Monitoring and Tuning ISA Server Performance

Tuning ISA Server Performance

You can optimize ISA Server performance and tune the ISA Server cache. The ISA Server performance settings that you can tune to optimize the performance of the ISA Server computer exist on the Performance tab of the Array Properties dialog box.

ISA Server caches objects to RAM and on disk. The default ISA Server configuration caches objects that are below 12,800 bytes in size in RAM. An object that is stored in RAM is retrieved faster by ISA Server than an object which is stored on disk. The default configuration caches objects which are larger than 12,800 bytes in size on disk.

You can use the settings on the Cache Configuration Properties dialog box (Advanced tab) to change the size of objects which are stored in memory. ISA Server cache performance is tuned by manipulating the percentage of available RAM for cache space. A high percentage of available RAM for cache space leads to an improvement in cache response time. More content can be stored in faster physical memory than on disk. Before setting a high percentage of available RAM for cache space, you have to bear in mind that less memory would be available for other activities of the operating system and for other applications' activities as well. Monitoring and Tuning ISA Server Performance

How to optimize ISA Server performance

Open ISA Management.
Right-click the ISA Server array and select Properties from the shortcut menu.
Click the Performance tab.
Move the slider to More Than 1000 when more than 1, 000 users are anticipated daily.
Move the slider to Fewer Than 1000 when less than 1, 000 users are anticipated daily.
Move the slider to Fewer Than 100 when less than 100 users are anticipated daily.
Click OK.

How to optimize ISA Server cache performance

Open the ISA Management console.
Navigate to the Cache Configuration node in the console tree.
Right-click the Cache Configuration node and then select Properties from the shortcut menu.
The Cache Configuration Properties dialog box opens.
Click the Advanced tab.
Enter the percentage of free memory to use for caching in the Percentage Of Free Memory To Use For Caching textbox.
Click OK.

Monitoring System and Network Performance using Standard objects and Counters

A few elements that should be included in a server monitoring plan are:

Identify those server events which should be monitored.
Determine and set up monitors and alerts to inspect the events.
Determine whether filters are necessary to reduce the quantity of monitoring information which you want to collect and then configure any necessary filters.
Establish a logging strategy to log event data that should be analyzed. Alternatively, you can monitor and analyze server activity when it occurs.
View and analyze data collected by events in the Performance console.

Another key component to monitoring server performance is to identify bottlenecks. A bottleneck can be described as a condition which is created by a particular resource which in turn prevents other resources from operating optimally.

Bottlenecks usually occur when:

Certain settings are not configured correctly.
A resource is faulty and not functioning as it should be.
Insufficient resources exist, and a resource is being overused.
Where many instances of the same particular resource exist, the resources may not be handling load equally or efficiently.
A particular application(s) is hogging a resource.

Server and system performance is usually impacted by the following:

Resources are configured incorrectly which are causing resources to be intensely utilized.
Resources are unable to handle the load it is configured to handle. In this case, itis usually necessary to upgrade the particular resource or add any additional components that would improve the capability of the resource.
Resources that are malfunctioning impair performance.
The workload is not configured to be evenly handled by multiple instances of the identical resource.
Resources are ineffectually allocated to an application(s).

You can use System Monitor to collect and analyze performance data for both the local computer and remote computer, and to track various processes running on a Windows Server 2003 or Windows 2000 system. The System Monitor utility is located within the Performance MMC snap-in.

A few key activities that can be performed using System Monitor and the main features of System Monitor are listed below:

View and monitor real-time performance data or view data from a log file.
Choose which data you want to collect by selecting between various objects and counters.
Collect data from multiple computers simultaneously.
Choose the format or view in which you want to examine collected data:
- Graph view
- Report view
- Histogram view
Monitor processes and components that you want to optimize
Monitor the results of your optimization efforts
View trends in workloads and the effect being realized on resource usage.
Plan for upgrades

The subsystems which should be monitored when monitoring and optimizing system performance are listed below. These subsystems should be monitored and optimized to tune server performance:

Memory subsystem: When it comes to determining the memory that is being used, you need to examine physical memory, and the page file. Physical memory pertains to physical RAM. The page file pertains to logical memory on the hard drive.

The most important performance counters which you should monitor to detect memory specific issues are:

- MemoryAvailable Bytes: The counter indicates what your available memory capacity is. To efficiently run a server, you need to have at least 4MB of memory available. When the memory drops below 4MB, you might need to consider immediately adding more memory.
- MemoryPages/Sec: With a recommended counter threshold of 20, this counter indicates the rate at which pages are written to disk, or read from disk. The counter should generally be beneath 20
Network subsystem: You can assess the performance of a computer on the network by monitoring the network interface and the network protocols installed on the computer. You can improve network performance by unbinding network adapters that are not frequently used, and then upgrading these to high performance network adapters. Alternatively, you can install multiple network adapters.

The important counters which should be tracked to monitor the performance of the network for possible bottlenecks are:

- Network InterfaceBytes Total/sec; Bytes Sent/sec; Bytes Received/sec: These counters indicate the manner in which your network adapters are performing in relation to network traffic.
- ServerBytes Total/sec; Bytes Received/sec; Bytes Sent/sec: These set of counters indicates the manner in which the server is utilizing the network to send data and receive data.
- ServerPool Paged Peak: This counter shows the amount of physical memory and the maximum paging file size. A threshold of the amount of physical RAM is fine.
Processor subsystem: You should monitor the processors to ensure that processor utilization maintains an acceptable level. The factors that need to be kept in mind when monitoring processor activity are the role of the server and the type of work being performed on the server. Consider using less processor intensive applicatios, or upgrading the processor when a processor bottleneck exists. You can add a processor if the computer supports multiple processors.

A few performance counters that should be tracked to monitor the processor subsystem of the server for bottlenecks are:

- Processor% Interrupt Time: The counter indicates how often devices such as network adapters and disk drives generate interrupts by showing the time duration for which the processor receives and services hardware interrupts in the sample interval.
- Processor Interrupts/Sec: This counter shows the number of interrupts which are being received from devices. An increase in the counter's value should be accompanied by an increase in system activity. If not, you could have an existing hardware issue that needs to be resolved.
- System Processor Queue Length: This counter shows the number of requests waiting in queue to be processed. If you constantly have a queue length of over 10 for a processor, you may have an existing bottleneck.
Disk subsystem: You can use the PhysicalDisk object or the LogicalDisk object to monitor disk access. The PhysicalDisk object relates to the logical drives on a physical drive, while the LogicalDisk object relates to a particular logical disk. The speed of the disk controller and the average disk access time has on impact on the speed at which system requests are handled. Disk access can be described as the time it takes to service requests.

A few important counters which you should monitor to track disk performance of a server are:

- Physical Disk Current Disk Queue Length: The counter indicates the number of requests which are in queue for disk access. The counter should be consistently at 1.5 to 2 times the number of spindles which comprise of the physical disk.
- Physical Disk % Disk Time and % Idle Time: These counters indicate the percentage of time that a drive is active, and the percentage of time for which the drive is idle. The recommended threshold for both counters is 90 percent.
- Physical Disk Disk Reads/Sec and Disk Writes/Sec: These counters show the speed at which data is written to disk, and read from disk. The information of these counters could assist you in more efficiently balancing the load of your servers. A lengthy delay could be indicative of a hard disk issue. When usage is close to the defined transfer rate of the physical disk, you might need to consider decreasing the load of the server. You could also upgrade to RAID.
- Physical Disk Bytes/sec: The Physical Disk Bytes/sec counter indicates throughput of disk activity.
- Physical Disk Avg. Disk Bytes/Transfer: This counter tracks the average number of bytes which are either moved to or from a disk when disk reads and writes occur. A program is typically accessing the drive ineffectually when the counter's value is over 2KB.

Understanding ISA Server Performance Objects and Counters

ISA Server provides the ISA Server Performance Monitor tool to analyze ISA Server performance. The ISA Server Performance Monitor is installed when you install ISA Server.

When you access the ISA Server Performance Monitor, the following tools are displayed:

System Monitor node
Performance Logs and Alerts node

System Monitor can be displayed in a graph, histogram, or report format. System Monitor uses objects, counters and instances to monitor the system. An object can be described as a collection of counters that is associated with a system resource or service which produce the data you can assess. When an object executes a function, its associated counters are updated. A counter can be regarded as a data reporting component in an object. The counter represents data for a particular component of the system or service. Each object therefore has a set of counters that track particular information on the performance object.

The ISA Server Performance Monitor is preconfigured with the ISA Server objects and counters listed below:

ISA Server Cache object contains 6 counters.
ISA Server Firewall Service object contains 8 counters.
ISA Server Packet Filter object contains 1 counter.
Web Proxy Service performance object contains 6 counters.

The ISA Server Bandwidth Control performance object contains the counters listed below. None of these counters are preloaded in System Monitor:

Actual Inbound Bandwidth; tracks and indicates actual inbound bandwidth.
Actual Outbound Bandwidth; tracks and indicates actual outbound bandwidth.
Assigned Connections; monitors the number of connections that have an assigned bandwidth priority.
Assigned Inbound Bandwidth; monitors assigned inbound bandwidth.
Assigned Outbound Bandwidth; monitors assigned outbound bandwidth.

The ISA Server Cache performance object contains the counters listed below. Some are preloaded in System Monitor and others are not.

Active Refresh Bytes Rate (KB/ Sec); for active caching, the object tracks the rate at which bytes of data are retrieved from the Internet to refresh URLs in the cache.
Active URL Refresh Rate (URL/ Sec); for active caching, the object tracks the rate at which cached URLs are retrieved from the Internet to refresh cache content.
Disk Bytes Retrieved Rate (KB/ sec); tracks the rate at which bytes of data are retrieved from the disk cache.
Disk Cache Allocated Space (KB); tracks the space used by the disk cache.
Disk Content Write Rate (Writes/ Sec); tracks the number of writes, to the disk cache to store URL content.
Disk Failure Rate (Fail/Sec); tracks the number of input/output (I/O) failures per second.
Disk URL Retrieve Rate (URL/ Sec); tracks the number of URLs per second, sent to clients from the disk cache.
Max URLs Cached; tracks the maximum number of URLs stored in the cache.
Memory Bytes Retrieved Rate(KB/Sec); tracks the rate at which bytes of data are retrieved from the memory cache.
Memory Cache Allocated Space(KB); tracks the space used by the memory cache.
Memory URL Retrieve Rate (URL/ Sec); tracks the number of URLs per second, sent to clients from the memory cache.
Memory Usage Ratio Percent (%); indicates the ratio between the amount of cache fetches from the memory cache as a percentage of total cache fetches.
Total Actively Refreshed URLs; indicates active caching performance by showing the collective number of URLs in the cache that have been actively refreshed from the Internet.
Total Bytes Actively Refreshed (KB); indicates active caching performance by showing the collective number of bytes in the cache that have been actively refreshed from the Internet.
Total Disk Bytes Retrieved (KB); indicates the collective number of disk bytes that have been retrieved from the disk cache.
Total Disk Failures; indicates the number of times that the Web Proxy service failed to read/write to the disk cache because to an input/output (I/O) failure.
Total Disk URLs Retrieved; tracks the collective number of URLs that have been retrieved from the disk cache.
Total Memory Bytes Retrieved (KB); tracks the collective number of memory bytes that have been retrieved from the memory cache.
Total Memory URLs Retrieved; tracks the collective number of URLs that have been retrieved from the memory cache.
Total URLs Cached; tracks the collective number of URLs that have been cached.
URL Commit Rate (URL/Sec); shows the speed at which URLs are cached.
URLs in Cache; tracks the current number of URLs in the cache.

The ISA Server Firewall service performance object contains th counters listed below. Some are preloaded in System Monitor and others are not.

Accepting TCP Connections; tracks the number of connection objects waiting for TCP connections from Firewall clients.
Active Sessions; tracks the number of active sessions for the Firewall service.
Active TCP Connections; tracks the number of active TCP connections sending data.
Active UDP Connections; tracks the number of active UDP connections sending data.
Available Worker Threads; tracks the number of Firewall worker threads.
Back-connecting TCP Connections; tracks the number of TCP connections waiting for an inbound connect call to complete.
Bytes Read/sec; tracks the number of bytes per second, read by the data-pump.
Bytes Written/sec; tracks the number of bytes per second, written by the data-pump.
Connecting TCP Connections; tracks the number of pending TCP connections.
DNS Cache Entries; tracks the current number of DNS domain name entries cached due to the Firewall service.
DNS Cache Flushes; tracks how many times the DNS domain name cache was flushed by the Firewall service.
DNS Cache Hits; tracks the number of times a DNS domain name was located by the Firewall service in the DNS cache.
DNS Cache Hits %; tracks the DNS domain names serviced by the DNS cache as a percentage of the total DNS entries retrieved by the Firewall service.
DNS Retrievals; indicates the total number of DNS domain names which were retrieved by the Firewall service.
Failed DNS Resolutions; shows the number of failures for gethostbyname and gethostbyaddr application programming interface (API) calls.
Kernel Mode Data Pumps; tracks the number of Kernel mode data pumps created by the Firewall service.
Listening TCP Connections; tracks the number of connection objects which are waiting for TCP connections from remote Internet computers.
Non-connected UDP mappings; tracks and shows the number of mappings available for UDP connections.
Pending DNS Resolutions; indicates the number of pending gethostbyname and gethostbyaddr API calls.
SecureNAT Mappings; shows the number of mappings created by SecureNAT.
Successful DNS Resolutions; indicates the number of successfully returned gethostbyname and gethostbyaddr API calls.
TCP Bytes Transferred/sec by Kernel Mode Data Pump; indicates the number of TCP bytes transferred by the Kernel mode data-pump.
UDP Bytes Transferred/sec by Kernel mode Data Pump; indicates the number of UDP bytes transferred by the Kernel mode data-pump.
Worker Threads; shows the number of active Firewall worker threads.

The ISA Server Packet Filter performance object contains the counters listed below. Some are preloaded in System Monitor and others are not.

Packets Dropped Due to Filter Denial; monitors the total number of packets dropped due to dynamic packet filtering rejecting the data.
Packets Dropped Due to Protocol Violations; monitors the total number of packets dropped due to protocol violation.
Total Dropped Packets; tracks the total number of dropped packets.
Total incoming connections; indicates the total number of connections made through filtered interfaces.
Total Lost Logging Packets; tracks and shows the number of dropped packets which could not be logged.

The ISA Server Web Proxy service performance object contains the counters listed below. Some are preloaded in System Monitor and others are not.

Array Bytes Received/Sec (Enterprise); monitors the rate that data bytes are received from the other ISA Server computers in the same ISA Server array.
Array Bytes Sent/Sec (Enterprise); monitors the rate that data bytes are sent to the other ISA Server computers in the same ISA Serverarray.
Array Bytes Total/Sec (Enterprise); shows the total rate for all data bytes passed between the ISA Server computer and the other members of the same ISA Server array.
Cache Hit Ratio %; shows the number of Web Proxy client requests served from the cached as a percentage of the total number of the Web Proxy client requests passed to the ISA Server computer. This counter measures Web Proxy client requests serviced from when the Web Proxy service was last started.
Cache Running Hit Ratio (%); shows the requests served from the cache as a percentage of total successful requests serviced. This counter measures the last 10,000 requests serviced.
Client Bytes Received/sec; indicates the rate that data bytes are being received from Web Proxy clients.
Client Bytes Sent/Sec; indicates the rate at which data bytes are being transmitted to Web Proxy clients.
Client Bytes Total/Sec; shows the total rate for all data bytes passed between the ISA Server computer and Web Proxy clients.
Current Array Fetches Average (Milliseconds/Request); indicates, in milliseconds, the time needed to service a Web Proxy client request that is fetched through a different array member server.
Current Average Milliseconds/Request; indicates, in milliseconds, the average time needed to service a Web Proxy client request.
Current Cache Fetches Average (Milliseconds/Request); shows in milliseconds, the time needed to service a Web Proxy client request.
Current Direct Fetches Average (Milliseconds/Request); shows in milliseconds, the time needed to service a Web Proxy client request to the Web server or upstream proxy.
Current Users; shows the clients currently using the Web Proxy service.
DNS Cache Entries; indicates the number of DNS domain name entries cached by the Web Proxy service.
DNS Cache Flushes; shows the number of times that the Web Proxy service cleared/flushed the DNS domain name cache.
DNS Cache Hits; shows the number of times that the DNS domain name was located in the DNS cache by the Web Proxy service.
DNS Cache Hits %; tracks the number of DNS domain names serviced by the DNS cache as a percentage of the total DNS entries retrieved by the Web Proxy service.
Failing Requests/Sec; tracks the rate at which Web Proxy client requests have some form of error.
FTP Requests; indicates the number of FTP requests which have been passed to the Web Proxy service.
Gopher Requests; indicates the number of Gopher requests which have been passed to the Web Proxy service.
HTTP Requests; indicates the number of HTTP requests which have been passed to the Web Proxy service.
HTTPS Sessions; indicates the number of HTTPS secured sessions serviced by a SSL tunnel.
Maximum Users; shows the maximum number of users that have simultaneously connected to the Web Proxy service.
Requests/Sec; shows the rate of incoming requests made to the Web Proxy service.
Reverse Bytes Received/sec; shows the rate at which data bytes are received by the Web Proxy service from Web publishing servers for incoming requests.
Reverse Bytes Sent/sec; shows the rate at which data bytes are sent by the Web Proxy service to Web publishing servers for incoming requests.
Reverse Bytes Total/sec; shows the total rate at which data bytes are being passed between the Web Proxy service and Web publishing servers for incoming requests.
Site Access Denied; indicates the number of Internet sites to which the Web Proxy service was denied access.
Site Access Granted; indicates the number of Internet sites to which the Web Proxy service was granted access.
SNEWS Sessions; shows the number of SNEWS sessions serviced by the SSL tunnel.
SSL Client Bytes Received/Sec; indicates the rate that SSL data bytes are being received from secured Web Proxy clients by the Web Proxy service.
SSL Client Bytes Sent/Sec indicates the rate that SSL data bytes are being sent to secured Web Proxy clients from the Web Proxy service.
SSL Client Bytes Total/Sec; indicates the total rate for all bytes passed between the Web Proxy service and secured Web Proxy clients.
Thread Pool Active Sessions; indicates the number of sessions being serviced by the thread pool threads.
Thread Pool Failures; indicates the number of requests being rejected due to the thread pool being full.
Thread Pool Size; indicates the current number of threads in the thread pool.
Total Array Fetches (Enterprise); indicates the total number of Web Proxy client requests which was served by requesting the data from a different ISA server in the ISA Server array.
Total Cache Fetches; shows the total number of Web Proxy client requests that have been served through cached data.
Total Failed Requests; shows the total number of requests which were not processed by the Web Proxy service because of errors.
Total Pending Connects; indicates the total number of pending connections to the Web Proxy service.
Total Reverse Fetches; indicates the total number of incoming requests to the Web Proxy service that was served by requesting data from Web publishing servers.
Total SSL Sessions; indicates the total number of SSL sessions serviced by the SSL tunnel.
Total Successful Requests; indicates the total number of requests which have successfully been processed by the Web Proxy service.
Total Upstream Fetches; indicates the total number of requests which was served through Internet data or from a chained proxy computer.
Total Users; shows the total number of users which connected to the Web Proxy service.
Unknown SSL Sessions; indicates the total number of unknown SSL sessions serviced by a SSL tunnel.
Upstream Bytes Received/Sec; indicates the rate that data bytes are being received by the Web Proxy service from servers residing the Internet or from a chained proxy computer to service requests.
Upstream Bytes Sent/Sec; indicates the rate that data bytes which are being transmitted from the Web Proxy service to servers residing the Internet or to a chained proxy computer to service requests.
Upstream Bytes Total/Sec; indicates the rate that data bytes are being passed between the Web Proxy service and servers residing the Internet or the chained proxy computer.

The H.323 Filter performance object contains the counters listed below. None are preloaded in System Monitor.

Active H.323 Calls; indicates the number of active H.323 calls.
Total H.323 Calls; indicates total the number of active H.323 calls processed by the H.323 filter from when the ISA Server computer last started.

The SOCKS Filter performance object contains the counters listed below. None are preloaded in System Monitor.

Active Connections; indicates the number of existing active connections passing data.
Active Sessions; indicates the number of active SOCKS sessions.
Bytes Read/sec; indicates in seconds, the number of bytes read on SOCKS connections.
Bytes Written/sec; indicates in seconds, the number of bytes written on SOCKS connections.
Connecting Connections; indicates the number of SOCKS connections waiting for a remote computer connection.
Listening Connections; indicates the number of SOCKS connection objects waiting for a remote computer connection.
Pending DNS Resolutions; indicates the pending DNS name resolution requests.
Successful DNS Resolutions; indicates the number of name resolution requests being resolved per second.

How to add performance counters

Open ISA Server Performance Monitor.
Right-click the System Monitor node and select Add Counters.
Select which object you want to monitor in the Performnce Object box.
If you want to monitor all counters for the object which you have selected, select the All Counters option.
If you want to only monitor specific counters, select the Select Counter option and then choose the counter.
If you want to monitor all instances of the object, select the All Instances option.
If you want to only monitor specific instances, select the Select Instances option and then choose the instance.
Click the Add button.
Click Close.

How to view log files data

Open ISA Server Performance Monitor.
Select the System Monitor node
Select the View Log File data button.
Select the log file you want to view and then click Open.

How to create a counter log to log ISA Server performance data

Open ISA Server Performance Monitor.
Expand the Performance Log and Alerts node.
Select the Counter Logs folder.
Right-click in the details pane and then select New Log Settings from the shortcut menu.
Enter a name for the log in the Name textbox.
Click OK.
On the General tab, click the Add button.
Choose the counter to add, click Add and then click Close.
Click the Log Files tab.
Specify the location for storing log data.
Click the Schedule tab.
Define the schedule for logging.
Click OK.
To start logging immediately, right-click the specific counter log and click Start from the shortcut menu.
To stop logging, right-click the counter log again and select Stop from the shortcut menu.