The Windows System Resource Log Enablement Package is a Windows Performance Monitor Template which contains Performance Counters. These counters provide basic threshold monitoring of OS metrics for processor, memory, and disk. All threshold data is sent to the Application Event Logs where the K1's Agent or Agentless component can manage performance data extraction. K1 then displays this data in a single page UI which tracks the overall health of the endpoints being monitored. The Threshold column below displays a Criteria Level of Critical, Warning, or Error. This column should have two values, a Default value and a Threshold value, for records without both, only a Default value of 10000 is set which needs to be reset to an appropriate Threshold value. For instructions related to LEP’s check out How to Edit Windows Monitoring Log Enablement Package(LEP), How to Import Windows Monitoring Log Enablement Package(LEP), and Troubleshooting Windows Monitoring Log Enablement Package(LEP). Detailed instructions on how to configure the K1 to monitor Application or Threshold Monitoring on devices can be found in the Dell KACE K1000 System Management Appliance 6.3 Administrator Guide.
Processor
Download Windows System Resource Processor Log Enablement Package for Windows Server 2008 and higher.
| Performance Counter | Description | Threshold Values |
| % Processor Time | % Processor Time is the percentage of elapsed time that the processor spends to execute a non-Idle thread. It is calculated by measuring the percentage of time that the processor spends executing the idle thread and then subtracting that value from 100%. (Each processor has an idle thread that consumes cycles when no other threads are ready to run). This counter is the primary indicator of processor activity, and displays the average percentage of busy time observed during the sample interval. It should be noted that the accounting calculation of whether the processor is idle is performed at an internal sampling interval of the system clock (10ms). On todays fast processors, % Processor Time can therefore underestimate the processor utilization as the processor may be spending a lot of time servicing threads between the system clock sampling interval. Workload based timer applications are one example of applications which are more likely to be measured inaccurately as timers are signaled just after the sample is taken. | Default>80 Critical>80 |
| Processor Queue Length | Processor Queue Length is the number of threads in the processor queue. Unlike the disk counters, this counter counters, this counter shows ready threads only, not threads that are running. There is a single queue for processor time even on computers with multiple processors. Therefore, if a computer has multiple processors, you need to divide this value by the number of processors servicing the workload. A sustained processor queue of less than 10 threads per processor is normally acceptable, dependent of the workload. | Default>4 Warning>4 |
| Context Switches/Sec | Context Switches/sec is the combined rate at which all processors on the computer are switched from one thread to another. Context switches occur when a running thread voluntarily relinquishes the processor, is preempted by a higher priority ready thread, or switches between user-mode and privileged (kernel) mode to use an Executive or subsystem service. It is the sum of Thread\\Context Switches/sec for all threads running on all processors in the computer and is measured in numbers of switches. There are context switch counters on the System and Thread objects. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval. | Default>5000 Critical>5000 |
Memory
| Performance Counter | Description | Threshold Values |
| Available Mbytes | Available MBytes is the amount of physical memory, in Megabytes, immediately available for allocation to a process or for system use. It is equal to the sum of memory assigned to the standby (cached), free and zero page lists. For a full explanation of the memory manager, refer to MSDN and/or the System Performance and Troubleshooting Guide chapter in the Windows Server 2003 Resource Kit. | Default<100 Critical<100 |
| Pages Input/Sec | Pages Input/sec is the rate at which pages are read from disk to resolve hard page faults. Hard page faults occur when a process refers to a page in virtual memory that is not in its working set or elsewhere in physical memory, and must be retrieved from disk. When a page is faulted, the system tries to read multiple contiguous pages into memory to maximize the benefit of the read operation. Compare the value of Memory\\Pages Input/sec to the value of Memory\\Page Reads/sec to determine the average number of pages read into memory during each read operation. | Default>10 Critical>10 |
| Page Writes/Sec | Page Writes/sec is the rate at which pages are written to disk to free up space in physical memory. Pages are written to disk only if they are changed while in physical memory, so they are likely to hold data, not code. This counter shows write operations, without regard to the number of pages written in each operation. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval. | Default>10000 |
| Page Reads/Sec | Page Reads/sec is the rate at which the disk was read to resolve hard page faults. It shows the number of reads operations, without regard to the number of pages retrieved in each operation. Hard page faults occur when a process references a page in virtual memory that is not in working set or elsewhere in physical memory, and must be retrieved from disk. This counter is a primary indicator of the kinds of faults that cause system-wide delays. It includes read operations to satisfy faults in the file system cache (usually requested by applications) and in non-cached mapped memory files. Compare the value of Memory\\Pages Reads/sec to the value of Memory\\Pages Input/sec to determine the average number of pages read during each operation. | Default>10000 |
| Pages/Sec | Pages/sec is the rate at which pages are read from or written to disk to resolve hard page faults. This counter is a primary indicator of the kinds of faults that cause system-wide delays. It is the sum of Memory\\Pages Input/sec and Memory\\Pages Output/sec. It is counted in numbers of pages, so it can be compared to other counts of pages, such as Memory\\Page Faults/sec, without conversion. It includes pages retrieved to satisfy faults in the file system cache (usually requested by applications) non-cached mapped memory files. | Default>1000 Critical>1000 |
Disk I/O
Download Windows System Resource Disk Log Enablement Package for Windows Server 2008 and higher.
| Performance Counter | Description | Threshold Values |
| % Free Space | % Free Space is the percentage of total usable space on the selected logical disk drive that was free. | Default<15 Critical<15 |
| %Idle Time | % Idle Time reports the percentage of time during the sample interval that the disk was idle. | Default<20 Critical<20 |
| Avg. Disk Sec/Read | Avg. Disk sec/Read is the average time, in seconds, of a read of data from the disk. | Default>25 Critical>25 |
| Avg. Disk Sec/Write | Avg. Disk sec/Write is the average time, in seconds, of a write of data to the disk. | Default>25 Critical>25 |
| Avg. Disk Queue Length | Avg. Disk Queue Length is the average number of both read and write requests that were queued for the selected disk during the sample interval. | Default>20 |
| Cache Bytes | Cache Bytes is the sum of the Memory\\System Cache Resident Bytes, Memory\\System Driver Resident Bytes, Memory\\System Code Resident Bytes, and Memory\\Pool Paged Resident Bytes counters. This counter displays the last observed value only; it is not an average. | Default>300 Critical>300 |
Comments