My purpose of this post is to help you in preliminary analysis of performance issue on the server/desktop to trace the issue whenever you face the issue of Slowness, sluggish behavior and performance issue or reported by the end user. The best inbuilt tool in windows operating system used in such scenario is Perfmon.

I don’t think single post will be sufficient to describe the perfmon counters and its purpose. However I am trying to explain very few specially targeting Processor and Memory which is the most common reason of the issue. My effort is to help you in preliminary analysis of performance issue on the server/desktop to trace the issue.

Processor Troubleshooting

Processor bottlenecks occur when the processor is so busy that it cannot respond to requests for a noticeable period of time.

 

Counter Primary Indicator Threshhold Values
Processor(_Total)\% Processor Time Processor utilization Sustained values > 90% busy on a uniprocessor or sustained values >80% on a multiprocessor should be investigated.
System\Processor Queue Length Current depth of the thread Scheduler Ready Queue Numerous observations > 2 Ready threads per processor should be investigated. Observations > 5 Ready threads per processor are cause for alarm

When the processor executes instructions, it is in either of two states: Privileged mode or User mode.

Processor(n)\% Privileged Time It records the percentage the system was found busy while executing in Privileged mode. Within this 2 additional modes are available Interrupt mode and Deferred Procedure Call.

Interrupt mode is a high-priority mode reserved for interrupt service routines (ISRs), which are device driver functions that perform

hardware-specific tasks to service an interrupting device.

Processor(n)\% Interrupt Time It records the percentage of time the system was found busy while it was executing in Interrupt mode, or other high IRQL activity

DPCs are often referred to as soft interrupts. It runs at dispatch level IRQL, just below the priority level of interrupt service routines.

Processor(n)\% DPC Time It records the percentage of time the system was found busy while at dispatch level.

 

Once you are able to diagnose the process causing CPU spike, first step is to lower the Priority Level and check if the CPU resource crunch is contented or not, else you may kill the process if you are sure that it will not destabilize the Operating system and its functionality.

Memory Troubleshooting

[Counters to evaluate when troubleshooting memory performance] 

Counter Description Suggested Threshold
Memory\%Committed Bytes in use This value should be relatively stable during a long-term view. Investigate if greater than 80%.
Memory\Available Bytes If this value is low, check the Memory\Pages/sec counter value. Low available memory and high paging indicate a memory shortage resulting from an excessive application load or a defective process. Investigate if less than5% of the size of RAM.
Alarm if less than 0.5%of the size of RAM.
Memory\Commit Limit This value should stay constant, indicating an adequately sized paging file. If this value increases, the system enlarged the paging file for you, indicating a prolonged virtual memory shortage. Investigate if the trend of this value is increasing over time.
Memory\Committed Bytes This represents the total virtual memory allocated by the processes on the system. If it increases over an extended period of time, a process might be leaking memory Investigate if the trend of this value is increasing over time.
Memory\Pages/sec Tracks page fault pages generated by read (input) and write (output) operations. If this value is high, check the Pages Input/sec to see whether
application(s) are waiting for pages that could slow response time.
Depends on page file disk speed. Additional investigation might be required when there are more than 40 per second on slow disks or more than 300 per second on faster disks.
Memory\Pages Input/sec Tracks page faults requiring data to be read from the disk. Unlike output pages, the application must wait for this data to be read, so application response time can be slowed if this number is high.
Check the disk % Idle Time to see whether the page file drive is so busy that paging performance might be adversely affected.
Varies with disk hardware and system performance.
More than 20 might be a problem on slow disk drives, whereas faster drives can handle much more.
Memory\Pool Nonpaged Bytes Tracks memory that is always resident in physical memory. Primarily device drivers use this memory.
The value of this counter should be relatively stable. An increasing value over time might indicate a pool memory leak.
Investigate if Pool Nonpaged Bytes is running at > 80% of its maximum configured pool size.
Memory\Pool Paged Bytes Tracks memory that can be paged out of physical memory. Any service or application can use this memory.
The value of this counter should be relatively stable. An increasing value over time might indicate a pool memory leak.
Investigate if Pool paged Bytes is running at > 70% of its maximum configured pool size.
Process(_Total)\Private Bytes Monitors the sum of all private virtual memory allocated by all the processes running on that system.
If this value increases over a long period of time, an application might be leaking memory.
Investigate if the trend of this value is increasing over time.
LogicalDisk(pagefile drive)\% Idle Time Monitors the idle time of the drive (or drives) on which the paging file resides.
If this disk is too busy (that is, has a very low idle time), virtual memory operations to that disk will slow down.
Investigate paging  drives with less than 50% Idle Time.
LogicalDisk(pagefile drive)\Split I/O/sec Monitors the rate that Split I/Os are occurring on the drive with the paging file.
A higher than normal rate of Split I/Os on a drive with a paging file can cause virtual memory operations to that disk to take longer.
The threshold value for this counter depends on the disk drive type and configuration

 

Primary indications of a memory bottleneck [Shortage of RAM] 

Counter Description Suggested Threshold
Memory\Pages/sec Paging operations to disk (Pages input + Pages output) Pages/sec × 4K page size > 70% of the total number of Logical Disk Bytes/sec to the disk(s) where the paging file is located.
Memory\Page Reads/sec Page faults that were resolved by reading the disk [Hard Page Fault] Sustained values > 50% of the total number of Logical Disk operations to the disk(s) where the paging file is located.
Memory\Available Bytes Free (unallocated) RAM Available Bytes < 5% of the size of RAM is likely to mean there is a shortage of physical memory.

 

Disk is also a contender in the race to cause the issue however I will be explaining that in a separate post .

Hope you have enjoyed reading and will try to use perfmon and it’s counters.