in real time with Task Manager.

Figure 6.8 Monitoring a system’s network utilization in real time with Task Manager.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Chapter 6224

Figure 6.9 Viewing a system’s currently logged-on users with Task Manager.

Using Real-Time Monitoring with SystemMonitorYou can configure the System Monitor tool to display its results in any ofthree different views—graph, histogram, or report. The graph view is thedefault, and it supports the most optional settings. The histogram view is abar-chart configuration, as shown in Figure 6.10. The report view is simplya straightforward list of the performance objects, counters, and their associ-ated instances in a report-like format (see Figure 6.11). Using the SystemMonitor, you can monitor the local computer or several remote computersover a network connection.

The default configuration is to monitor the local computer in real time. Youcan change the default settings to monitor one or more remote computers inreal time. You can also choose to record the system performance of the localor remote computers to a log file using the Performance Logs and Alertsnode of the Performance snap-in, which is covered in the section“Monitoring File and Print Services” later in this chapter. You can play backand view the results of those log files using the System Monitor tool.


Figure 6.11 Watching the System Monitor in report view to track several performance objects andcounters.

Adding and Removing Objects, Counters, and InstancesSystem Monitor offers you a variety of ways to add objects, counters, andinstances to its list of monitored items; collectively, these items as referred tosimply as counters. To add counters, you can click the plus sign (+) on the iconbar, you can press Ctrl+I on the keyboard, or you can right-click the right(details) pane in any view and select Add Counters. To both add and remove

To obtain the most accurate results when checking a computer’s performance withSystem Monitor, you should monitor a computer remotely. System Monitor itselfrequires a certain amount of overhead to run. Therefore, when you run SystemMonitor on the same machine you are measuring, the performance data can benegatively affected and the results might be somewhat skewed.

Figure 6.10 Watching the System Monitor in histogram view to track several performance objectsand counters.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Chapter 6226

counters, you can right-click the details pane in any view, select Properties,and click the Data tab. To add counters to System Monitor, follow thesesteps:

1. Open the Performance snap-in and click the System Monitor node.

2. Click the plus sign (+) on the icon bar, press Ctrl+I on the keyboard,right-click the details pane and select Add Counters, or right-click thedetails pane and select Properties and use the Data tab.

3. From the Add Counters dialog box, select either the Use LocalComputer Counters option or the Select Counters From Computeroption; type in a computer name or select a remote computer.

4. Select the performance object that you want to monitor from the drop-down list box.

5. Click the All Counters option button or the Select Counters from Listoption button.

6. Select the counter that you want to monitor from the list of counters.Click the Explain button to view a definition of the specific counterthat you have selected (see Figure 6.12).

7. Click the All Instances option button or the Select Instances from Listoption button.

8. Choose the instance of the object that you want to monitor. The_Total option monitors the sum of all the instances for that selectedobject:counter combination.

9. Click the Add button to add the selected object:counter:instance com-bination to System Monitor’s list of performance items to monitor.

10. Repeat this process for each object:counter:instance combination thatyou want to add. Click Close when you are done adding counters.

To remove counters from System Monitor, you can select the counter thatyou want to remove at the bottom of the details pane and press the Del keyon the keyboard. You can also remove counters another way by followingthese steps:

1. Right-click the details pane and select Properties.

2. Select the Data tab.

3. Select the counter (or several counters) that you want to delete fromthe Counters list box.

4. Press the Remove button.


Figure 6.12 Adding performance counters to System Monitor with the Add Counters dialog box.

Using Logged Monitoring with Performance Logs and AlertsThe Performance Logs and Alerts tool in Windows Server 2003 is the otherhalf of the Performance snap-in. Performance Logs and Alerts supportslogged monitoring to log files larger than 1GB, up to the maximum supportedfile size for the file system on which the logs are stored. In addition, you canappend performance data onto existing log files. Two new groups (installedby default) allow users to gather performance data for a computer withoutrequiring that those users become members of the Administrators group:

➤ Performance Log Users—This is a local group on standalone and domainmember servers and a domain local group on domain controllers.Members of this group have permission to manage and schedule loggedperformance counters, logs, and alerts on the local server or on serverswithin the domain, both interactively (locally) and remotely.

➤ Performance Monitor Users—This is a local group on standalone anddomain member servers and a domain local group on domain con-trollers. Members of this group have permission to monitor performancecounters, logs, and alerts on the local server or on servers within thedomain, both interactively (locally) and remotely. Members of this groupdo not need to be members of the Administrators group or thePerformance Log Users group to monitor performance.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Chapter 6228

The Performance Logs and Alerts tool offers administrators three majorbenefits:

➤ The ability to record system performance data at specified intervals overtime using counter logs

➤ A method to record detailed system events after specific events occurusing trace logs

➤ A configuration setting for being notified by the system when specificcounters exceed certain preset thresholds using alerts

Counter logs enable you to collect data about a server’s performance over time toestablish a baseline of normal performance for a given computer system. You shouldcollect baseline data during periods of regular activity, not during temporary periodsof high or low server usage. Baselines can only be an effective barometer of averageserver performance under “normal” loads; recording performance data during peakusage times does not create an accurate baseline reading, nor does recording per-formance at times when the system is not being used. In some cases, it might beinteresting to record the system without users on it to know the minimum level ofactivity the system generates on its own for replication traffic and so on. This no-userbaseline gives the administrators another piece of information to use when consid-ering system upgrades. You should create and use system performance baselines forfuture comparison purposes when you suspect that server performance has degrad-ed over time or when you evaluate new purchases. By comparing baseline readingswith current performance results, you can quickly determine whether there is truly aperformance bottleneck or whether you might need additional hardware. Remember,if you change the server’s hardware configuration, you need to re-establish a base-line for that system.

Configuring Counter LogsCounter logs enable you to collect performance data on systems over peri-ods of time to create performance baselines, chart and analyze performancetrends, and diagnose performance bottlenecks. Once you configure one ormore counter logs, you can schedule these logs to record data automaticallyat predetermined times. You can also start and stop counter logs manually ifyou want. You can choose from five different types of counter log storageformats—comma delimited (.csv) text files; tab delimited (.tsv) files; binaryfiles (.blg); binary circular files (.blg) that overwrite themselves when theyreach a maximum size; and SQL database files, which require a connectionto a Microsoft SQL Server computer and access to an accompanying SQLdatabase table. To set up a new counter log, follow these steps:

1. Launch the Performance console.

2. Expand the Performance Logs and Alerts node and select the CounterLogs subnode.

3. Right-click the Counter Logs subnode and select New Log Settings.


4. Type a name for this log in the Name box and click OK.

5. From the General tab of the properties dialog box that appears (seeFigure 6.13), you can

➤ Click the Add Objects button to add objects with all their associatedcounters to the log.

➤ Click the Add Counters button to add individual counters andinstances to the log.

➤ Select one or more objects or counters from the Counters list andclick the Remove button to delete them.

Figure 6.13 Adding objects and counters to a new counter log in Performance Logs and Alerts.

6. To change the sample interval, type a number or increment or decre-ment the interval using the up or down arrows on the Interval spinnerbox.

7. To change the sample interval time units, click the Units drop-downlist box and select from Seconds, Minutes, Hours, or Days.

8. If you want to have the counter log record data under a specific useraccount’s security context, type the user account name in the Run asbox and then click the Set Password button to specify the proper pass-word.

9. Click the Log Files tab to specify log-file options, as shown in Figure6.14.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Chapter 6230

Figure 6.14 Specifying log-file formats for a new counter log.

10. Click the Log File Type drop-down list box to select the type of logstorage format that you want for this log—binary file (default), text file(comma delimited), text file (tab delimited), binary circular file, orSQL database.

11. Click the Configure button to change the location of the log file,change the log filename, or establish a maximum log file size. If theMaximum Limit (default) option is selected, the logging will continuefor this counter log until the log file uses all the available space on thedisk where the log is located. Click OK for the Configure Log Filesdialog box when finished.

12. Clear the End File Names with check box if you do not want the logfile’s name appended with a numeric sequence number or a date format.

13. If you leave the End File Names with check box marked, you can selectfrom the nnnnnn setting or one or several date formats from the asso-ciated drop-down list box, such as mmddhh that uses the currentmonth, day, and hour or mmddhhmm that uses the current month,day, hour, and minute.

14. Optionally, you can type a description in the Comment box.

15. Mark the Overwrite Existing Log File if you want to overwrite anexisting file that has the same name.


16. Click the Schedule tab to specify start and stop times for logging tothis counter log, as shown in Figure 6.15.

17. Click OK to create the new counter log.

Figure 6.15 Scheduling start and stop times for a counter log.

You can create a counter log from an existing set of counters set up in the SystemMonitor tool by right-clicking anywhere in the details pane of System Monitor andselecting Save as. When the Save as dialog box appears, select a location on diskto save these settings, specify the Save as Type as a Web page (*.htm, *.html) file,and click Save to save the settings file. Next, go to the Performance Logs and Alertsnode, right-click the Counter Logs subnode, and select New Log Settings. Locatethe settings file that you saved and click the Open button. Click OK for the messagebox that appears. Type a name for this new counter log in the Name box for the NewLog Settings dialog box that pops up. Make any changes that you want to the newcounter log’s properties window that appears and click OK when you are done.

To manually start a counter log to record performance data, right-click thecounter log name in the details pane of Performance Logs and Alerts andselect Start. The icon for the counter log turns to green, indicating that log-ging is occurring. To manually stop a counter log from logging data, right-click the counter log name and select Stop. To modify a counter log’s settings,right-click the log and select Properties.

To view the results of logging to a counter log, go to System Monitor and clickthe View Log Data icon from the icon bar or press Ctrl+L on the keyboard.Be sure that the Source tab is selected. Click the Log Files option button, if

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Chapter 6232

you are not using the SQL Database logging format. Next, click the Add but-ton, locate the log file using the Select Log File dialog box, and click Open toselect the file. If you are using the SQL database logging format, click theDatabase option button and select the SQL System DSN and Log Set fromtheir respective drop-down list boxes. Click the Time Range button to adjustthe period of time view for displaying the log file’s results; use the slider bar toshorten or lengthen the time window. Lengthening the time window gives youmore of an overall view of a performance trend; shortening the time windowlets you zoom in to analyze the details of system performance for a specificperiod of time. Click OK for the System Monitor Properties dialog box, asshown in Figure 6.16.

Figure 6.16 Setting the data source for a counter log to display its results in System Monitor.

You can also create counter logs from the command line under Windows Server 2003using the logman.exe tool. If you type logman /? at a command prompt, you can gethelp on the many “verbs,” parameters, and options available with this tool. For exam-ple, the command line logman create counter perf_log -c “\Processor(_Total)\%Processor Time” creates a new counter log named perf log that uses the binary fileformat and uses the Processor object, the % Processor Time counter, and the _Totalinstance.

Configuring AlertsAlerts send notifications whenever the predefined counter setting exceeds orfalls beneath the specified alert threshold. When an alert is triggered basedon its settings, it can perform several actions—create an entry in the applica-tion event log, send a network message to someone, initiate logging for a


specific performance log, and run an application program. To create a newalert, follow these steps:

1. Launch the Performance console.

2. Expand the Performance Logs and Alerts node and select the Alertssubnode.

3. Right-click the Alerts subnode and select New Alert Settings.

4. Type a name for this Alert in the Name box and click OK.

5. From the General tab of the properties dialog box that appears (seeFigure 6.17), click the Add button to add one or more counters to thisalert.

Figure 6.17 Configuring threshold settings for an alert.

6. Select either Over or Under from the Alert When the Value Is drop-down list box.

7. Type the threshold value in the Limit box.

8. You can change the sample data interval and you can configure thealert to run under a specific user account, if you desire.

9. Click the Action tab to specify the actions that you want the alert toperform when the alert is triggered, as shown in Figure 6.18.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Chapter 6234

Figure 6.18 Configuring actions to be performed when an alert is triggered.

10. Click the Schedule tab to schedule when the alert should be operating.

11. Click OK to save the settings for the new alert.

To manually start an alert, right-click the alert name in the details pane ofPerformance Logs and Alerts and select Start. The icon for the alert turns togreen, indicating that the alert is operating. To manually stop an alert fromscanning the system, right-click the alert name and select Stop. To modify analert’s settings, right-click the alert and select Properties.

Monitoring File and Print ServicesAt a minimum, you should always monitor the four major performance areasthat can have a significant impact on file and print server performance—processor utilization, memory utilization, disk utilization, and network uti-lization. These four major performance areas and the reasons for theirimpact on server performance are as follows:

➤ Processor—This is a key element in server performance. This element ismeasured in terms of percentages with 100% being full processor uti-lization. It is not good for a server to be fully utilized for prolongedperiods.


The CPU Usage graph in Task Manager and the % Processor Timecounter in the Performance snap-in measure processor utilization.Sustained usage of 85% or more can indicate a processor bottleneck.

➤ Memory—This resource is also a key element in server performance. Alack of sufficient physical memory in a server requires that more virtualmemory is used. Virtual memory uses disk storage via the paging files toswap data and programs in and out of memory. Because disk is muchslower than RAM (random access memory), insufficient RAM can causea significant system slowdown. Memory bottlenecks occur when low mem-ory conditions cause increased use of the paging file, and page faultsoccur when the system is unable to locate either data or programs inmemory. Services and programs can become less responsive under theseconditions. Memory leaks occur when programs allocate memory fortheir own use, but they never release that allocated memory back to thesystem’s memory pool. Over time, memory leaks can lock up a serverand make it stop functioning; rebooting the server temporarily fixes theproblem. A server that is running low on memory can appear to have adisk problem due to excessive swapping of application code and datafrom physical memory to virtual memory (the paging file). This exces-sive swapping is known as thrashing.

➤ Disk—Disks can be a source of performance bottlenecking on a system ifall three of the following conditions exist: the sustained disk activitygreatly exceeds your established baseline, the persistent disk queuesexceed two per disk, and there is not a high amount of paging occurringon the system. Disk fragmentation can slow down disk performance; youshould have all the disks on a server regularly defragmented. If the %Disk Time performance counter averages greater than 50% on a regularbasis, you might have a disk bottleneck. Replacing the disk subsystemwith faster drives or replacing a software RAID configuration with ahardware RAID configuration can improve disk performance.

➤ Network—Network throughput can have a major impact on users as theyrequest data from network servers. Network bandwidth includes howfast bytes are sent to and from a server and how fast data packages(packets, frames, segments, and datagrams) are transferred by a server.Network bottlenecks are often caused by too many requests for data ona particular server; too much data traffic on the network segment; or aphysical network problem with a hub, switch, router, or other networkdevice. The Network Utilization graph in Task Manager can assist youwith troubleshooting a possible network bottleneck. This statistic shouldgenerally average below 30% utilization.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Chapter 6236

Monitoring General Server Workload withTask ManagerYou can get a quick glimpse into a server’s general health and well-being byusing Task Manager. Press Ctrl+Alt+Del on the keyboard and select TaskManager or right-click a blank area on the taskbar and select Task Managerto display this tool. Click the Performance tab to view current CPU Usage;CPU Usage History; current PF (Page File) Usage; Page File Usage History;total Handles, Threads, and Processes; Physical Memory; Kernel Memory;and Commit Charge statistics (listed in kilobytes). Click the Networking tabto view current network utilization percentages for each installed networkadapter.

Monitoring Disk Quotas with the EventViewerIf you enable disk quotas for one or more drive volumes, you can monitorusers who exceed their disk quota entry warning level and their disk quotalimit threshold in Event Viewer. You must be sure to mark the check box LogEvents When a User Exceeds Their Warning Level and the check box LogEvents When a User Exceeds Their Quota Limit for these occurrences to berecorded in the System Event Log as a Category Disk, Event ID 36 loggedentry. If you filter the log, it’s easy to spot various kinds of warnings anderrors such as this one. Figure 6.19 shows the Event Properties window fora user who hits his or her quota limit.

Troubleshooting Server Bottlenecks withSystem MonitorYou can usually discover performance bottlenecks on a server whenever oneor more of the system’s major elements, or subsystems, shows a decline inperformance as compared to its historical baseline performance statistics.This discovery is why establishing and maintaining baseline performancedata for each of the major server subsystems is so important! By default, per-formance for each counter is displayed in graph view in System Monitor.Each counter/instance combination is assigned a different color on thegraph. As you select a counter/instance in the lower half of the window, itsstatistics also appear just below the graph. The following metrics appearbelow the graph:


Figure 6.19 Monitoring disk quota thresholds for users with the Event Viewer.

➤ Last—This metric shows the result for the current counter/instance as ofthe last recorded interval.

➤ Average—This metric shows the average result for the currentcounter/instance during the monitoring period.

➤ Maximum—This metric shows the maximum result for the currentcounter/instance during the monitoring period.

➤ Minimum—This metric shows the minimum result for the currentcounter/instance during the monitoring period.

➤ Duration—This metric shows the length of the current monitoring period.

By keeping baseline data on each server’s processor (CPU), memory, disk,and network utilization, you can easily compare those baseline figures againstcurrent performance results. Use the Performance Logs and Alerts tool tolog system baseline performance and then you can compare the baseline tocurrent system performance by loading the logged data into System Monitorand displaying a second instance of the Performance snap-in to show currentperformance results. Figure 6.20 shows two instances of System Monitor:The top window is displaying current performance and the bottom windowdisplays logged baseline data.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Chapter 6238

Figure 6.20 Comparing current system performance data (top) against logged baseline performancedata (bottom).

Diagnosing and Resolving Performance BottlenecksIn addition to monitoring and comparing current system performance met-rics against baseline data, you can also keep tabs on several key areas of per-formance that might indicate the presence of performance problems. Tables6.1, 6.2, 6.3, and 6.4 outline performance counters to monitor when checkingfor possible system bottlenecks. Each table lists general guidelines for per-formance counters that you should monitor, the threshold levels to check, andwhat remedial action that you can take to resolve the performance problem.Table 6.1 deals with processor bottlenecks, Table 6.2 deals with memory bot-tlenecks, Table 6.3 talks about disk bottlenecks, and Table 6.4 discusses net-work bottlenecks.

Table 6.1 Troubleshooting Processor Usage Bottlenecks

Performance Object:Counter Unacceptable Threshold Level Remedy

Processor:% User Time Sustained usage higher than Upgrade existing CPUProcessor:% Processor Time 85%. to a faster CPU or Processor:% Privileged Time install additional CPUs.


System:Processor Queue Sustained usage higher than 2. Upgrade existing CPULength to a faster CPU orServer Work Queues: install additional CPUs.Queue Length

Processor:Interrupts/sec Varies by processor; however, Locate and replace the substantially higher values than hardware device that is the baseline can indicate a generating the high hardware problem with another number of interrupts.device in the server, such as a faulty network adapter or a failing disk controller.

Table 6.2 Troubleshooting Memory Usage Bottlenecks


Memory:Page Faults/sec Consistent page fault rates Identify the processeshigher than 5. using disproportional

amounts of RAM andinstall more memory.

Memory:Committed Bytes Sustained value higher Identify the processesthan 75% of total physical using disproportionalRAM installed. amounts of RAM and

install more memory.

Memory:Available Bytes Consistent value lower than Identify the processes5% of total physical RAM using disproportionalinstalled. amounts of RAM and

install more memory.

Memory:Pages/sec Consistently higher than 20. Identify the processescausing excessive pag-ing and install morememory.

Memory:Nonpaged Bytes Steady increases (compared Identify one or more to baseline) over time without programs that might an increased server load can have a memory leak, indicate a memory leak. stop running the pro-

grams, or get updatedversions.

Table 6.1 Troubleshooting Processor Usage Bottlenecks (continued)


. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Chapter 6240

Table 6.3 Troubleshooting Disk Usage Bottlenecks


PhysicalDisk:% Disk Time Consistently higher than 50%. First verify that excessive LogicalDisk:% Disk Time paging is not the cause

of this problem; if not theresult of excessive pag-ing, replace the disk witha faster model.

PhysicalDisk:Current Disk Consistently higher than 2. Replace the disk with aQueue Length faster model.LogicalDisk:Current Disk Queue Length

PhysicalDisk:Avg. Disk Consistently lower than the Replace the disk with aBytes/Transfer server’s baseline. faster model.LogicalDisk:Avg. Disk Bytes/Transfer

PhysicalDisk:Disk Bytes/sec Consistently lower than the Replace the disk with aLogicalDisk:Disk Bytes/sec server’s baseline. faster model.

Table 6.4 Troubleshooting Network Usage Bottlenecks


Server:Bytes Total/sec Sustained usage levels higher Replace the installedNetwork Interface:Bytes than the baseline averages for network adapters withTotal/sec the server. faster models; install

another network adapter;upgrade the physical net-work cabling, hubs, andswitches.

Server:Bytes Received/sec Sustained usage levels higher Replace the installed than 50% of the network network adapters with adapter’s bandwidth rating. faster models; upgrade the

physical network cabling,hubs, and switches.

Network Interface:Bytes Sustained usage levels lower Replace the installed Sent/sec than the baseline averages network adapters with

for the server. faster models; upgrade thephysical network cabling,hubs, and switches.


Monitoring and OptimizingApplication Server PerformanceAs discussed throughout this chapter, monitoring system performance is animportant task for an administrator to perform on a regular basis. You canuse System Monitor to display real-time data and to display the results of logfiles you created with the Performance Logs and Alerts tool. There are fourmajor areas of server performance to monitor that will help identify andresolve performance slowdowns—processor, memory, disk, and network uti-lization. In this section, we show you how to set up the appropriate per-formance counters to make sure that a server is running smoothly.

Monitoring Processor UsageOne or more CPUs are the heart of any computer system. Processors onapplication servers tend to experience more activity than processors on fileand printer servers; generally, more numbers are being crunched on an appli-cation server. You can monitor processor performance in any of the follow-ing ways:

➤ Run Task Manager and view real-time performance data from thePerformance tab.

➤ Open the Performance snap-in and select System Monitor to view real-time data. Add performance counters for

➤ Processor:% Processor Time

➤ System:Processor Queue Length

➤ Server Work Queues:Queue Length

➤ Processor:Interrupts/sec

➤ Open the Performance snap-in and select Performance Logs and Alertsto collect logged data or establish baseline averages for the server. Addperformance counters for

➤ Processor:% Processor Time

➤ System:Processor Queue Length

➤ Server Work Queues:Queue Length

➤ Processor:Interrupts/sec

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Chapter 6242

Monitor these counters and watch for the threshold levels listed in Table6.1 in the previous section “Diagnosing and Resolving PerformanceBottlenecks.”

Monitoring Memory UsageLack of adequate RAM is a common cause for poor server performance.Symptoms related to inadequate memory include excessive paging or a highrate of hard page faults. You can monitor memory performance in any of thefollowing ways:

➤ Run Task Manager and view real-time performance data from thePerformance tab.


➤ Memory:Nonpaged Bytes

➤ Memory:Pages/sec

➤ Memory:Available Bytes

➤ Memory:Committed Bytes

➤ Memory:Page Faults/sec


➤ Memory:Nonpaged Bytes

➤ Memory:Pages/sec

➤ Memory:Available Bytes

➤ Memory:Committed Bytes

➤ Memory:Page Faults/sec

Monitor these counters and watch for the threshold levels listed in Table6.2 in the previous section.

Monitoring Disk UsageDisk storage can be a significant source of performance bottlenecking on aserver due to the fact the disks are mechanical. Therefore, disk response


times are generally much slower than the access times for nonmechanicalcomponents such as the processor, memory, or even network I/O. You canmonitor PhysicalDisk counters, LogicalDisk counters, or both. PhysicalDiskcounters measure individual hard disk drives. LogicalDisk counters measurelogical partitions or volumes stored on physical disks. LogicalDisk countershelp you isolate the source of bottlenecks to a particular logical drive volumeso that you can more easily identify where disk access requests are comingfrom. You can monitor disk performance in the following ways:


➤ PhysicalDisk:% Disk Time or LogicalDisk:% Disk Time

➤ PhysicalDisk:Current Disk Queue Length or LogicalDisk:CurrentDisk Queue Length

➤ PhysicalDisk:Avg. Disk Bytes/Transfer or LogicalDisk:Avg. DiskBytes/Transfer

➤ PhysicalDisk:Disk Bytes/sec or LogicalDisk:Disk Bytes/sec


➤ PhysicalDisk:% Disk Time or LogicalDisk:% Disk Time

➤ PhysicalDisk:Current Disk Queue Length or LogicalDisk:CurrentDisk Queue Length

➤ PhysicalDisk:Avg. Disk Bytes/Transfer or LogicalDisk:Avg. DiskBytes/Transfer

➤ PhysicalDisk:Disk Bytes/sec or LogicalDisk:Disk Bytes/sec


Monitoring Network UsageNetwork usage bottlenecks can be difficult to troubleshoot because manyfactors can influence network bandwidth availability and because the largernetworks become, the more complex they become. If you determine thatnetwork throughput is the source of your server’s bottleneck, you can takesome constructive measures such as the following:

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Chapter 6244

➤ Add servers to distribute network traffic.

➤ Segment the network into smaller subnets and connect each subnet to aseparate network card on the server.

➤ Remove network bindings from unneeded network cards.

➤ Install the latest networking equipment such as 100Mb or 1000Mb(Gigabit) switches, hubs, routers, and cabling.

You can monitor network performance in the following ways:

➤ Run Task Manager and view real-time performance data from theNetworking tab. In general, sustained network utilization should be lowerthan 30%.


➤ Server:Bytes Total/sec

➤ Network Interface:Bytes Total/sec

➤ Server:Bytes Received/sec

➤ Network Interface:Bytes Sent/sec


➤ Server:Bytes Total/sec

➤ Network Interface:Bytes Total/sec

➤ Server:Bytes Received/sec

➤ Network Interface:Bytes Sent/sec


Managing Software Site LicensingTechnically, Microsoft “licenses” each of its software products to individuals,companies, and organizations; it does not “sell” its software. When money isexchanged for Microsoft’s (and many other software publishers’) softwareproducts, ownership is not granted to the buyer. As the End User License


Agreement (EULA) states, the purchaser is buying a license to use the soft-ware in accordance with the terms of the EULA contract and copyright law.For Microsoft server products, the person or entity “buying” the softwaremust purchase a license for each server product. Additionally, the licensedentity must purchase a separate Client Access License (CAL) for each user ordevice that will be connecting to the server software. If your organization isusing Windows Terminal Services, each Terminal Server (Remote DesktopConnection) user or device must also have a Terminal Server Client AccessLicense (TSCAL), or each user or device must qualify to use a built-inTSCAL, to connect to Windows Terminal Servers. Microsoft offers a totalof five types of software licensing:

➤ Full Packaged Product—You can purchase full retail products in the box atstores such as Staples or Office Depot or from any one of a number ofonline resellers via the Internet. This low-volume purchase option isdesigned for consumers and small businesses that need fewer than fivelicenses. Media (CD-ROM, DVD-ROM) ships in each package.

➤ Open Licensing—This is the entry level volume-licensing program forcorporate, academic, charity, and government customers that need atleast five licenses per product or more. The Open, Select, andEnterprise licensing programs are more economical than purchasingretail packages. This program is designed for small- to medium-sizedcompanies. You must purchase media separately for a nominal fee.

➤ Select Licensing—This volume licensing program is designed for corpo-rate, academic, and government customers that need at least 250 licensesper product or more. This program is designed for medium, large, andmultinational companies who want decentralized purchasing. You mustpurchase media separately for a nominal fee.

➤ Enterprise Agreement Licensing—This volume licensing program isdesigned for corporate customers that need at least 250 licenses perproduct or more. This program is designed for medium, large, andmultinational companies who want centralized purchasing. You must pur-chase media separately for a nominal fee.

➤ Enterprise Subscription Agreement Licensing—This volume licensing pro-gram is also designed for corporate customers that need at least 250licenses per product or more; however, this program provides companieswith nonperpetual licenses for enterprise products, and these softwareproducts are licensed on a subscription basis.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Chapter 6246

Understanding Microsoft LicensingMicrosoft server licensing generally offers three licensing modes—per serv-er, per device or per user, and per processor. Per-server licensing requires aCAL for each user or device that accesses a particular server. With this mode,CALs are associated with specific servers. If you choose the per-serveroption, you must purchase at least as many CALs for a given server as themaximum number of clients that might connect to that server any point intime. If you choose the per-device or per-user option, each CAL is associat-ed with a specific user, computer, or device. Clients, therefore, are entitled toconnect to any server on the network as long as each client (user or device)possesses a CAL for each type of server being accessed (for example, oneCAL for Windows Server 2003, one CAL for SQL Server, one CAL forExchange Server, and so on). Not all but selected server products offer per-processor licensing, such as SQL Server 2000. With per-processor licensing,CALs are not required. The server itself is licensed based on the number ofprocessors installed in the server.

Microsoft permits organizations to make a one-time–only switch from per-serverlicensing to per-device or per-user licensing. Microsoft does not permit switchingfrom per-device or per-user licensing to per-server licensing.

To keep track of software licensing for the different types of licensingoptions, Windows 2000 Server and Windows Server 2003 install theLicensing tool by default. You need to work directly with the proper licens-ing server if you want to manage software licenses for an entire site. To locatethe software licensing server for a site, follow these steps:

1. Open the Active Directory Sites and Service snap-in and select the sitethat you want to work with.

2. Right-click the Licensing Site Settings object in the details pane andselect Properties.

3. The licensing server for the site appears at the bottom of the windowin the Licensing Computer section, as shown in Figure 6.21.

4. To change the licensing server for the site, click the Change button.

5. Click OK when you are finished.

The default licensing server for a site is the first DC installed in the site. However, asite license server does not have to be a DC. Microsoft recommends that a site licenseserver and a DC should be located in the same site.


Figure 6.21 Locating the licensing server for an Active Directory site.

Using the Licensing ToolsWindows Server 2003 actually installs two licensing utilities by default. TheLicensing icon in the Control Panel lets you configure licensing for the localserver (see Figure 6.22). If you click Start, (All) Programs, AdministrativeTools, Licensing, you launch the Enterprise Licensing tool for sites anddomains (see Figure 6.23). To use either licensing tool, you must have theLicense Logging service running on the server that you are working on. Bydefault, the License Logging service is not started automatically. You must bea member of the Administrators group for the local server or for the domainon which you want to manage licensing.

Figure 6.22 The Choose Licensing Mode utility for managing software licenses on the local server.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Chapter 6248

Figure 6.23 The Enterprise Licensing tool for managing software licenses for sites and domains.

Administering and TroubleshootingNetwork Print QueuesWhen a user sends a print job to a print device (printer) over the network,the print-server computer that hosts the printer first spools that print job todisk. The process of spooling the print job frees up the workstation comput-er so that it does not have to wait for the print job to complete before it cango on to a different task. The print jobs that have been spooled to disk waitin line (queue up) to be printed; this line is known as the print queue. Eachprinter has its own print queue. By default the print spooler folder is locatedin the %systemroot%\system32\spool\printers folder. For performance reasonsor lack of available disk space reasons, you might need to move this folder toa different drive volume. To change the location of the print spooler folderas well as to configure several other print server settings, follow these steps:

1. Create an empty folder on the drive volume where you want to placethe print spooler folder.

2. Click Start, Printers and Faxes or click Start, Settings, Printers andFaxes from the classic start menu.

3. From the Printers and Faxes window, click File, Server Properties todisplay the Print Server Properties window.

4. Click the Advanced tab.

5. Type the full local drive letter and path in the Spool Folder box, asshown in Figure 6.24. The new folder location must already exist.

6. Click OK to save the new settings.

7. Stop the Spooler service and then restart it for the change to take effect.


Figure 6.24 Changing the print spooler folder location and viewing other options on the Print ServerProperties dialog box.

From the Advanced tab of the Print Server Properties dialog box, you canalso specify whether the system should log error events, warning events, andinformation events in the Event Viewer for the print spooler service. If youwant workstation computers running Windows NT, Windows 2000, orWindows XP to be notified when their documents are printed, be sure tomark the Notify When Remote Documents Are Printed check box. You canalso work with forms from the Forms tab; you can add, delete, and configureports from the Ports tab; and you can add, remove, reinstall, and view prop-erties of printer drivers from the Drivers tab.

Setting Printer Priority and AvailabilityLevelsYou can establish different priority levels for different printers that are set upas a printer pool. You can also specify availability times for each printer if youwant to limit the time period when a printer can be used. If you set up twoor more printers using the same port, you can specify the priority for eachprinter from the Advanced tab of the printer’s properties sheet (see Figure6.25). You can specify a priority level for each printer between 1 and 99 (1 isthe default). The highest priority number prints first; lower-priority num-bers print after higher priorities. Print jobs sent by users to higher-prioritylogical printers will bypass other lower-priority print jobs that are waiting in

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Chapter 6250

the print queue. By scheduling printer availability, you can set up differentlogical printers in the Printers and Faxes folder that print to the same phys-ical printer but at different times. In this way, you can offload the printing oflong print jobs to nonpeak hours. Set printer availability on the Advanced tabof the properties sheet for each printer that you set up in the Printers andFaxes folder. The default availability is Always Available.

Figure 6.25 Specifying priority and availability settings from the Advanced tab of a printer’s proper-ties sheet.

If you want to set up a printer pool among several of the same model printers usingthe same printer driver, click the Ports tab on the properties sheet for the printer thatyou will be using. Mark the Enable Printer Pooling check box and then select eachport for each printer that you want to include as a part of the printer pool. Click OKwhen you are finished. Printing pooling enables you to set up one logical printer thatactually connects to several identical print devices to greatly enhance printing output.

Working with Print QueuesTo view and manage print jobs waiting to be printed in print queues, double-click a printer icon in the Printers and Faxes folder. From the printer’s printmanagement (queue) window, you can right-click a document name andchoose to pause it, restart it, or view its properties sheet (see Figure 6.26). Asan administrator, you have permission to modify each document’s prioritylevel and availability scheduling (see Figure 6.27).


Figure 6.26 Managing print jobs from the print queue window.

From the Printer menu, you can pause printing for all the documents in thequeue as well as cancel all documents in the queue. You can also set printingpreferences for the printer, set up or modify sharing settings, use the printeroffline, and work with the printer’s properties sheet. From the Documentsmenu, you can perform the same actions as when you right-click a docu-ment—pause, restart, cancel, and properties. The Status column displays thecurrent status for the documents; a printing problem for a document displaysin this column. If there is a local or network connectivity issue when com-municating with the printer, you see the message “Unable to connect” nextto the printer’s name in the title bar of the print queue window.

Figure 6.27 Working with the Document Properties window for a document waiting in the printqueue.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Chapter 6252

Monitoring Print Queue PerformanceYou can monitor the performance of a print server’s print queue by using thePerformance snap-in. You can monitor real-time statistics using SystemMonitor and you can log performance over time using Performance Logsand Alerts. The performance object to specify is Print Queue. The objectinstances are the printers that are installed on the local print server comput-er along with the _Total instance. The available counters include BytesPrinted/sec, Job Errors, Jobs, Jobs Spooling, Not Ready Errors (since lastrestart), Out of Paper Errors (since last restart), Total Jobs Printed (since lastrestart), and Total Pages Printed (since last restart).

Managing Operating SystemUpdates with SUSMicrosoft’s SUS feature is an extension of the Windows Update Web site(http://windowsupdate.microsoft.com). Instead of requiring that each comput-er in an organization visit the Windows Update Web site individually, SUSis designed to have one computer install the server component to SUS, andthen that designated computer can download the latest updates, networkadministrators can determine which updates are approved for deployment,and the Automatic Updates service on client computers can automaticallydownload and install those approved updates. You can install the AutomaticUpdates client software as an .msi file on computers that do not already havethis service. Computers running Windows 2000 Service Pack 3 (SP3),Windows XP SP1, and Windows Server 2003 already have the AutomaticUpdates software installed.

Updates to the various versions of the Windows operating are periodicallypublished by Microsoft. Such updates include critical updates, recommend-ed downloads, Windows tools, Internet and multimedia updates, and otherrelated items. SUS allows you to control which updates get deployed toclient computers and when to deploy each update. SUS also allows you toinstall multiple updates on computers simultaneously. Because SUS lever-ages Active Directory, you can easily specify which computers get updatedand which do not through group policy. So now, you can create a GPO set-ting for deploying software patches almost as easily as you can create a GPOsetting for deploying a new software application.


Installing SUS Server-Side ComponentsYou can install the SUS version 1.0 with SP1 server-side components on acomputer running Windows 2000 Server SP2 or higher or Windows Server2003. The server computer should at least be a Pentium III-compatiblemachine running at 700Mhz or faster with a minimum of 512MB RAM, atleast 6GB of available disk space on an NTFS drive volume, and IIS 5.0 orhigher installed. Microsoft claims that such a configuration can support upto 15,000 client computers. Of course, the server computer requires anInternet connection and it needs Internet Explorer (IE) version 6.0 or laterinstalled. To download SUS, go to http://www.microsoft.com/windows2000/windowsupdate/sus/default.asp and you’ll see the SUS Web page, shown inFigure 6.28.

Figure 6.28 Viewing the Microsoft SUS Web page.

After you download the self-extracting installation file, you can launch theinstallation and answer the prompts to complete the installation process. Bydefault, SUS installs into an SUS folder on a drive volume that is not the sameas the %systemdrive% volume. To work with the SUS administration Web site,type http://server_name/SUSAdmin in Internet Explorer. At the SUS adminis-tration page, click the Set Options link in the left frame to configure the SUSserver name, the synchronization setting, and the updates approval policy(see Figure 6.29).

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Chapter 6254

Figure 6.29 Configuring SUS option settings from the local SUS administration page.

Next, click the Synchronize Server link in the left frame and then click theSynchronization Schedule button to set up automatic downloads ofWindows updates to the SUS server, as shown in Figure 6.30. Click OK tosave your Schedule Synchronization settings. You can click the SynchronizeNow button to manually synchronize your new SUS server with theWindows Update Web site for the first time. After you download the updatesto the SUS server, you can click the Approve Updates link to designate whichupdates you will allow to be deployed automatically to the client computers.Close the SUS administration page when you are finished working with it.

Figure 6.30 Scheduling Windows updates synchronization for the SUS server.


Setting Up SUS Automatic Updates for ClientComputersSUS is designed to update computers running Windows 2000, Windows XP,and Windows Server 2003 operating systems only. The most effective andefficient way to set up SUS automatic updates is through group policy. Twogroup policy settings are key to enabling SUS automatic updates on clientcomputers—Configure Automatic Updates and Specify Intranet MicrosoftUpdate Service Location. You can find both of these group policy settings byusing the Group Policy Object Editor for a site, domain, or organizationalunit (OU) under Computer Configuration\Administrative Templates\Windows Components\Windows Update. Double-click the ConfigureAutomatic Updates policy setting and select Enabled. For the ConfigureAutomatic Updating drop-down list box (see Figure 6.31), choose one of thefollowing options and then click OK to save the settings:

➤ 2-Notify for Download and Notify for Install

➤ 3-Auto Download and Notify for Install

➤ 4-Auto Download and Schedule the Install

➤ Select the Scheduled Install Day—0-Everyday, 1-Every Sunday, 2-EveryMonday, 3-Every Tuesday, 4-Every Wednesday, 5-Every Thursday, 6-Every Friday, 7-Every Saturday—from the drop-down list box.

➤ Select the Schedule Install Time from the drop-down list box.

Figure 6.31 Configuring SUS Automatic Updates settings for client computers with group policy.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Chapter 6256

For the Specify Intranet Microsoft Update Service Location policy, double-click this policy setting and click Enabled. Type the appropriate DNS servername in the Set the Intranet Update Service for Detecting Updates box andin the Set the Intranet Statistics Server box, as shown in Figure 6.32. ClickOK to save your settings and then close the Group Policy Editor when youare done. Now, client computers that are located in the appropriate contain-er or OU where you applied the group policy settings should start receivingWindows updates via the SUS server.

Figure 6.32 Using group policy to specify the SUS server name for updating client computers.

Backing Up the SUS ServerIn case of server failure or other disaster, you should back up the SUS com-ponents on the server so that you could restore SUS to its previous opera-tional state prior to the failure. You must back up the IIS metabase in additionto backing up other IIS components. You need to back up the x:\inetpub\wwwroot folder, the x:\inetpub\msus folder, (where x: is the appropriate driveletter), and the %windir%\system32\inetsrv\metaback folder using the WindowsBackup Utility or third-party backup software. To restore SUS on a WindowsServer 2003 computer after a failure, follow these steps:

1. Take the server offline by disconnecting it from the network.

2. Assign the same name to the computer as it had before the failure.


3. Be sure to install the same IIS components as were installed before thefailure. The WWW service must be installed, at a minimum.

4. Install the latest service pack and security updates.

5. Install SUS into the same folder where it had been installed prior tothe failure.

6. Restore the most recent backup for SUS from backup media.

7. Restore the IIS metabase. Open IIS Manager, right-click the serverwhose metabase you want to restore, point to All Tasks, and selectBackup/Restore Configuration. Select the metabase backup that youwant to restore and click the Restore button.

8. Open the SUS Administration (SUSAdmin) Web site and verify thatthe settings on the Set Options page are configured as they werebefore the failure. Confirm that the previously approved updates arestill listed as approved on the Approve Updates page.

9. Put the server back online. (Connect it to the network.)

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Chapter 6258

Exam Prep Questions

Question 1

Which of the following tools can you use to view real-time system performancedata? (Choose two.)

❑ A. Performance Logs and Alerts

❑ B. Task Manager

❑ C. Event Viewer

❑ D. System Monitor

❑ E. Services.msc

❑ F. Licensing

Answers B and D are correct. You can monitor a computer system in realtime under Windows Server 2003 using either the Task Manager tool or theSystem Monitor utility. Answer A is incorrect because Performance Logs andAlerts is not designed to display performance data in real time; its results arelogged. Answer C is incorrect because the Event Viewer displays systemevent messages, not real-time performance data. Answers E and F are incor-rect because neither the Services console (Services.msc) nor the Licensingapplet offer real-time system performance monitoring.

Question 2

Which of the following event items is not one of the five default Event Viewerevent types?

❍ A. Information

❍ B. Error

❍ C. Caution

❍ D. Failure Audit

❍ E. Success Audit

Answer C is correct. Caution is not one of the default event types for theEvent Viewer; Warning events are one of the five default event types. AnswerA is incorrect because Information is a default event type. Answer B is incor-rect because Error is a default event type. Answer D is incorrect becauseFailure Audit is a default event type. Answer E is incorrect because SuccessAudit is also a default event type.


Question 3

Which of the following items serve as performance metrics for specifying dif-ferent computer resources to monitor? (Choose three.)

❑ A. Objects

❑ B. Counters

❑ C. Cycles

❑ D. Initiators

❑ E. _Totals

❑ F. Instances

Answers A, B, and F are correct. You use objects, counters, and instances ofobjects to measure system performance using System Monitor andPerformance Logs and Alerts. Answer C is incorrect because cycles are notperformance metrics. Answer D is incorrect because initiators are not per-formance metrics. Answer E is incorrect because _Totals are not perform-ance metrics.

Question 4

Using the Performance Logs and Alerts tool, Jane, the network administrator, addsperformance counters such as Memory:Pages/sec, PhysicalDisk:Avg. Disk QueueLength:_Total, and Processor:% Processor Time:_Total to a new counter log. Sheschedules this new counter log to start on Monday morning at 8:00 a.m. and sheschedules the log to stop on Wednesday evening at 10:00 p.m. The company thatJane works for has a very seasonal business; computer usage is extremely highduring this time of year due to increased marketing, sales, and accounting activi-ties. Collecting this type of performance data can be referred to as

❍ A. Establishing a baseline

❍ B. Viewing real-time data

❍ C. Logged performance monitoring

❍ D. Collecting histogram data

Answer C is correct. The Performance Logs and Alerts tool collects per-formance data over time and records that data into log files. Answer A isincorrect because although you should use the Performance Logs and Alertstool to create performance baseline data, you should not attempt to collectperformance data as a baseline during peak usage times. Answer B is incor-rect because you can only view real-time data using System Monitor or theTask Manager. Answer D is incorrect because both real-time data and logged

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Chapter 6260

performance data can be viewed as a histogram using the System Monitortool; a histogram is a view, not a type of data.

Question 5

On which of the following computer systems can you install Software UpdateServices (SUS) as a server? (Choose two.)

❑ A. Windows NT Workstation 4.0 with SP5

❑ B. Windows XP Professional with SP1

❑ C. Windows 2000 Server

❑ D. Windows 2000 Professional

❑ E. Windows 98 SE

❑ F. Windows Me

Answers B and C are correct. You can only set up SUS server-side compo-nents on Windows XP SP1, Windows 2000 Server, and Windows Server2003. Answer A is incorrect because you cannot set up SUS as a server underWindows NT Workstation 4.0. Answer D is incorrect because you cannotset up SUS as a server under Windows 2000 Professional. Answer E and Fare incorrect because you cannot set up SUS as a server under eitherWindows 98 SE or Windows Me.

Question 6

Onto which of the following computer systems can you deploy Windowsupdates using SUS? (Choose three.)

❑ A. Windows NT Workstation 4.0 with SP5

❑ B. Windows XP Professional with SP1

❑ C. Windows 2000 Server

❑ D. Windows 2000 Professional

❑ E. Windows 98 SE

❑ F. Windows Me

Answers B, C, and D are correct. You can deploy Windows updates usingSUS onto Windows XP, Windows 2000 Server, Windows 2000 Professional,and Windows Server 2003 computers. Answer A is incorrect because youcannot deploy updates using SUS to Windows NT Workstation 4.0 com-puters. Answer E and F are incorrect because you cannot deploy updatesusing SUS to either Windows 98 SE or Windows Me computers.


Question 7

Where do you change the location of the print spooler folder?

❍ A. In the Registry by modifying the Spooler value data in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows.

❍ B. By clicking Start, (All) Programs, Administrative Tools, Manage YourServer and selecting the Add a Printer Driver option.

❍ C. By opening the Printers and Faxes window; clicking File, Print ServerProperties; clicking the Advanced tab; and typing in the new spoolfolder location.

❍ D. By going to the Control Panel, right-clicking the Printers and Faxesicon, and selecting Print Server Properties. Click the Advanced tab andtype in the new spool folder location.

Answer C is correct. You can change the location of the print spooler folderfrom the Print Server Properties window. Answer A is incorrect because thatRegistry key and value name do not provide a way to change the location ofthe printer spool folder. Answer B is incorrect because you cannot changethe location of the print spooler folder from the Add a Printer DriverWizard. Answer D is incorrect because you cannot change the location of theprint spooler folder by right-clicking the Printers and Faxes icon in theControl Panel.

Question 8

Which of the following licensing options is not permitted by Microsoft?

❍ A. Per-processor licensing

❍ B. Per-device or per-user licensing

❍ C. Per-server licensing

❍ D. Switching from per-device or per-user mode to per-server mode

❍ E. Switching from per-server mode to per-device or per-user mode

Answer D is correct. You cannot switch from per-device or per-user licens-ing mode to per-server licensing mode. Answer A is incorrect because per-processor licensing is permitted. Answer B is incorrect because per-device orper-user licensing is allowed. Answer C is incorrect because per-serverlicensing is allowed. Answer E in incorrect because Microsoft does allow aone-time switch from per-server mode to per-device or per-user mode.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Chapter 6262

Question 9

How can you determine which computer is the site license server for a particu-lar site as part of an Active Directory forest?

❍ A. Use Active Directory Users and Computers.

❍ B. Use Active Directory Domains and Trusts.

❍ C. Use the Enterprise Licensing tool.

❍ D. Use the License tool in the Control Panel.

❍ E. Use Active Directory Sites and Services.

Answer E is correct. You use the Active Directory Sites and Services snap-into determine the license server computer for a given site by double-clickingthe Licensing Site Settings object. Answer A is incorrect because you cannotfind this information using Active Directory Users and Computer. Answer Bis incorrect because you cannot find this information using Active DirectoryDomains and Trusts. Answer C is incorrect because you cannot get thisinformation from the Enterprise Licensing tool. Answer D is incorrectbecause you cannot discover this information from the License tool in theControl Panel.

Question 10

Which of the following print spooler events and notifications are logged orenabled by default? (Choose three.)

❑ A. Error events

❑ B. Warning events

❑ C. Notify when remote documents are printed

❑ D. Show informational notifications for local printers

❑ E. Beep on errors of remote documents

❑ F. Information events

Answers A, B, and F are correct. Error events, warning events, and informa-tion events are recorded in the Event Viewer System log by default. AnswerC is incorrect because the Notify When Remote Documents Are Printedcheck box is not marked (enabled) by default. Answer D is incorrect becausethe Show Informational Notifications for Local Printers check box is notmarked (enabled) by default. Answer E is incorrect because the Beep onErrors of Remote Documents check box is not marked (enabled) by default.


Need to Know More?Holme, Dan, and Orin Thomas. MCSA/MCSE Self-Paced TrainingKit (Exam 70-290): Managing and Maintaining a Microsoft WindowsServer 2003 Environment. Redmond, Washington: Microsoft Press,2003.

Microsoft Corporation. Microsoft Windows Server 2003 Resource Kit.Redmond, Washington: Microsoft Press, 2003.

Morimoto, Rand, et. al. Microsoft Windows Server 2003 Unleashed.Indianapolis, Indiana: SAMS Publishing, 2003.

Search the Microsoft Product Support Services Knowledge Base onthe Internet: http://support.microsoft.com. You can also searchMicrosoft TechNet on the Internet: http://www.microsoft.com/

technet. Find technical information using keywords from this chap-ter, such as system monitor, Performance Logs and Alerts, baselines,print queues, enterprise licensing, and Software Update Services.

Review the SUS deployment white paper from Microsoft athttp://www.microsoft.com/windows2000/windowsupdate/sus/default.asp.