5 Replies Latest reply on Jun 8, 2013 7:49 PM by mhamel

    PerfMon Monitoring

    mikeloria

      My first thought of setting up Perfmon was to run the interface on 2 separate servers for fail over so there would only be one instance running at a time. These would be servers outside of the PI servers and interfaces. Now I am continuously being faced with security issues. I have no problems with Windows 2003 32 bit but Windows 2008 R2 I am having trouble with accessing the Perfmon remotely. I also have the issue of some of the machines that I wish to access are not on the domain. Event the Tech support guy punted on me which I might be appealing.

       

      What are your thoughts of running perfmon directly on each machine that I wish to monitor? Has anyone had these issues that I am having? Is anyone actually running several instances of perfmon (1 on each machine)?

       

      Thank you for your input on this matter.

        • Re: PerfMon Monitoring
          Marcos Vainer Loeff

          Hello Mike,

           

          Technically there is no problem running PI Performance Equation interface on each machine you wish to monitor. The advantage of this option is that it is easier to configure its security settings and data is sent directly to the PI Server, not having to pass through a third machine. This architecture is more efficient concerning network traffic.

           

          On the other hand, this is not the best option concerning maintenance. It is easier to install and to manage one interface node then 10. Besides that, depending which machines you want to monitor, you might not have permission to install new applications due to company policies for instance.

           

          All in all, it really depends on your priorities. But you should be able to use PI Performance Monitor interface to receive data from other machines with Windows Server 2008 R2. If the user account under which your interface is running domain user account, you should add this account to the local Windows group called “Performance Monitor Users” on every machine you wish to monitor. But if you have machines that are not on the domain, I would create another instance for those machines. For this instance, the user account under which your interface is running should be a local user account. On the machines outside of the domain, I would create the same local account which is running on the interface node (same name and password). You should follow the same procedure about adding this account to the local Windows group “Performance Monitor Users”.

           

          If you still have problems, my suggestion is to continue troubleshoot your security issue with our TechSupport.

            • Re: PerfMon Monitoring
              mikeloria

              Thank you for the advice. I believe I will install on each machine I wish to monitor

               

              For Ping

               

              I am looking for recommendation for scan times. I noticed in the Ping documentation that it was recommended to not scan less than 1 minute. Is that valid for Ping? I did not think it was such an expensive operation?

               

              For Perfmon

               

              What about for perfmon? I would like to do 10 second scans  so that a health screen has some life to it. I am thinking 5 to 20 counters for each node which is about 100 nodes out of about 2000 machines on the entire network. We have gig in some places and only 100 megs in others. If I am running the interface directly off of the machine, I felt I was safe to scan at higher rates, especially since we are talking about a few points (10)

               

              Thank you,

                • Re: PerfMon Monitoring
                  Bannikov

                  Mike Loria

                  I noticed in the Ping documentation that it was recommended to not scan less than 1 minute. Is that valid for Ping? I did not think it was such an expensive operation?

                   

                  In all out projects we use scan class both for Ping and PerMon equal to 1 minute. To much life on health screen can cause to much disk space to store diagnostics data...

                    • Re: PerfMon Monitoring

                      Hello Mike,

                       

                      It takes some time until ping requests time out. I believe it's about 2 seconds. Let's assume you have quite some devices to ping the timeouts easily add up to a recognizable period and may cause scans cannot be completed in time. To my understanding this is the reason why it's not recommended using scan frequencies smaller than 60 seconds.

                       

                      With perfmon tags it's similar to other interfaces. Please select reasonable scan times and apply appropriate exception and compression setting. Let's assume you like to monitor % CPU usage on some hardware with 2 CPU's, 4 cores each and 2 threads per core. For sure you are interested to not just monitor the Total % CPU Usage but each logical core (16). Sampling at 1 second allows you to render cool trends but will also consume some space in archives over the time. Of what use will all that data be after 2 years? I believe a sample rate between 5 and 10 seconds would be more reasonable. You may decide later for 30 to 60 seconds depending on your use case. As the next thing you would like to see how memory usage develops over time and may also be interested collecting the private bytes usage of some critical processes. A sample rate between 1 and 5 minutes appears reasonable to me for this purpose. You still can assign single tags to a more frequent scan class in case you need to get a more detailed picture i.e. of a process that suddenly leaks memory. As the last example, you are interested to collect the free disk space of the partition that holds your PI Archives or of a file server. Something between 1 hour and 1 day appears reasonable to me for this purpose. 

                        • Re: PerfMon Monitoring
                          mhamel

                          @Mike: Going under 1 minute for ping (ICMP echo) could be considered a flood attack and you would not have an easy way to distinguish between a normal scan and an attack for DOS. A scan rate between 2 and 5 minutes should be fine to detect a network split.

                           

                          Regarding PerfMon, this can take a high load but generally it's not necessary for all counters. I would insure to create groups for different kind of categories such as: Disk IOs, memory consumption, CPU load, process private bytes, etc. The main benefit to have a local PI-PerfMon interface on local node allows to only sending on the wire the exception events.

                           

                          Let me know if that helped.