Use this Knowledge Script to monitor Performance Monitor counters. You can run this script on any computer or server to monitor any counter available in Performance Monitor. You can configure the script to raise an event if the value of the counter you select exceeds or falls below the threshold you set. You can also specify a consecutive number of times that a threshold must be exceeded before an event is raised.
Use this Knowledge Script to yield performance information for the counters you want to monitor. When this script collects and graphs data, the results are similar to the results displayed in Performance Monitor. Use the counter data to start corrective actions when thresholds are exceeded, generate more complex and sophisticated graphs, and provide historical information for reporting, trend analysis, and capacity planning.
Requirements for Windows Server 2012, Windows 8, Windows 7, Windows 2008 R2, and Windows 2008:
The Log On As account under which the AppManager agent runs for these Windows operating systems must be a domain account and belong to the local Administrator group.
Requirements for Windows Server 2003:
The Log On As account under which the AppManager agent runs on Windows Server 2003 must belong to the Performance Monitor Users policy.
If the Operator Console or Control Center is installed on Windows Server 2003, the user account under which the console application runs must belong to the Performance Monitor Users policy.
To check the local policy:
At a Command Prompt, type gpedit.msc and press Enter.
In the Group Policy snap-in, double-click Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment.
In the Local Setting column, ensure the appropriate user account belongs to the Performance Monitor Users policy.
If the Operator Console or Control Center is installed on Windows Server 2003, the Remote Registry service on the console computer must be running. If the Remote Registry service is down when you attempt to configure this script by browsing counter information on the remote computer, the console displays an error message that indicates AppManager was unable to connect to the remote computer.
Requirements for Windows Vista:
If the Operator Console or Control Center is installed on Windows Vista, the Remote Registry service on the console computer must be running. If the Remote Registry service is down when you attempt to configure this script by browsing counter information on the remote computer, the console becomes unresponsive.
Windows computer
The default interval for this script is Every 5 minutes.
Set the following parameters as needed:
|
Parameter |
How to Set It |
|---|---|
|
Event Notification |
|
|
Event severity when job fails |
Set the event severity level, from 1 to 40, to indicate the importance of an event in which the Counter job fails. The default is 5. |
|
Event severity when no counter or instance is found |
Set the event severity level, from 1 to 40, to indicate the importance of an event in which the script cannot find the counter or instance you specified. The default is 15 (yellow event indicator). |
|
Raise event when counter equals a specific value? |
Select Yes to raise an event if the counter equals a specific value The default is unselected. |
|
Event severity when counter equals a specific value |
Set the event severity level, from 1 to 40, to indicate the importance of an event in which the counter equals a specific value. The default is 15. |
|
Value to match |
Specify the number you want the counter to match so an event is generated. The default is 100. |
|
Raise event when counter value exceeds threshold? |
Select Yes to raise an event if the counter value exceeds the threshold n consecutive times. Specify the value of n in the Consecutive times threshold can be crossed before event is raised parameter. The default is Yes. |
|
Event severity when counter value exceeds threshold |
Set the event severity level, from 1 to 40, to indicate the importance of an event in which a value exceeds the threshold you set. The default is 8 (red event indicator). |
|
Threshold - Maximum counter value |
Specify the highest value a counter can attain before an event is raised. The default is 600. |
|
Raise event when counter value falls below threshold? |
Select Yes to raise an event if the counter value falls below the threshold n consecutive times. Specify the value of n in the Consecutive times threshold can be crossed before event is raised parameter. The default is Yes. |
|
Event severity when counter value falls below threshold |
Set the event severity level, from 1 to 40, to indicate the importance of an event in which a value falls below the threshold you set. The default is 8 (red event indicator). |
|
Threshold - Minimum counter value |
Specify the lowest value a counter must maintain to prevent an event from being raised. The default is 20. |
|
Monitoring |
|
|
Path of counter to monitor |
Provide the name of the '\\[computer or cluster name]\object\counter\instance you want to monitor, or click Browse [...] to select the computer and counter you want to monitor. You can also select a counter to monitor by starting System Monitor and clicking Add [+] in the toolbar. The default is Objects\Threads\. If typing the name of the counter to monitor, use the following formats:
In addition, a computer name or the name of a Microsoft cluster counters may be installed under may be specified preceding 'object', as in: \\<computer name or name of cluster>\object\counter name\instance. For more information, see Examples of Using This Script. Tips
|
|
Consecutive times threshold can be crossed before event is raised |
Specify the number of consecutive times a counter value can exceed or fall below the threshold before an event is raised. The default is 1 time. Tip This parameter provides functionality similar to that of the Raise event if event condition occurs x times within y job iterations parameter on the Advanced tab. NetIQ recommends using the Consecutive times threshold ... parameter when you run this script. The Consecutive times threshold ... parameter is designed to match the event text that is particular to this script, which can vary depending on your entry for the Name of counter to monitor parameter. In summary, use the Consecutive times threshold ... parameter to raise events. Leave the Raise event if event condition ... parameter at the default setting of 1 time within 1 job iteration. |
|
Data Collection |
|
|
Collect data for counter value? |
Select Yes to collect data for charts and reports. If enabled, data collection returns values for counters that exceed the threshold. The default is unselected. |
The following are examples of providing information in the Path of counter to monitor parameter.
For example, to monitor the Cache Hit Ratio counter and create one datastream, set the Path of counter to monitor parameter as follows:
SQLServer\Cache Hit Ratio
or
\\MyMSCluster\SQL Server\Cache Hit Ratio
For this type of counter you can simply leave the instance parameters blank. If selecting this counter through the Counter Browser:
Click Browse [...] and select the target Computer.
Select SQLServer from the Object list.
Select Cache Hit Ratio from the Counter list and click OK.
Assume you want to monitor the percentage of processor time used by several cmd processes running on a given computer. If you enter cmd as the instance name, only the first cmd process found is monitored.
To monitor additional cmd processes, or to select a specific cmd process rather than the “first found,” you need to specify the instance index. The simplest way to select multiple instances is through the Counter Browser.
The script will monitor the processor time for these three cmd processes and create three datastreams.
If you do not use the Counter Browser and there are multiple instances with the same name, you need to identify which instance to monitor using an instance index, with 0 indicating the first instance, 1 the second, and so on. If you do not enter an index, the first instance found is monitored. If you are typing the information in the Name of counter to monitor parameter, use one of the formats:
<object>\<counter>\<instance> (<instance_index>)
or
\\<cluster or computer name>\<object>\<counter>\<instance> (instance_index)
In some cases, an instance is a parent of multiple child instances. For example, if you have a Logical Disk 0 with partitions C: and D:, the logical disk 0 is the parent of the logical disk C: and the logical disk D: or \\MyMSCluster\LogicalDisk\% Free Space\0 ==> C:. In addition, there may be multiple child instances with identical names. For example, two processes called MSDEV may each have threads 0, 1, 2, and 3:
Instance ProcessID ThreadID Instance Index ---------------------------------------------- MSDEV ==> 0 361 495 0 MSDEV ==> 0 291 426 1 MSDEV ==> 1 361 275 0 MSDEV ==> 1 291 181 1 MSDEV ==> 2 361 471 0 MSDEV ==> 2 291 256 1 MSDEV ==> 3 361 376 0 MSDEV ==> 3 291 500 1
The simplest way to select these child instances is through the Counter Browser. If you do not use the Counter Browser and there are child instances, you need to identify which instance to monitor using the format <object>\<counter>\<parent_instance> ==> <child_instance>. For example:
LogicalDisk\% Free Space\0 ==> C:
If there are multiple child instances with the same name, you need to identify which child instances to monitor using an instance index, with 0 indicating the first instance, 1 the second, and so on. If you do not enter an index, the first instance found is monitored.
If you are typing the Counter to monitor, use the format: <object>\<counter>\<parent> ==> <child> (<index>). For example:
Thread\% Processor Time\MSDEV ==> 0 (0),MSDEV ==> 0 (1)
Using the example above, this counter would get % Processor Time for threads 495 (MSDEV process 361) and 426 (MSDEV process 291) and create two datastreams.
ID Job KS Name Legend ------------------------------------------------------------- 7 12 General_Counter Thread-% Processor Time-MSDEV ==> 0(0) 6 12 General_Counter Thread-% Processor Time-MSDEV ==> 0(1)
To type counter names rather than use the Counter Browser, enter the complete instance name exactly as it is displayed in the Performance Monitor, including any spaces or spelling conventions.
To manually set the Path of counter to monitor parameter (without browsing), use one of the following formats, and you can prepend to any of these the name of a cluster or computer name in the format "\\MyMSCluster\object .......":
|
Counter Type |
General Format to Use and Example |
|---|---|
|
Single counter instance |
<object>\<counter>\<instance_name>Process\% Privileged Time\cmd |
|
Multiple instances |
<object>\<counter>\<instance> (<instance_index>)Process\% Privileged Time\cmd (1),cmd (4) |
|
Child instances |
<object>\<counter>\<parent_instance> ==> <child_instance>LogicalDisk\% Free Space\0 ==> C: |
|
Multiple child instances |
<object>\<counter>\<parent> ==> <child> (instance_index)Thread\% Processor Time\MSDEV ==> 0 (0),MSDEV ==> 0 (1) |