MONITORING MICROSOFT WINDOWS SERVER 2003

1. MONITORING MICROSOFT WINDOWS SERVER 2003 Chapter 3

2. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2003 2 CHAPTER OVERVIEW Use Event Viewer to monitor system logs. Configure Task Manager to display performance data. Use System Monitor to display real-time performance data. Create counter logs and alerts. Discuss the topics covered in this chapter. The chapter not only explains how to monitor server performance but also introduces students to what they should be monitoring.Discuss the topics covered in this chapter. The chapter not only explains how to monitor server performance but also introduces students to what they should be monitoring.

3. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2003 3 SERVER MONITORING PRACTICES Real-time monitoring Uses tools that display a continuous stream of statistics about what the system is doing right now Logged monitoring Enables administrators to observe trends that develop over longer periods of time than those observed in a typical real-time monitoring session Explain that real-time (reactive) monitoring and logged (proactive) monitoring both have a place in the management and maintenance of a Windows Server 2003 system. Explain that this chapter looks at both real-time tools (Task Manager, System Monitor) and logged monitoring tools (Performance Logs and Alerts).Explain that real-time (reactive) monitoring and logged (proactive) monitoring both have a place in the management and maintenance of a Windows Server 2003 system. Explain that this chapter looks at both real-time tools (Task Manager, System Monitor) and logged monitoring tools (Performance Logs and Alerts).

4. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2003 4 MONITORING SUBSYSTEMS Processor Disk Memory Network Explain that although dozens of components and processes can be monitored on a Windows Server 2003 system, the Processor, Disk, Memory, and Network interfaces receive the most attention because they have the greatest impact on server performance.Explain that although dozens of components and processes can be monitored on a Windows Server 2003 system, the Processor, Disk, Memory, and Network interfaces receive the most attention because they have the greatest impact on server performance.

5. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2003 5 WHAT IS A BASELINE? Explain that a baseline is a set of statistics, taken under various conditions, that can be used for future comparison. Explain that without a baseline, there is really no way to answer claims such as �The server is slow� or �The network is slow.� Baseline comparison allows you to determine if there is indeed an issue affecting performance.Explain that a baseline is a set of statistics, taken under various conditions, that can be used for future comparison. Explain that without a baseline, there is really no way to answer claims such as �The server is slow� or �The network is slow.� Baseline comparison allows you to determine if there is indeed an issue affecting performance.

6. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2003 6 USING EVENT VIEWER Demonstrate opening Event Viewer. Familiarize students with the basic elements of the utility. Explain that daily administration routines normally include reviewing of logs to identify potential problems.Demonstrate opening Event Viewer. Familiarize students with the basic elements of the utility. Explain that daily administration routines normally include reviewing of logs to identify potential problems.

7. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2003 7 EVENT VIEWER LOGS Application Information about specific programs running on the computer System Events generated by components such as services and device drivers Security Security-related events such as failed logons and attempts to access resources Explain the purpose of each log. Give some examples of events that would be recorded in each log, such as a database error (Application log), the failure of a device driver to load (System log), or attempts to access or modify user account properties without the necessary permissions (Security log). If the system you are demonstrating on is a domain controller, show the Directory Service and File Replication Service logs. Direct students to the list of other log files as detailed in the �Event Viewer Logs� section in the chapter.Explain the purpose of each log. Give some examples of events that would be recorded in each log, such as a database error (Application log), the failure of a device driver to load (System log), or attempts to access or modify user account properties without the necessary permissions (Security log). If the system you are demonstrating on is a domain controller, show the Directory Service and File Replication Service logs. Direct students to the list of other log files as detailed in the �Event Viewer Logs� section in the chapter.

8. Chapter 3: MONITORING MICROSOFT WINDOWS SERVER 2003 8 UNDERSTANDING EVENT TYPES