Windows Server 2003 performance monitoring objects contain functionality known as performance counters. These so-called counters perform the actual analysis. For example, a hard-disk object is able to calculate transfer rate, while a processor-associated object is able to calculate processor time.
To gain access to the data or to start the data collection, you first have to create the object and gain access to its functionality. This is done by calling a create function from a user interface or other process. As soon as the object is created, and its data collection functionality invoked, it begins the data-collection process and stores the data in various properties. Data can be streamed out to disk, files, RAM, or to other components that assess the data and present it in some meaningful way.
Depending on the object, your analysis software can create at least one copy of the performance object and analyze the counter information it generates. You need to consult Microsoft documentation to "expose" the objects to determine whether the object can be created more than once concurrently. If it can be created more than once, you will have to associate your application with the data the object collects by referencing the object's instance counter. Windows Server 2003 enables you to instantiate an object for a local computer's services, or you can create an object that collects data from a remote computer.
Two methods of data collection and reporting are made possible using performance objects. The objects can sample data. This means that data is collected periodically, rather than when a particular event occurs. All forms of data collection place a burden on resources, which means that monitoring in itself can be a burden to systems. Sampled data has the advantage of being a period-driven load, but the disadvantage is that values may be inaccurate when a certain activity falls outside the sampling period or between events.
The other method of data collection is event tracing. Event tracing, new to Windows Server 2003, is able to collect data as certain events occur. Because there is no sampling window, you can correlate resource usage against events. For example, you can watch an application consume memory when it executes a certain function and monitor how and if it releases that memory when the function completes.
The disadvantage of event tracing is that it consumes more resources than sampling, so you would only want to perform event tracing for short periods where the objective of the trace is to troubleshoot, and not to just monitor.
Counters can report their data in one of two ways: instantaneous counting or average counting. An instantaneous counter displays the data as it happens; it is a snapshot. In other words, the counter does not compute the data it receives; it just reports it. Conversely, average counting computes the data for you. For example, it can compute bits per second or pages per second.
Other counters are able to report percentages, difference, and so on.
Was this article helpful?