windowswideopen.com

1. Ensure Performance Logs and Alerts service has sufficient rights to log data on remote machines. Go to the “services” section of the Computer Management MMC and make sure the Performance Logs and Alerts service is using an account that has administrative rights on the machine we want to monitor. By default, the local system account is selected; this will not work in this situation, and must be changed.

2. Start System Monitor on a remote Windows machine (server or workstation) by selecting run and typing “perfmon” in the dialogue box and clicking “OK.” We want to run System Monitor on a remote machine (not the machine experiencing the problem)

3. On the left hand side of the window that appears, open “Performance Logs and Alerts” and highlight “Counter Logs.”

4. Right-click Counter Logs, click New Log Settings, type a name for the log, and then click OK.

5. A new dialogue will appear with 3 tabs. On the General tab, click “Add.” A new window will appear.

6. Select the following in the “Select Counters” window:

“Select counters from computer”

7. In the box under this, type in the name of the machine experiencing the problem. (\\servername)

8. Next, we need to select our Counters and Instances. Counters are listed on the left, and the instances are listed on the right. Select the radio buttons marked “Select counters from list” and “All Instances.” Now, select the following from the Counter column (you can hold down the Ctrl key to make multiple selections at once):

Cache

Memory

Objects

Paging file

Process

Processor

System

Logical disk

NBT Connections

Network interface

Physical disk

Redirector

Server

Server work queues

Thread (do NOT capture if a terminal server)

9. At the bottom of the General tab, we will need to set the update interval of the log. This is the frequency that sysmon writes data back to the log file. Let’s set this to 60 minutes/1 hour (I am assuming this issue takes about a week or longer to appear, if the problem manifests itself sooner, we can reduce this interval).

10. On the Log Files tab, select the file name and location you want to write the log to. Make sure the location you select has plenty of free space.

Also, make sure to select “Binary File” as the Log file type.

11. Click apply and OK.

12. Do not close the system monitor application or logging will stop.

Operating SystemOperating System

Filed under: Operating System