1

Vital Signs: Performance Monitoring Windows

Server

Module 7: Performance Analysis Of

Logs (PAL) ToolMicrosoft Confidential

©2011 Microsoft Corporation

Conditions and Terms of Use

This training package is proprietary and confidential, and is intended only for uses described in the training materials. Content and software is provided to you under a Non-Disclosure Agreement and cannot be distributed. Copying or disclosing all or any portion of the content and/or software included in such packages is strictly prohibited.

The contents of this package are for informational and training purposes only and are provided "as is" without warranty of any kind, whether express or implied, including but not limited to the implied warranties of merchantability, fitness for a particular purpose, and non-infringement.

Training package content, including URLs and other Internet Web site references, is subject to change without notice. Because Microsoft must respond to changing market conditions, the content should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication. Unless otherwise noted, the companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, e-mail address, logo, person, place, or event is intended or should be inferred.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.

For more information, see Use of Microsoft Copyrighted Content athttp://www.microsoft.com/about/legal/permissions/

Microsoft®, Internet Explorer®, and Windows® are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Other Microsoft products mentioned herein may be either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. All other trademarks are property of their respective owners.

Copyright and Trademarks © 2011 Microsoft Corporation. All rights reserved.

Microsoft Confidential

Students: How to View this Presentation

Switch to Notes Page view Click View on the ribbon and select Notes Page Use page up or page down to navigate Zoom in or out as needed

Most slides will have supporting text that you can view now or after the delivery

Add notes to your copy of the presentation if you want to.

You take the presentation files home with you.

Microsoft Confidential

4

Module 7: Performance Analysis of Logs (PAL) tool

Section 1: Getting startedSection 2: Using the wizardSection 3: Interpreting the report

Microsoft Confidential

5

Section 1: Getting started

OverviewDownload PALPAL supports most of the major Microsoft productsInstall PALExport thresholds to a counter log template

Microsoft Confidential

6

Performance Analysis of Logs (PAL) analyzes counter logs (.csv or .blg) and creates an HTML report

Overview

PAL uses the counter thresholds from the Vital Signs workshop

(continued)Microsoft Confidential

7

Overview (continued)

PAL is:• A free and open-source project on Codeplex.com• A time saver, but not a replacement for performance analysis• Not supported by Microsoft

o For support, use the forums at http://pal.codeplex.como Contributors and users donate their time

• Designed to be used on a workstation—no connectivity to the original computer needed

• Resource intensive during analysis

Microsoft Confidential

8

Free and public download available at http://pal.codeplex.com

Download PAL

Codeplex.com is Microsoft’s open-source websitePAL is an effort from the open-source community to make counter-log analysis easier

Microsoft Confidential

9

PAL has counter thresholds defined for most of the major Microsoft server products

PAL supports most of the major Microsoft products

The threshold files are owned by subject matter experts of that field

Microsoft Confidential

10

Install PAL

PAL 2.0 has the following prerequisites:• Windows PowerShell 2.0 (free)• .NET Framework 3.5 (free)• Microsoft Chart Controls for .NET Framework 3.5 (free)

PAL installation uses Windows Installer (.msi)

Microsoft Confidential

11

To take full advantage of the thresholds, export a threshold file to a counter log template

Export thresholds to a counter log template

Counter log templates can be saved as .htm (Windows Server 2003/ Windows XP), .xml (Windows Server 2008/Windows 7), or .txt (logman)

Microsoft Confidential

12

Section 2: Using the wizard

Counter log page: Choose the pathCounter log page: Restrict the time rangeThreshold file pageQuestions pageOutput options page: Analysis intervalOutput options page: All Counter Stats

File output pageQueue pageExecute pageFinish

Microsoft Confidential

13

Provide the file path to one more counter logs (.blg or .csv)

Counter log page: Choose the path

If you provide paths to multiple logs, PAL uses Relog.exe to attempt to merge the logs. Use consecutively captured logs.

Microsoft Confidential

14

You can restrict the date/time range to reduce the size of the output or to focus on a specific time range

Counter log page: Restrict the time range

PAL uses Relog.exe to restrict the date/time range of the log

Microsoft Confidential

15

Choose a threshold file that best describes the product or role of the counters that are captured in the counter log

Threshold file page

System Overview is the generic default for Windows and Windows Server operating systems. Quick System Overview gives a “quick” analysis.

Microsoft Confidential

16

The answers to these questions help determine which thresholds are best for your particular computer environment

Questions page

Click each question and type an answer

Microsoft Confidential

17

The log is divided into time slices. Choose an analysis interval to determine the size of the time slices.

Output options page: Analysis interval

Time slices each have a min, avg, max, and trend value. Average values are typically more useful than maximum values.The AUTO (automatic) value divides the log into 30 time slices.

Microsoft Confidential

18

If you select this checkbox, the final report will include all of the counters that are in the log

Output options page: All Counter Stats

All Counter Stats is much more resource intensive and is disabled by defaultGreat for third-party counters or for other counters without thresholds defined

Microsoft Confidential

19

Choose the output directory, and either the HTML report and naming convention or the XML output and naming convention

File output page

The default is the user’s My Documents\PAL Reports folder. [LogFileName], [DateTimeStamp], and [GUID] are variables.

Microsoft Confidential

20

The queue is a batch (.bat) file that runs a Windows PowerShell script, PAL.ps1

Queue page

The PAL.ps1 script is the analysis engine. The wizard just creates the batch file that runs the script.

Microsoft Confidential

21

Execute the queue (batch file), add another log to analyze, or execute and restart the wizard

Execute page

The PAL analysis is resource intensive. It can be executed as a low priority, in order to reduce its impact on resources.

Microsoft Confidential

22

While the script is running, it can be very resource intensive

Finish

PAL can run on a workstation that does not have connectivity to the computer that the counter log was original captured on

Microsoft Confidential

23

Section 3: Interpreting the report

The HTML reportInterpreting the reportAnalysis chartsAlerts

Microsoft Confidential

24

After the analysis, an HTML report is created

The HTML report

The report has a table of contents showing the number of alerts in each section. Alerts are counter values that are outside established thresholds.

Microsoft Confidential

25

Each analysis has a description, the thresholds it uses, and references to more information, charts, and alerts

Interpreting the report

Microsoft Confidential

26

Analysis charts

The chart lines use different patterns to help differentiate them

Most charts in the analyses show the thresholds

Microsoft Confidential

27

Alerts are thrown when thresholds are broken. Overall counter stats are analyzed, as well as each time slice.

Alerts

Microsoft Confidential

28

Review

1. What is important about the size of the time slices in the analysis?

2. Is PAL supported by Microsoft?3. Why does PAL save time?

Microsoft Confidential

29

Review (answers)

1. The size of time slices define the average, min, max, and trend values which are used for each threshold

2. No, the PAL tool is an open source project that is not supported by Microsoft

3. It bulk processes counter logs and presents the data in an easy to read report

Microsoft Confidential

30

Questions?

Microsoft Confidential