Nagios/Icinga Windows Server, Domain Controller, DNS and IIS Performance Monitoring

This article describes Windows Server 2008 R2 Nagios/Icinga Templates that monitor core server functions, Domain Controllers, DNS Servers and IIS 7.5.  While built specifically for those systems, it is likely  the Templates are compatible with other versions of Windows as well.

For those with Nagios/Icinga and Windows experience, the counters used are available from the Monitoring Exchange page.

Windows Server ships with a excellent monitoring and trend analysis tool: Performance Monitor.  As illustrated below, it allows administrators to select and graph counters that include list of system metrics.  These measurements may also be saved as delimited text files for future analysis and visualization.  A centralized server may connect to other servers to remotely collect data.  Since the API is well-documented, it is integrated into other value-added systems monitoring software.

The illustration below depicts the text format of a Windows Performance Monitor counter.  Commands conforming to this syntax may be sent from remote monitoring servers whose applications comply with the Windows API.

Prerequisites

A thorough knowledge of Nagios/Icinga installation and configuration is necessary.  The fundamental knowledge to Nagios/Icinga is presented in the following articles:
Nagios/Icinga Installation and Initial Configuration
Nagios/Icinga Database Integration
Nagios/Icinga Configuration Files
Nagios / Icinga Configuration with NConf - a Graphical Web / Database Tool
Nagios / Icinga Performance Data Graphing with PNP4Nagios


Information specific to Windows Server enterprise monitoring is presented in these two articles:

Nagios/Icinga Templates for Windows 2008 R2 OS, Domain Controllers, DNS and IIS Servers 
Automated Nagios/Icinga NSClient++ Deployment and Configuration for Windows Enterprises

Description of Monitored Windows 2008 R2 Services and Counters

Nagios/Icinga use Check Commands and Service Checks to monitor Windows.  They use an NRPE Windows Services check to determine if all automatically started and disabled services are in their proper state. They use NRPE Windows Performance Monitoring Ccounter checks to monitor Processor, Memory, Disk and Network counters (among others).  The services and counters listed below are common to Windows Server 2008 R2 regardless of applications installed.  They are indicative of overall performance (or problems) but do not necessarily pinpoint the root issue(s); more advanced -- and specific -- checks are required to diagnose application issues.

Three template files containing the required Check Commands, Service Checks and advanced Performance Monitoring Windows Server Service Checks are available for download from the Monitoring Exchange site.

These checks were gathered from a variety of Microsoft sources.

TCP Ports

135 MSRPC
139 NetBIOS-ssn
445 NetBIOS-ssn

Processor

Processor Information Total Percent UtilizationProcessor Information Total Idle Time
System Processor Queue Length
Server Work Queues Length

Memory

Memory Available MBytes
Memory Free System Page Table Entries
Memory Pages Input/sec
Memory Pages/sec
Memory Pool Nonpaged Bytes
Memory Pool Paged Bytes
Memory Cache Bytes
Memory Percent Registry Quota in Use
Memory Percent Committed Bytes in Use
Paging File Total Percent Usage

Disk

LogicalDisk Avg. Disk sec/Read
LogicalDisk Avg. Disk sec/Write
LogicalDisk Disk Transfers/sec
PhysicalDisk Total Disk sec/Read
PhysicalDisk Percent Idle Time
PhysicalDisk Total Disk sec/Write
LogicalDisk C Free Megabytes
LogicalDisk C Percent Free Space

Network

Network Interface Output Queue Length
Network Interface Bytes Total/sec
Network Interface Bytes Sent/sec
Network Interface Bytes Received/sec

Windows Domain Controller Monitoring and Trend Analysis

Three template files containing the required Check Commands, Service Checks and advanced Performance Monitoring Windows Domain Controller Service Checks are available for download from the Monitoring Exchange site.

Microsoft provides a summary of Windows Domain Controller Performance Counters.

Summary of Monitored Services and Counters

TCP Ports

389 LDAP
464 Kerberos Password
636 LDAPS
3268 Global Catalog
3269 Global Catalog

Windows Server Domain Controller (NTDS) Counters

NTDS DRA Inbound Full Sync Objects Remaining
NTDS DS Notify Queue Size
NTDS LDAP Bind Time
NTDS SAM Account Group Evaluation Latency

Summary of DNS Server Services and Counters

Three template files containing the required Check Commands, Service Checks and advanced Performance Monitoring Windows DNS Server Service Checks are available for download from the Monitoring Exchange site.

Microsoft provides a summary of Windows DNS Server Performance Counters.

TCP and UDP Ports

53 (TCP) DNS
53 (TCP) DNS

Windows DNS Server Counters

Caching Memory
Database Node Memory
Record Flow Memory
Recursive Query Errors
Secure Update Failure
TCP Message Memory
Total Query Received
Total Query Received/sec
UDP Message Memory 
Zone Transfer Failure
Zone Transfer Success

Summary of IIS Server Services and Counters

IIS has changed repeatedly over time and Microsoft-recommended performance counters are generally out-of-date.  The list was developed from a variety of sources and intended to reflect the basic IIS 7.5 Server functions.  Other counters (such as ASP.NET, etc.) are more appropriate to various application environments, such as the Windows Application Server Role, which adds the .NET environment.

Three template files containing the required Check Commands, Service Checks and advanced Performance Monitoring Windows IIS Server Service Checks are available for download from the Monitoring Exchange site.

TCP Ports

80 HTTP
443 HTTPS

Windows IIS Server Counters

Bytes Received/sec
Bytes Sent/sec
Bytes Total/sec
Current Connections
GET Requests/sec
POST Requests/sec
Current Files Cached
Current Metadata Cached
Current URIs Cached
File Cache Hits %
Metadata Cache Hits
URI Cache Hits %

Server 2008 R2, Domain Controller and DNS Server Performance Monitoring Templates

Performance Monitoring Counters are included for advanced troubleshooting, trending and capacity planning.  These counters unlikely useful for day-to-day monitoring and should be used only when needed in those scenarios.

Host Group Assignments

Advanced Services -- as defined above -- are assigned to Host Groups.  When a host is added to a Host group, all of the Advanced Services in that group are then applied to the host.  The OS - Windows Role definitions of Host Groups and Advanced Services defines the groups that must be defined.  These include:

1. windows-servers
2. windows-servers-perfmon
3. windows-domain-controllers
4. windows-domain-controllers-perfmon
5. windows-dns-servers
6. windows-dns-servers-perfmon
7. windows-iis-servers

 Applying the checks now requires no more than adding the host to the appropriate groups.

Example

The video below depicts a Processor stress test conducted on a Windows Server 2008 R2 Domain Controller/DNS Server.  The Warning and Critical values returned for Processor Counters are expected.  Under this high load, there are also Warning and Critical values returned for Domain Controller functions, indicating that there may be issues with authentication and services relying upon it.