Monitoring and Troubleshooting Performance Lesson

Introduction
A computer system that performs at a low efficiency level can cause workplace problems such as
reducing user productivity and consequently increasing user frustration.

Windows 10 has tools that can help you to determine the potential causes of poor performance, and
afterwards use appropriate tools to help resolve the performance issues.

Lesson Objectives After completing this lesson, you will be able to:
 Describe key system components in Windows 10.
 Describe performance monitoring tools in Windows 10.
 Explain how to establish a performance baseline.
 Explain how to optimize disk and memory performance in a Windows 10 computer.

Key Performance Components in Windows 10

 Decreased computer system performance is a common source of user complaints.
 Performance is a measure of how quickly a computer completes application and system tasks.
 Performance problems can occur when available resources are lacking.
 Computers respond slowly for several reasons, including disorganized files, unnecessary software
that consumes resources, too many startup apps, or perhaps even malware or a virus.
 Factors that can influence computer system performance include:
o Access speed of the physical hard disks.
o Memory available for all running processes.
o Fastest speed of the processor.
o Maximum throughput of the network interfaces.
o Resources that the individual applications consume.
o Faulty or poor configuration of components, which leads to the unnecessary consumption of
resources.
o Out-of-date or inappropriate drivers for system components and peripherals, including the
graphics subsystem.

Windows 10 computers have four main hardware components that you should monitor:

 Processor
 Disk
 Memory
 Network
 Understanding how the operating system utilizes these four key hardware components and how
they interact can help you better optimize computer workstation performance.
 When monitoring workstation performance, you should consider:
 Measuring the performance of key components in your user’s workstation.
 The workstation role and its workload, to determine which hardware components are likely to
restrict performance.
  The ability to increase workstation performance by adding power or reducing the number of
applications that the user runs.
 Note: Although not considered a core component, the graphics adapter and its driver also can have
a significant impact on the performance of graphics-intensive applications.
 If your users intend to run applications that are graphically demanding, ensure that you select a
device with a powerful graphics subsystem, and that you install the latest vendor-specific driver
rather than relying on a generic driver.

Processor
 One important factor in determining your computer’s overall processor capacity is processor speed.
 Processor speed is determined by the number of operations that the processor performs over a
specific time period.
 Computers with multiple processors or processors with multiple cores generally perform processor-
intensive tasks with greater efficiency, and as a result, are faster than single processor or single-core
processor computers.
 Processor architecture is also important. 64-bit processors can access more memory and have a
significant positive effect on performance.
 This is true especially when applications that run on users’ workstations require a large amount of
memory.

Disk
 Hard disks store programs and data.
 Consequently, the throughput of a workstation’s disk affects its speed, especially when the
workstation performs disk-intensive tasks.
 Many hard disks have moving parts, and it takes time to position the read/write heads over the
appropriate disk sector to retrieve the requested information.
 Most Windows-based tablet devices use solid-state drives (SSDs), which have no moving parts. SSDs
have different read and write performance profiles.
 Determine the workload profile, and then attempt to match the disk’s performance profile to
optimize the device’s performance.
 By selecting faster disks, and by using collections of disks to optimize access times (Storage Spaces
or redundant array of independent disks (RAID)), you can alleviate the potential for the disk
subsystem to create a performance bottleneck.
 Windows 10 moves information on the disk into memory before it uses it.
 Therefore, if a surplus of memory exists, the Windows 10 operating system creates a file cache for
items recently written to, or read from disks.
 Installing additional memory in a workstation often improves the disk subsystem performance,
because accessing the cache is faster than moving the information into memory.
 Finally, consider the type of work for which users will use the device. Different work profiles use
disks in different ways.
 For example, some applications read from a disk more frequently that they write to the disk (read-
intensive), and therefore good read performance is important; other applications are more write-
intensive.
Memory
 Programs and data load from disk into memory before the program manipulates the data.
 In workstations that run multiple programs, or where datasets are very large, installing more
memory can improve workstation performance.
 Windows 10 uses a memory model that does not reject excessive memory requests.
 Instead, Windows 10 manages them by using a process known as paging.
 During paging, Windows 10 moves the data and programs in memory that processes are not
currently using, to the paging file on the hard disk.
 This frees up physical memory to satisfy the excessive memory requests.
 However, because a hard disk is comparatively slow, it has a negative effect on workstation
performance.
 By adding more memory, and by using a 64-bit processor architecture that supports larger memory,
you can reduce the need for paging.

Network
 You can easily underestimate how a network that performs poorly can affect workstation
performance, because it is not as easy to see or to measure as the other workstation components.
 However, the network is a critical component for performance monitoring, because network devices
store so many of the applications and data processed.
 In addition, wireless networks share the available bandwidth.

Understanding bottlenecks
 A performance bottleneck occurs when a computer is unable to service the current requests for a
specific resource.
 The resource might be a key component, such as a disk, memory, processor, or network.
 Alternatively, the shortage of a component within an application package also might cause a
bottleneck.
 By using performance-monitoring tools on a regular basis, and by comparing the results to historical
data, you can identify performance bottlenecks before they affect users.
 Once you identify a bottleneck, you must decide how to remove it.
 Your options for removing a bottleneck include:
o Running fewer applications.
o Adding additional resources to the computer.
 A computer suffering from a severe resource shortage might stop processing user requests.
 This situation requires immediate attention.
 However, if a computer experiences a bottleneck but still operates within acceptable limits, you
might decide to defer any changes until you resolve the situation, or until you have an opportunity
to take corrective action.
 As you identify and resolve a performance problem that is affecting one system component, another
component might become affected.
 Therefore, performance monitoring is an ongoing process.

Common causes for resource bottlenecks

 Resource bottlenecks might occur for several reasons.
 Some of the most common causes are:
 o Resources are insufficient, and your computer might require additional or upgraded
components.
o A resource is malfunctioning, and you need to replace it.
o A resource is not configured correctly, and you need to change configuration settings.
o An application is monopolizing a particular resource, which might require that you do one of
the following:
 Substitute with another application.
 Have a developer rewrite the application.
 Add or upgrade resources.
 Run the application when demands for resources are low.

Performance tuning and testing

 When you experience performance issues, you should make one change at a time, and then monitor
your resources after every change to verify whether the change solved the performance issue.
 In addition to monitoring, you can review event logs, because some performance problems generate
output that you can review in Event Viewer.
 To see whether network components are affecting performance, compare the performance of
programs that run over the network with programs that run locally.

Establishing a Performance Baseline

 By calculating performance baselines for your client computer environment, you can interpret real-
time monitoring information more accurately.
 A baseline for a computer’s performance indicates what your performance-monitoring statistics look
like during normal use.
 You can establish a baseline by monitoring performance statistics over a specific period.
 When an issue or symptom occurs in real time, you can compare your baseline statistics to your
real-time statistics, and then identify anomalies.
 You can set up a baseline in the Performance Monitor to help you with the following tasks:
 Evaluate your computer’s workload
 Monitor system resources
 Notice changes and trends in resource use
 Test configuration changes
 Diagnose problems
 By using data collector sets, you can establish a baseline to use as a standard for comparison.
 You create a baseline when you first configure the computer, at regular intervals of typical usage,
and when you make any changes to the computer’s hardware or software configuration.
 If you have appropriate baselines, you can determine which resources are affecting your computer’s
performance.
 When you create a performance baseline for a computer, you cannot transfer that baseline to a
computer configured with different hardware or software.
 Instead, you should create a performance baseline per client computer configuration.
 Note: You might have to recreate the baseline when you upgrade to Windows 10, because once it is
upgraded with new features and security updates, the baseline performance of Windows 10 might
change.
Task Manager
 You can use the Performance tab in Task Manager to help to identify performance problems.
 The Performance tab displays a summary of CPU and memory usage, and network statistics.
 Generally, you might consider using Task Manager when a performance-related problem first
becomes apparent.
 For example, you might examine the running processes to determine if a particular program is using
excessive CPU resources.
 Remember that Task Manager shows a snapshot of current resource consumption.
 You may need to examine historical data to get a better understanding of a server computer’s
performance and response under load.

Resource Monitor
 When the Resource Monitor first opens, the initial view is of the Overview tab.
 On the right side are four graphs: CPU, Disk, Network, and Memory.
 You can examine these graphs, looking for excessive peaks in CPU, Disk, Network, or Memory
activity.
 In the main pane, you can examine details about each component by expanding each component’s
information list.
 It lists each process that is running on the computer, and includes information about resource
consumption for each process.
 For example, the number of threads and the percentage of CPU capacity in use displays for each
running process.
 Having determined that a particular component is causing a bottleneck, you can use the appropriate
component tab to view more information.
 Remember that a snapshot of current activity, which Resource Monitor provides, tells only a partial
story. For instance, you might see a peak in activity, which is not representative of average
performance.

Performance Monitor
 Performance Monitor features multiple graph views that give you a visual review of performance log
data.
 You can create custom views in Performance Monitor that you can export as data collector sets for
use with performance and logging features.
 You can use data collector sets and the Performance Monitor tools to organize multiple data
collection points into a single component that you can use to review or log performance.
 The Performance Monitor also includes default data collector set templates to help system
administrators begin the process of collecting performance data.
 In the Performance Monitor, under the Data Collector Sets node, you can use the User Defined node
to create your own data collector sets.
 You can specify which objects and counters you want to include in the set for monitoring.
 To help you select appropriate objects and counters, you can use the following templates provided
for monitoring:
o System Diagnostics. This template selects objects and counters that report the status of
hardware resources, system response time, and processes on the local computer, along with
 system information and configuration data. The report provides guidance on ways to
optimize the computer’s responsiveness.
o System Performance. This template generates reports that detail the status of local
hardware resources, system response times, and processes.
o WDAC Diagnostics. This template enables you to trace debug information for Windows Data
Access Components.
 You also can configure a data collector set to run at a scheduled time, for a specific length of time, or
until it reaches a predefined size.
 For example, you can run the data collector set for 10 minutes every hour during working hours to
create a performance baseline.
 You also can set the data collector to restart when set limits are reached, so that a separate file will
be created for each interval.
 You can use data collector sets and Performance Monitor tools to organize multiple data collection
points into a single component that you can use to review or log performance.
 Performance Monitor also includes default data collector set templates to help system
administrators begin the process of collecting performance data specific to a server role or
monitoring scenario.
 In Performance Monitor, beneath the Data Collector Sets node, you can use the User Defined node
to create your own data collector sets.
 You can specify which specific objects and counters you want to include in the set for monitoring. To
help you select appropriate objects and counters, you can access templates to use for monitoring,
including:
o System Diagnostics. Selects objects and counters that report the status of hardware
resources, system response time, and processes on the local computer, along with system
information and configuration data. The report provides guidance on ways to optimize the
computer’s responsiveness.
o System Performance. Generates reports that detail the status of local hardware resources,
system response times, and processes.
o WDAC Diagnostics. Enables you to trace debug information for Windows Data Access
Components.
 Note: It is not necessary for Performance Monitor to be running for data to be collected into a data
collector set.
 You can add many different performance counters to the Performance Monitor.
 Some performance counters are not often used.
 The following table shows the commonly used performance counters.

Counter Usage
LogicalDisk\% Free Space This counter measures the percentage of free space on the selected
logical disk drive. Take note if this falls below 15 percent, because
you risk running out of free space for the operating system to store
critical files. One solution is to add more disk space.
PhysicalDisk\% Idle Time This counter measures the percentage of time the disk was idle
during the sample interval. If this counter falls below 20 percent,
 the disk system is saturated. You should consider replacing the
current disk system with a faster one.
PhysicalDisk\Avg. Disk Sec/Read This counter measures the average time, in seconds, to read data
from the disk. If the number is larger than 25 milliseconds (ms), that
means the disk system is experiencing latency when it is reading
from the disk.
PhysicalDisk\Avg. Disk This counter measures the average time, in seconds, it takes to
Sec/Write write data to the disk. If the number is larger than 25 ms, the disk
system experiences latency when it is writing to the disk.
PhysicalDisk\Avg. Disk Queue This counter indicates how many I/O operations are waiting for the
Length hard drive to become available. If the value is larger than two times
the number of spindles, it means that the disk itself might be the
bottleneck. If this counter indicates a possible bottleneck, consider
measuring the Avg. Disk Read Queue Length and Avg. Disk Write
Queue Length to try to determine if read or write operations are the
cause.
Memory\Cache Bytes This counter indicates the amount of memory that the file-system
cache uses. There might be a disk bottleneck if this value is greater
than 300 megabytes (MB).
Memory\% Committed Bytes in This counter measures the ratio of Committed Bytes to the Commit
Use Limit, or in other words, the amount of virtual memory in use. If the
number is greater than 80 percent, it indicates insufficient memory.
Memory\Available Mbytes This counter measures the amount of physical memory, in
megabytes, available to run processes. If this value is less than 5
percent of the total physical random access memory (RAM), that
means there is insufficient memory, which can increase paging
activity.
Memory\Free System Page This counter indicates the number of page table entries not
Table Entries currently in use by the system. If the number is less than 5,000,
there might be a memory leak.
Memory\Pool Non-Paged Bytes This counter measures the size, in bytes, of the nonpaged pool. This
is an area of system memory for objects that cannot be written to a
disk, but instead must remain in physical memory for as long as they
are allocated. If the value is greater than 175 MB (or 100 MB with
a /3 gigabyte (GB) switch), then there is a possible memory leak
Memory\Pool Paged Bytes This counter measures the size, in bytes, of the paged pool. This is
an area of system memory for objects that can be written to disk
when they are not being used. There might be a memory leak if this
value is greater than 250 MB (or 170 MB with the /3 GB switch).
Memory\Pages per Second This counter measures the rate at which pages are read from or
written to the disk to resolve hardpage faults. If the value is greater
than 1,000 as a result of excessive paging, there might be a memory
leak.
Processor\% Processor Time This counter measures the percentage of elapsed time that the
processor spends executing a non-idle thread. If the percentage is
greater than 85 percent, the processor is overwhelmed, and the
server might require a faster processor.
 Processor\% User Time This counter measures the percentage of elapsed time that the
processor spends in user mode. If this value is high, the server is
busy with the application.
Processor\% Interrupt Time This counter measures the time that the processor spends receiving
and servicing hardware interruptions during specific sample
intervals. If the value is greater than 15 percent, this counter
indicates a possible hardware issue.
System\Processor Queue This counter indicates the number of threads in the processor
Length queue. The server does not have enough processor power if the
value is more than two times the number of CPUs for an extended
period of time.
Network Interface\Bytes This counter measures the rate at which bytes are sent and received
Total/Sec over each network adapter, including framing characters. The
network is saturated if more than 70 percent of the interface is
consumed.
Network Interface\Output This counter measures the length of the output packet queue, in
Queue Length packets. There is network saturation if the value is more than 2.
Counter Usage Process\Handle This counter measures the total number of handles that a process
Count currently has open. This counter indicates a possible handle leak if
the number is greater than 10,000.
Process\Thread Count This counter measures the number of threads currently active in a
process. There might be a thread leak if this number is more than
500 between the minimum and maximum number of threads.
Process\Private Bytes This counter indicates the amount of memory that this process has
allocated that it cannot share with other processes. If the value is
greater than 250 between the minimum and maximum number of
threads, there might be a memory leak.
Optimizing Disk and Memory Performance
Disk and memory are arguably the resources that can make the most positive impact on improving
client computer performance. Use the following guidelines to help to optimize disk and memory
performance in your Windows 10 computer.

Select a 64-bit version of Windows 10. Using a 64-bit version enables your computer to use more
memory than the 4 GB limitation imposed by 32-bit operating systems. If your computer has more than
4 GB of memory, or if you can add additional memory beyond 4 GB, then select a 64-bit version of
Windows 10.

Avoid shared memory video. Some video adapters use shared system memory. This means that the
video adapter uses memory for display purposes that would otherwise be available for servicing
applications. Some computers come equipped with video adapters that use dedicated onboard memory
for display purposes, ensuring that more memory is available for applications.

Optimize paging. For most single disk drive computers that run Windows 10, leaving the paging file
settings at the default values is adequate. However, you might gain a small performance benefit by
following these guidelines:
 Create the paging file on a different physical disk than the operating system disk. Paging is a disk-
intensive task. If you distribute the disk load across all of your computer’s available disks, you minimize
the likelihood of performance bottlenecks affecting the disk subsystem. By optimizing the disk
subsystem, you can make the paging process as efficient as possible. If you have a device with an SSD as
the primary disk and a normal hard disk as the secondary disk, moving the paging file is not likely to
improve performance.

Configure a fixed-size paging file. A paging file that can grow on the disk might encompass fragmented
areas of the disk volume. By configuring a fixed-size paging file, you can ensure that the paging file does

On non-SSD drives, ensure that the disk volume is not fragmented when you create the paging file. If
you want to create a fixed-size paging file on a computer that already has a paging file, ensure that you
do not create a paging file that encompasses fragmented areas of the disk. Additionally, before you
create a fixed-size paging file, you should configure the computer to use no paging, and then
defragment the volumes.

When you configure the paging file, ensure that its size is sufficient. Recommendations specify that an
initial paging file should be equivalent to the amount of installed memory, and a maximum paging file
size that is equal to twice the initial value. Consequently, you should create a fixed-size paging file that is
equal to or twice the size of the physical memory.

Add physical memory to a computer that is paging excessively. If you investigate performance on a
computer with a memory bottleneck, you often find that disk performance is low as well. By adding
extra physical memory to the computer you can reduce the load on the disk subsystem and thereby
improve both memory and disk performance.

Implement faster disks. Disk speed is measured in revolutions per minute (rpm), and average seek times
are measured in milliseconds. Install disks running 7200 rpm or faster, and select disks with the lowest
seek time. On desktop computers, you also can install a disk controller that supports a faster bus type.
The first Serial ATA (SATA) standard supports transfer rates up to 150 megabytes per second (MBps)
whereas the latest SATA standard supports transfer rates up to almost 2000 MBps. Changing your disk
controller and disks that support the new disk controller could improve the disk subsystem performance
considerably.

Consider using SSDs. SSDs use flash memory technology and have no moving parts. They can operate
faster than traditional disks, but they are more expensive. Carefully research the specific vendor and
model of disk. Some disks provide higher write performance, and some provide higher read
performance. In systems that support multiple drives where SSD cost is a concern, consider a smaller
SSD drive to store the OS and a SATA drive for apps and data.

Defragment volumes that are used heavily. You can use either the built-in disk Optimize Drives tool or
another company’s tools, some of which support the defragmentation of files such as Hiberfil.sys and
Pagefile.sys. Windows 10 optimizes drives automatically once a week and will run the proper
optimization automatically (defragmenting SATA drives or running TRIM on SSDs).

Ensure that you enable write-caching. You can use Device Manager to examine the properties of any
installed disks, and to verify that write-caching is enabled.
 Distribute the memory load across all available disks. If your computer has multiple physical disks,
consider distributing disk-intensive activities across these disks. For example, you can install the
Windows operating system and applications on one disk, the paging file on another disk, and your data
files on a third disk.

Indexes
 Indexing is a technology used by Windows search.
 As the name implies, it is an index, a local database.
 Windows uses this index to keep track of files, folders, file types, data properties, and other details
about files so that you can search by those details to locate data more easily.
 Generally when you search for a file, Windows accesses this index first.
 It is important to personalize the settings for indexing to meet your needs.
 You want to make sure the service is indexing all of the areas of your computer that you use and it
does not index unnecessary areas.

Contents of the Windows Search Index

 One index is maintained per computer so shared data stored on local drives is indexed only once.
 In addition, each user’s data is distinguishable by a unique user security identifier {SID}, so users
have access only to their own content.
 System administrators can use Group Policy to prevent specific paths or file types from being
indexed.
 Windows Search indexes information as follows:
 By default, Windows Search indexes each user’s e-mail and Documents and Settings folders
(users can add custom locations like network shares). Indexing of shared folders can be turned
off with Group Policy.
 Windows Search does not index password-protected Office files.
 Windows Search indexes e-mail and attachments in a secure environment.
 Indexing of attachments can be turned off with Group Policy.
 The Windows Search index is updated automatically in the background when data is added,
deleted, and modified.

Indexing Encrypted Files

 Windows Search 4.0 and higher fully supports indexing encrypted files on local file systems, enabling
users to index and search the properties and contents of encrypted files.
 Users can manually configure Windows Search to include encrypted files, or administrators can
configure this with Group Policy.
 Windows Search ensures that only users with the correct permissions can search the content of
encrypted files by honoring ACLs and by restricting access to users with decryption permissions for
the files.
 Additionally, Windows Search restricts access to encrypted files to local searches only; Windows
Search does not return encrypted files in search results when the query is initiated remotely.
 Note: The indexing of encrypted files should not be enabled unless the search index itself is
protected with full volume encryption.
 While encrypting the index file with EFS is possible, it is not recommended