Windows Server 2016 Services and Counters

This SAM application monitor template assesses the status and overall of services and performance of a Microsoft Windows Server 2016 operating system.

Prerequisites

WMI access to the target server.

Credentials

Windows Administrator on the target server.

Starting in SAM 2020.2, WinRM is the default transport method used to collect data for WMI-based component monitors (such as Performance Counter Monitors) in SAM templates and application monitors. To learn more, see Use WinRM for application monitor polling in SAM.

Component monitors

Service: Distributed Transaction Coordinator

Coordinates transactions that span multiple resource managers, such as databases, message queues, and file systems. If this service is stopped, these transactions will fail. If this service is disabled, any services that explicitly depend on it will fail to start.

Service: Security Accounts Manager

The startup of this service signals other services that the Security Accounts Manager (SAM) is ready to accept requests. Disabling this service will prevent other services in the system from being notified when the SAM is ready, which may in turn cause those services to fail to start correctly. This service should not be disabled.

Service: Remote Registry

Enables remote users to modify registry settings on this computer. If this service is stopped, the registry can be modified only by users on this computer. If this service is disabled, any services that explicitly depend on it will fail to start.

Total Available Memory (MBytes)

Shows the amount of physical memory, in megabytes (MB), immediately available for allocation to a process or for system use. It is equal to the sum of memory assigned to the standby (cached), free, and zero page lists. For a full explanation of the memory manager, refer to Microsoft Developer Network (MSDN) or "System Performance and Troubleshooting Guide" in the Windows Server 2003 Resource Kit.

This should remain above 100 MB at all times.

Page File Usage

This is a measure of how much of the pagefile is actually being used. This is the counter you should use to determine whether the pagefile is an appropriate size. If this counter reaches 100, the pagefile is completely full and operations stop working.

Depending on the volatility of your workload, you probably want to set the pagefile large enough so that no more than 50 to 75 percent of it is used. If a large part of the pagefile is in use, having more than one pagefile on different physical disks may improve performance.

Disk Queue Length

Tracks the number of requests that are queued and waiting for a disk during the sample interval, as well as requests in service. As a result, this might overstate activity. If more than two requests are continuously waiting on a single-disk system, the disk might be a bottleneck.

To analyze queue length data further, use Avg. Disk Read Queue Length and Avg. Disk Write Queue Length.

Virtual Memory

This is a measure of the demand for virtual memory. It shows how many bytes have been allocated by processes and to which the operating system has committed a RAM page frame or a page slot in the pagefile (or both).

As Committed Bytes grows above the available RAM, paging increases, and the amount of the pagefile in use also increases. At some point, paging activity starts to significantly affect perceived performance.

% Processor Time

Shows the percentage of time that the processor is executing application or operating system processes. This is when the processor is not idle.

This should be less than 75% on average.

Service: Server

Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

Service: Plug and Play

Enables a computer to recognize and adapt to hardware changes with little or no user input. Stopping or disabling this service will result in system instability.

Pages/sec

Pages/sec is the number of pages read from the disk or written to the disk to resolve memory references to pages that were not in memory at the time of the reference. This is the sum of Pages Input/sec and Pages Output/sec. This counter includes paging traffic on behalf of the system Cache to access file data for applications.

This should be 0-20 at all times. It is unhealthy if this is greater than 80, which probably indicates there is not enough RAM.

Logical Disk: Avg. Disk Queue Length

Tracks the number of requests that are queued and waiting for a disk during the sample interval, as well as requests in service. As a result, this might overstate activity.

If more than two requests are continuously waiting on a single-disk system, the disk might be a bottleneck.

This should be less than 4 at all times.

When looking at hard disks using perfmon.exe, an understanding of the underlying hard disk subsystem is required to determine which counters (physical disk or logical disk) to look at.

Physical Disk: Avg. Disk Queue Length

Tracks the number of requests that are queued and waiting for a disk during the sample interval, as well as requests in service. As a result, this might overstate activity.

If more than two requests are continuously waiting on a single-disk system, the disk might be a bottleneck.

This should be less than 4 at all times.

When looking at hard disks using perfmon.exe, an understanding of the underlying hard disk subsystem is required to determine which counters (physical disk or logical disk) to look at.