Exam Ref 70-411 Administering Windows Server 2012 R2 (2014)

Monitoring real-time performance

You can monitor real-time performance by using the Resource Monitor view of the Windows Performance Monitor. Start the Resource Monitor by using the shortcut in Administrative Tools by clicking the link in the Overview Of Performance Monitor pane of Windows Performance Monitor. You can also type perfmon /res from a command shell.

The Resource Monitor provides detailed real–time process monitoring, CPU usage, memory, logical and physical disk, and network usage. You can end a problem process or the entire tree of a problem process. You can also suspend a process (and resume previously suspended processes). When a process appears to be a problem, you can analyze the wait chain for the process to see whether it is a problem and what it is waiting for, as shown in Figure 1-14.

FIGURE 1-14 The Analyze Wait Chain dialog box

Monitoring virtual machines

All Hyper-V hosts include virtual machine (VM) resource pools that align with the resources that the host provides to guest VMs. These resource pools include processor, Ethernet, memory, and Virtual Hard Disk (VHD). By monitoring these resource pools, you can also monitor the aggregate usage of the resource by the guest VMs. You can also create new resource pools that measure a subset of a resource, such as the VHDs on a specific volume. To get a list of the resource pools, use the Get-VMResourcePool cmdlet. The default output on a Hyper-V host that hasn’t had any configuration done is the following:

Name ResourcePoolType ParentName ResourceMeteringEnabled
---- ---------------- ---------- -----------------------
Primordial FibreChannelConnection False
Primordial FibreChannelPort False
Primordial VFD False
Primordial ISO False
Primordial VHD False
Primordial Memory False
Primordial Ethernet False
Primordial Processor False

The predefined resource pools are named Primordial to indicate that they represent the resources of the entire host machine. To enable a pool, use the Enable-VMResourcePool cmdlet. To enable resource metering on all available pools, use this command:

Enable-VMResourceMetering *

The preceding command enables all resource pools on the host that have a resource to enable. On my host, it yielded the following:

Name ResourcePoolType ParentName ResourceMeteringEnabled
---- ---------------- ---------- -----------------------
Primordial FibreChannelConnection False
Primordial VFD False
Primordial ISO False
Primordial VHD True
Primordial Ethernet True
Primordial Memory True
Primordial FibreChannelPort False
Primordial Processor True

The pools that still show False were not enabled because there are no resources associated with them.

Creating new VM resource pools

You can create new VM resource pools that monitor subsets of the primordial pool. For example, to create a new resource pool to monitor the resources used by the VHDs on the E drive, create a new VM resource pool with the following command:

New-VMResourcePool "E-Drive" VHD -Paths "E:\"

Name ResourcePoolType ParentName ResourceMeteringEnabled
---- ---------------- ---------- -----------------------
E Drive Pool VHD {Primordial} False

Monitoring resource usage by VMs

You can use VM resource pools to monitor the resource usage of specific VMs. To enable resource metering on the VM trey-dc-02, use the following command:

Enable-VMResourceMetering -VMName trey-dc-02

To see the resource usage of trey-dc-02, use this command:

Measure-VM -VMName trey-dc-02

VMName AvgCPU AvgRAM MaxRAM MinRAM TotalDisk Network Network
(MHz) (M) (M) (M) (M) Inbound(M) Outbound(M)
--------------- ------- ----- ------ ------ --------- ---------- -----------
trey-dc-02 20 1358 1358 1358 130048 7 2

Because Measure-VM supports lists of VMs, you can quickly get the resource usage of all the VMs running on the local machine:

Get-VM | Measure-VM

VMName AvgCPU AvgRAM MaxRAM MinRAM TotalDisk Network Network
(MHz) (M) (M) (M) (M) Inbound(M) Outbound(M)
--------------- ------- ----- ------ ------ --------- ---------- -----------
charlie-monster 0 0 0 0 0 0 0
trey-dc-02 20 1382 1420 1342 130048 79 16
trey-server-01 102 1010 1044 972 334848 16 5
trey-Server-02 45 5803 5838 5682 260096 4 3
trey-wds-11 16 1688 1744 1638 348862 14 73
vm-ts-05 73 1287 1401 1248 130048 113 14
Win7-DRM 0 0 0 0 0 0 0

This is useful, but the VM cmdlets also support remoting, so you can easily get the status of a remote machine as well:

Enable-VMResourceMetering * -ComputerName hp350-srv8-7
Get-VM -ComputerName hp350-srv8-7 | Measure-VM

VMName AvgCPU AvgRAM MaxRAM MinRAM TotalDisk Network Network
(MHz) (M) (M) (M) (M) Inbound(M) Outbound(M)
--------------- ------- ----- ------ ------ --------- ---------- -----------
HP350-TS-05 20 2703 2703 2703 539648 2 2
srv2 290 16384 16384 16384 614401 3 3

Monitoring events

Event monitoring has not materially changed in Windows Server 2012 or Windows Server 2012 R2 over the behavior and tools available in Windows Server 2008—with the exception of a limited number of Windows PowerShell cmdlets. The exam questions will likely focus on that one area that is new while retaining some legacy questions such as how to create a custom event view.

Creating custom views

You can create custom Event Viewer views by opening the Event Viewer console (eventvwr.msc) and clicking Create Custom View in the Actions pane. Specify the time period for the view in the Logged drop-down list, and set the Event Level to View. Continue configuring what you want to see in the custom view. As shown in Figure 1-15, you can track by log or by source, and specify Event IDs, task categories, keywords, and the user and computer that generated the event.

FIGURE 1-15 The Create Custom View dialog box of the Event Viewer console

Using Windows PowerShell to monitor events

You can use Windows PowerShell to monitor events. A quick way to get a list of all available event–related Windows PowerShell cmdlets, organized to make it easier to find what you need, is to use this command:

Get-Command *event*,*counter* | sort noun,verb | Format-Table -auto Verb,Noun,Module

This command gives you a list of all the Windows PowerShell cmdlets on the current computer that have “event” or “counter” in their name, sorted by noun.

Some of the common Windows PowerShell cmdlets used for server monitoring are shown in Table 1-2.

TABLE 1-2 Popular Windows PowerShell cmdlets for server monitoring

Using event subscriptions

Event Viewer allows you to connect to a remote computer, but only one at a time. This limitation can make it difficult to collect events that span multiple computers, and it is positively tedious to try to capture the event health of your entire network. However, beginning in Windows Server 2008, you can create subscriptions to enable multiple computers to forward events from multiple logs to a single computer for evaluation.

When you create an event subscription, you specify exactly which events are forwarded and in which log they are stored locally. When you have the subscription events in a local log, you can view and process them in the same way you would a local event.

Configuring for event subscriptions

Before you can use event subscriptions, both the event sender (forwarder) and event receiver (collector) have to be configured to support the subscription. On each source (forwarding) computer, you have to enable and configure Windows Remote Management (WinRM) with this command:

WinRM quickconfig

You have to run the same WinRM command on the collector computer if you need to configure event delivery optimization. In addition, you have to run the wecutil qc command on the collector computer from an elevated prompt.

Finally, add the collector computer’s account to the local Administrators group on each of the source computers. This is sufficient configuration on domain-joined computers that are all part of the same (or a trusted) domain. Additional configuration is required for workgroup computers:

Only pull subscriptions are supported.

A Windows Firewall exception is required.

A local administrative account must be added to the Event Log Readers group on each source computer.

Each source computer must be a trusted host for WinRM on the collector computer:

WinRM set winrm/config/client @{TrustedHosts="<source1>,<source2>,..."}

Creating a new event subscription

After you configure the source and collector computers to support event subscriptions, you can create a new subscription in Event Viewer by following these steps:

1. Select Subscriptions in the left pane and click Create Subscription in the Actions pane.

2. Configure the subscription properties, including name, destination log, and source computers.

3. Select the events to collect, as shown in Figure 1-16. Click OK.

FIGURE 1-16 The Query Filter dialog box of Event Viewer

4. To optimize event delivery, click the Advanced button. You can configure event delivery optimization to the following:

Normal Uses pull delivery mode and batches 5 items at a time with a timeout of 15 minutes

Minimize Bandwidth Uses push delivery with a batch timeout of six hours and a heartbeat interval of six hours

Minimize Latency Uses push delivery mode with a batch timeout of 30 seconds

Configuring network monitoring

Windows Server 2012 R2 provides a new module of Windows PowerShell cmdlets to enable network packet capturing. The NetEventPacketCapture module includes the cmdlets shown in Table 1-3.

TABLE 1-3 NetEventPacketCapture cmdlets