Windows NT 2000 Preview for Performance Analysts

1
Windows NT 2000 Preview for Performance Analysts

• Demand Technology
• 1020 Eighth Avenue South, Suite 6, Naples, FL
  34102
• phone [phone] fax [phone]
• e-mailmarkf_at_demandtech.com
• http//www.demandtech.com

2
Windows NT today

• Full-featured, secure operating system
• portable
• preemptive multitasking multiprocessing
• built-in networking
• Growing acceptance as an enterprise-wide
  networking standard
• Mail (Exchange) server
• Web server
• Database/Application server

3
Windows 2000 preview

• Formerly Windows NT version 5
• No more planned enhancements to Windows 9x.
• based on Beta 2 install
• shipped in August
• code frozen three months before that
• MS Professional developers conference (PDC)
  preview in October 1998

4
Windows NT today

• Unresolved issues crucial to adoption as an
  enterprise-wide standard
• Current security model based on Domains does not
  scale (addressed by NT 5.0)
• Reliability, Availability and Serviceability
• maintenance prerequisites and corequisites
• e.g., shared DLLs
• inadequate crash dump support
• e.g., primary page size dependence
• Microsofts market dominance

5
Windows NT today

• Unresolved performance management issues crucial
  to adoption as an enterprise-wide standard
• Ample measures of resource utilization, but
  almost no measures of service levels or response
  time.
• Scalability of built-in performance management
  tools
• Developer-oriented, not systems
  management-oriented

6
Windows NT in the future

• Enterprise scalability NT 4.0 deliverables
• Fault tolerant Clustering (Wolfpack, Convoy)
• Multi-user systems (WinFrame, Terminal Server)
• Object-oriented Transaction Monitor
• Messaging services
• Network Directory (LDAP) services (NT 5.0 core)
• Accentuates the need for enterprise management
  tools
• e.g., Microsoft Management Console

7
Cluster Server (Wolfpack)
8
Networked storage

• CIFS - Common Internet File System
• Built into every Microsoft operating system
  desktop
• Allows files to be shared across Microsoft
  networks today, within the limitations of Disk
  A-Z addressing
• NT version 5.0 will extend CIFS to build dfs, a
  distributed file system
• Prediction CIFS will be running enterprise-wide
  within five years
• Third party ISVs will support CIFS on Unix and MVS

9
NT 5.0 distributed file system
10
Windows 2000 changes

• Major new features
• Plug and Play
• Power Management
• new Driver model
• DVD, UFS support
• DNS replaces WINS
• I20
• gigabit ethernet
• disk defragmenter

• Active Directory
• COM (MTS v3 COM)
• distributed file system
• Search Index Server
• kerberos file encryption
• disk quota management
• tape library support
• Windows installer

11
Windows 2000 changes

• No major performance enhancements!
• Memory management constants should be revised
  upwards for better scalability
• gt 63 MB, NT Servers are all considered Large
  today
• LargeSystemCache produces less drastic behavior
• Disk performance monitoring holes closed
• diskperf.sys can be installed both above and
  below Ftdisk
• diskperf.sys can be enabled without rebooting
• new Disk Idle Time counter
• System Total Processor Time counters moved

12
Windows 2000 changes

• NTFS exploitation
• Compression
• new encryption service (portable computers!)
• Index Server relies on NTFS Change Journal log
• sparse files
• requires new version of ntfs.sys for (limited)
  backward compatibility
• Master File Directory entries changed from 4K to
  1K
• Beta2 installation experience

13
Windows 2000 changes

• NTFS is strategic!
• Which way will the OEMs go?

14
Microsoft Management Console
15
Microsoft Management Console

• Common look and feel to Microsoft tools
• User Manager
• Event Viewer
• Service Control Manager
• etc.
• MMC apps are COM programs (.OCX)
• e.g., sysmon.ocx
• application snap-ins

16
System Monitor
17
System Monitor

• Separate collection service from GUI
• New features
• ActiveX component
• can be embedded in another application
• can be scripted
• Printing
• Fonts

18
System Monitor

• Promised, but not yet available
• Alert service
• per Process Read and Write I/O Counts

19
System Monitor architecture
Windows NT Performance Monitor
System Monitor graph control
Custom Performance Tool
Sysmon log and alert service
PDH.DLL
WMI
RegQueryValueEx()
Perflib
Performance Extension DLL
System Performance DLL
Performance Extension DLL
System Performance DLL
Sysmon Log Service Files
Hi-Perf Data Provider Object
System Performance DLL
Performance Extension DLL
20
Microsoft Management Console

• New performance Objects
• Server Print Queue
• Jobs Queued/Printed
• Pages
• Jobs
• Job Object
• Job Object Details

21
Jobs

• Job Objects are used to set resource limits on
  one or more Processes
• Processor time, Dispatching priority, working
  set, etc.

22
Jobs

• Win32 API calls provided to
• establish a Job
• associate a process with a Job
• e.g.,
• IIS spawns CGI scripts they can placed in a Job
  context that prevents them from usurping too many
  execution resources
• Jobs are not equivalent to workloads or
  performance groups

23
Availability enhancements

• Improved system diagnostics
• Plug Play
• Automated service recovery
• new Scheduler app

24
Plug and Play

• Plug and Play clears the way for widespread
  adoption of Windows NT in both business and home
  computing
• Power Management clears the way for adoption in
  portables
• Question can one OS scale from handheld PCs to
  server clusters???

25
Plug and Play
26
Plug and Play
27
(No Transcript)
28
Disk Administrator

• Fault tolerant disk driver (ftdisk.sys) was
  rewritten by Veritas
• Building block for adding the Veritas Volume
  Manager software
• to become available as an add-on
• backward compatibility???
• Old DISK key in Registry

29
Disk Administrator
30
Disk defragmenter

• Diskeeper Lite support built in
• diskperf provides new split I/O counts

31
Windows Management Instrumentation

• Microsofts implementation of WBEM (Web-based
  Enterprise Management)
• What is WBEM?
• An ambitious attempt to unify SNMP, DMI, and
  various Win32 services (Perfmon API, Registry,
  Event log)
• Adopted by the DMTF (Intel, Cisco, BMC, etc.)
• Describe objects in CIM (Common Information
  Model) to create MOFs

32
Windows Management Instrumentation

• Most interesting hardware components and system
  settings have been defined as CIM objects in
  Windows 2K
• Disks, Netcard, Video, Mouse, Memory,
• Performance, Events
• SNMP objects and traps (MIB ? MOF compiler
• CIMOM runtime services in Win2K
• WBEM Query language (similar to SQL)

33
WMI architecture
Management application
Management application
COM interfaces
CIM repository
CIMOM (WinMgmt)
Provider (DLL)
Provider (EXE)
Provider (DLL)
Provider (EXE)
Provider (EXE)
Provider (DLL)
34
Performance Monitoring architecture
Windows NT Performance Monitor
System Monitor graph control
Custom Performance Tool
Sysmon log and alert service
PDH.DLL
WMI
RegQueryValueEx()
Perflib
Performance Extension DLL
System Performance DLL
Performance Extension DLL
System Performance DLL
Sysmon Log Service Files
Hi-Perf Data Provider Object
System Performance DLL
Performance Extension DLL
35
Windows Management Instrumentation

• WBEM futures
• e.g., SMS Health Monitor
• Development environment MIB ? MOF compiler
• MS WBEM URLs
• http//www.microsoft.com/management/
• http//www.microsoft.com/msdn/sdk/wbem

36
Windows kernel trace facility

• Initially described at CMG 97 late breaking
  session
• Secure kernel trace facility
• Architected for high volume
• NT Scheduler trace abandoned due to overhead
• Designed for application extensions

37
Operating System Traces
Process Start/End
Trace Header
Process Id
Parent Process Id
Security Id
Image Name
4 bytes
4 bytes
Variable length
Variable length
Disk I/O
Trace Header
Disk Signature
Transfer Size
IRP Flags
Response
Byte Offset
Page Faults
4 bytes
4 bytes
4 bytes
4 bytes
8 bytes
VirtualAddress
Trace Header
TCP/IP
4 bytes
Trace Header
Source Ip Address
Dest Ip Address
SourcePort
DestPort
Size
Process Id
4 bytes
4 bytes
4 bytes
4 bytes
2 bytes
2 bytes
38
Windows kernel event trace

• Event trace header

39
Windows kernel trace facility

• Evaluation
• Process End event does provide process end
  performance statistics (CPU, I/O, etc.)
• New per Process Disk I/O Counters satisfy most
  capacity planning requirements
• The I/O trace namespace for capturing I/O
  requests by file is formidable
• captures per process hard page faults
• TCP trace data vs. Network Monitor data

40
WBEM
41
Overhead vs. version 4.0

• OS functionally very similar
• e.g., no Thread Scheduler changes
• Several new services added
• In order to retain the same memory footprint, it
  will be necessary to turn off any extraneous
  services

42
Futures beyond Win2K

• Port to 64-bit hardware
• Windows NT is already running out of virtual
  memory in large scale server apps
• NT 5.0 has rudimentary support for real memory
  above the 32-bit line
• Port to 64-bits is well underway
• Compaq (Digital) Alpha
• Intel/HP P7 Merced joint development effort

43
Questions or comments?