Keep Tabs on Your Network Traffic - Page 2
It Pays to Keep a Steady Count
Each of the counters has an accompanying description that you can read to determine if the counter you are adding is going to yield the information you are looking for. It is worth spending a few moments reading the descriptions, which are generally informative. By understanding the range of available counters related to network traffic monitoring, you can fine-tune your network traffic monitoring, focusing on specific areas. That said, there are three counters that you may want to monitor on an ongoing basis. All three of the following counters are related to the Network Performance Object, and provide a good overview of the network related health of your server. These counters are the following:
Network Interface: Bytes Total/sec - This counter provides the number of bytes sent and received per second by the network interface adapter. A significant drop in performance could indicate a faulty network adapter. If you have more than one network adapter in your server, you can choose to monitor any or all of the adapters at one time.
Network Interface: Output Queue Length - This counter provides the number of packets waiting to be transmitted by the network interface. Ideally, this value should be zero, indicating that data is not having to wait before being sent to the network. However, on a busy server, values of two or less are acceptable. If the number is abnormally high on a consistent basis, you should look for a problem with a network card or some other piece of network hardware. Another possible cause of high output queue length is a corrupt or incorrect network card driver, though such a problem normally manifests itself in other ways than just an increased output queue length statistic.
Server: Bytes Total/Sec - This often-misunderstood counter provides the total number of bytes sent and received by the server over all of its network interfaces. In a typical environment, the value of this counter should be no more than 50 percent of the total bandwidth capacity of all the network interfaces combined. A value higher than 50 percent could indicate that network interfaces of the server simply can't keep up with demand. You only have two options in this case. Install faster network interfaces, or move some applications or functions off that server.
Regardless of what or how many counters you choose to add to the graph of System Monitor, the information is updated every second. This makes for a 1-minute-and-40-second snapshot of the system performance on the screen at any one time. Increasing the update interval, or sample rate to give it its proper name, to every 5 seconds, will yield a display lasting 8 minutes and 20 seconds. This might seem better, but setting the sample rate at too much of an interval can cause you to miss spikes in utilization, as they may occur between sample points.
We'll talk more about the appropriate setting for the sample rate in Part 2 of this article, and also look at how you can use the Performance Logs and Alerts feature of the Performance Console to record information for future reference. In addition, we'll discuss some useful third-party network traffic monitoring tools.