How to control Processor usage

This document explains the setting of SNMP thresholds on processor usage on Windows 2000 / XP operating system. It also explains how to configure and display line graph of this usage. We will define eventsfor this thresholds

Warning: The SNMP objects used in this how to come from our Windows perfmib.mib file. Our examples will not work with any other mib available on the Internet. The configuration and installation of this MIB is explained in the How to add SNMP performance monitoring to WIndows 2000 / XP

You should download the set of file including the perfmib.mib file with the link on the page. We do have a working perfmib.mib before continuing.

Processor performance object description

The setting for this counters in LoriotPro use the following Mib entries:

In the ms-proc-processentry

In the ms-system

The thresholds and indicators recommended to supervise are provided below:

Processor\% Processor Time

ms-percentprocessortime

85%

Find the process that is using a high percentage of processor time. Upgrade to a faster processor or install an additional processor.

Processor\Interrupts/sec

ms-procsr-interruptspersec

Depends on processor; 1000 interrupts per second is a good starting point

A dramatic increase in this counter value without a corresponding increase in system activity indicates a hardware problem. Identify the network adapter causing the interrupts. You might need to install an additional adapter or controller card.

System Call/sec

ms-sys-ms-systemcallspersec

Could be used to compare with number of interrupt

Should be higher than the number of Interrupts/sec else one hardware device is generating too much interrupts

System\Processor Queue Length

ms-sys-processorqueuelength

2

This is an instantaneous counter; observe its value over several intervals.

The configuration in the Bulk Threshold Plug-in is done below.

If the threshold is reached the event is generated in the Event Manager

Graphing the processor statistics

The first graph collect the % of utilization from the ms-proc-PercentProcessorTime

% Processor Time is the percentage of elapsed time that all of the threads of this process used the processor to execute instructions. An instruction is the basic unit of execution in a computer, a thread is the object that executes instructions, and a process is the object created when a program is run. Code executed to handle some hardware interrupts and trap conditions are included in this count. On Multi-processor machines the maximum value of the counter is 100 % times the number of processors.

Next counters than we can graph on the same graphic are :

ms-proc-PercentUserTime

ms-proc-PercentPrivilegedTime

% User Time is the percentage of non-idle processor time spent in user mode. (User mode is a restricted processing mode designed for applications, environment subsystems, and integral subsystems. This counter displays the average busy time as a percentage of the sample time.

% Privileged Time is the percentage of non-idle processor time spent in privileged mode. (Privileged mode is a processing mode designed for operating system components and hardware-manipulating drivers. It allows direct access to hardware and all memory. The operating system switches application threads to privileged mode to access operating system services). % Privileged Time includes time servicing interrupts and deferred procedure calls - DPCs. This counter displays the average busy time as a percentage of the sample time.

A high rate of privileged time might be attributable to a large number of interrupts generated by a failing device.

Comparing the number of system calls and interrupts

We use the the Line Graph plug-in and enter both OID to graph.

ms-procsr-interruptspersec : Interrupts/sec is the average number of hardware interrupts the processor is receiving and servicing in each second. It does not include DPCs, which are counted separately. This value is an indirect indicator of the activity of devices that generate interrupts, such as the ms-system clock, the mouse, disk drivers, data communication lines, network interface cards and other peripheral devices. These devices normally interrupt the processor when they have completed a task or require attention. Normal thread execution is suspended during interrupts. Most ms-system clocks interrupt the processor every 10 milliseconds, creating a background of interrupt activity. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.

ms-sys-ms-systemcallspersec : ms-systems Calls/sec is the combined rate of calls to Windows NT ms-system service routines by all processes running on the computer. These routines perform all of the basic scheduling and synchronization of activities on the computer, and provide access to non-graphic devices, memory management, and name space management. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.

ms-sys-ms-systemcallspersec should be higher than ms-procsr-interruptspersec

else one hardware device is generating too much interrupts

We set both counters on the same graph, it will be easier to compare them.


The green is ms-sys-ms-systemcallspersec and the red is ms-procsr-interruptspersec.

If the red line goes over the green line it is time to check what device interface generates so much interrupts.

Supervising the Processor Queue

The Processor Queue Length is the number of threads in the processor queue. There is a single queue for processor time even on computers with multiple processors. Unlike the disk counters, this counter counts ready threads only, not threads that are running. A sustained processor queue of greater than two threads generally indicates processor congestion. This counter displays the last observed value only; it is not an average.

Example of graph on the ms-sys-processorqueuelength

End of Document