By using Task Manager, you can track running applications and processes and determine resource usage. This can help you understand how a server is performing and whether there are any problems, such as applications that aren't running or processes that are hogging sys tem resources. Task Manager is available on both workstations and servers by pressing Ctrl+Alt+End.

To work with Task Manager, the key issue you must understand is the distinction between an application, an image name, and a process. Basically, the executable name of an application, such as Taskmgr.exe, is known to the operating system as its image name, and any time that you start an application the operating system starts one or more processes to support it. As Figure 15-1 shows, Task Manager has five tabs:

Figure 15-1. Use the Task Manager to track running applications and processes and to determine resource usage

No single command-line tool performs all the same functions as Task Manager. The closest tool in functionality is Process Resource Manager (Pmon.exe). Pmon is included in the Sup port Tools and performs the following tasks:

As Figure 15-2 shows, Pmon is much more detailed than the default Task Manager view, especially when it comes to current perprocess resource usage and activity. To run Pmon, access a command prompt, and then type pmon.

Figure 15-2. Use the Process Resource Manager to track running applications and processes and to determine resource usage

Unlike most commands that run and then exit, Pmon runs continuously until you press the Q key to quit. While it is running, Pmon gathers resource and process statistics every 5 seconds and redisplays them automatically. If you press any key other than Q, Pmon updates the sta tistics, allowing for more frequent refreshes if desired. Like Task Manager, Pmon can be run only locally, so if you wanted to work with a remote system, you must start a Remote Desktop Connection.

The sections that follow discuss how to use these tools to gather information about systems and resolve problems. The focus of the discussion is on Task Manager, which should be your primary tool for tracking a system's general health.

The Performance tab in Task Manager, shown in Figure 15-3, should be the first tab you check if you suspect a performance issue with a system. It shows current processor and mem ory usage and also graphs some historical usage statistics based on data collected since you started Task Manager.

Figure 15-3. The Performance tab provides a summary of current processor and memory usage as well as some historical usage statistics based on data collected since you started Task Manager

Some of the performance data is fairly selfexplanatory. The CPU Usage and CPU Usage His tory graphs show the percentage of processor resources being used. The PF Usage and Page File Usage History graphs show the size of the paging file being used by the system. The paging file is an area of memory written to disk, also referred to as virtual memory. The tough data to interpret here is the information below the graphs.

Totals shows summary statistics for input/output (I/O), threads, and processes. Handles shows the number of I/O file handles in use. Because each handle requires system memory to maintain, this is important to note. Threads shows the number of threads in use. Threads allows concurrent execution of process requests. Processes shows the number of processes in use.

Commit Charge shows how much memory is committed to processes currently and is not available for other processes. Total lists all physical and virtual memory currently in use. Limit lists the total physical and virtual memory available. Peak lists the maximum memory used by the system since it was started.

Physical Memory shows the total RAM on the system. Total shows the amount of physical RAM. Available shows the RAM not currently being used and available for use. System Cache shows the amount of memory used for system caching.

Kernel Memory shows the memory used by the operating system kernel. Total lists all memory being used by the operating system kernel, including physical memory (RAM) and virtual memory. Nonpaged reflects memory used by the operating system kernel that can't be written to disk. Paged reflects memory that can be paged to virtual memory if necessary.

In Figure 15-3 on the previous page, you see an example of a system with moderate to fairly high central processing unit (CPU) usage but with very little ongoing paging file activity. A system with CPU usage consistently at these levels would warrant some additional monitoring to determine whether resources should be added to the system. Basically, you'd want to determine whether these were average usage conditions or whether you were seeing peak usage.

If these are average usage conditions, increasing the processor speed or adding processors could improve performance and allow for better handling of peak usage situations. If these statistics represent peak usage conditions, the system probably wouldn't need additional resources. Sometimes the CPU usage can be high if the system has too little memory as well. A quick check of the memory usage of the server, including its current and peak usage, shows, however, that this isn't the case for this particular system.

Figure 15-4 shows performance data for a different system. This system has high CPU usage and in many cases, CPU usage is at 100 percent. If CPU usage were consistent at 100 percent, I might suspect a runaway process and look for a process that is causing the problem. Here, however, there are times when CPU usage isn't maxed out, and you'd definitely want to take a closer look at what's going on starting with memory usage. One thing to note right away is that the system has very little available RAM—around 45 MB—and the paging file (as shown in the Commit Charge section) is quite large—around 550 MB.

Figure 15-4. Heavy activity on the system is causing CPU usage to soar and in many cases to max out

Such a small amount of available RAM would be a concern, and if this level of usage were consistent, you might consider changing the way applications use RAM, adding RAM, or both. Such a large amount of virtual memory being used (relative to available physical RAM) is also an area of possible concern that might make you consider adding physical RAM. Although increasing the amount of RAM could offer some relief to the CPU, it might not be enough, so you could consider increasing the processor speed or adding processors. You might also consider offloading some of the system's load. For example, you could move one of its roles or applications to a different server.

The Applications Tab in Task Manager, shown in Figure 15-5, lists applications being run by users on the computer along with status details that show whether the applications are running or not responding. If an application has an open file, such as a Microsoft Word document, the name of the file is shown as well.

Figure 15-5. Task Manager tracks applications users are running in the Applications tab

To work with an application, select it by clicking it in the Task list. You can then right-click the application name to select the Switch To, Bring To Front, Minimize, or Maximize options. Don't overlook the usefulness of the Go To Process option when you right-click: Use this when you're trying to find the primary process for a particular application because selecting this option highlights the related process in the Processes tab.

If you see an application with a status of Not Responding, that's an indicator that an application might be frozen, and you might want to select it and then click End Task. Keep in mind that the Not Responding message can also be an indicator that an application is busy and should be left alone until it finishes. Generally, don't use End Task to stop an application that is running without errors. Instead, select the Switch To option to switch to the application and then exit as you normally would.

You can view information about processes running on a system by using the Processes tab of Task Manager or by running Pmon. The Task Manager display differs greatly from the output provided by Pmon. By default, the Processes tab shows only processes run by the operating system, local services, network services, and the interactive user. The interactive user is the user account logged on to the local console. To see processes run by remote users, such as those users connecting by using a Remote Desktop Connection, you must select the Show Processes From All Users option.

The default view of the Processes tab shows each running process by image name and user name. The CPU column shows the percentage of processor utilization for each process. The Mem Usage column shows the amount of memory the process is currently using. By default, processes are sorted by user name, but you can change this by clicking any of the available column headers to sort the information based on that column. Clicking again on the same column reverses the sort order. For example, click Image Name to alphabetically sort the image names. Click Image Name again to reverse sort the image names.

Troubleshooting: Isolate 32-bit or 64-bit processes

By default, 32-bit Windows systems show both 16-bit and 32-bit tasks that are running on the system, and 64-bit systems show both 32-bit and 64-bit tasks that are running on the system. To show only 32-bit tasks on 32-bit systems, click Options, then click Show 16-Bit Tasks. To show only 64-bit tasks on 64-bit systems, click Options, then click Show 32-Bit Tasks. This should clear the option for the related item on the Option menu.

As you may recall from Figure 15-2, Pmon shows much more detailed information for each process. This information is useful for troubleshooting. If you click View and choose Select Columns, you'll see a dialog box that allows you to add columns to the Processes tab. To get the additional information shown by Pmon, the following columns should be selected:

You will then have a process display like the one shown in Figure 15-6.

Figure 15-6. The Processes tab provides detailed information on running processes according to image name and user name

Okay, so now that you've added all these extra columns of information, you are probably wondering what it all means and why you want to track it. As stated previously, you primarily use this information for troubleshooting. It helps you pinpoint which processes are hogging system resources and the type of resources the resource hogs are using. Once you know what's going on with processes, you can modify the system or its applications accordingly to resolve a performance problem.

Table 15-1 summarizes the information provided by the process statistics. The value in parentheses following the Task Manager column name is the name of the corresponding column in Pmon. If by monitoring processes you notice what looks like a problem, you will probably want to start more detailed monitoring of the system. One tool to consider is System Monitor, which is discussed in Chapter 16. You can also stop processes that you suspect aren't running properly. To do this, right-click the process, and choose End Process to stop the process or End Process Tree to stop the process as well as any other processes it started.

As Figure 15-7 shows, the Networking tab in Task Manager displays current network usage for each of the system's connections to the network.

Figure 15-7. Use the Networking tab to track network activity

You can use the information provided to determine the following quickly:

The network activity graph shows traffic going to and from the computer as well as how much of the network capacity is in use. If a system has one network adapter, the graph details network traffic on this adapter over time. If a system has multiple network adapters, the graph displays a composite index of all network connections, which represents all network traffic.

Troubleshooting: Get separate views of bytes received and sent for troubleshooting

For troubleshooting, it is sometimes useful to have separate views of traffic going to the computer (Bytes Received) and traffic going from the computer (Bytes Sent). To do this, click View, choose Network History, and then select Bytes Sent. Then click View, choose Network History, and then select Bytes Received. Afterward, Bytes Sent are shown in red, Bytes Received in yellow, and Bytes Total in green.

You can also get more detailed information for each adapter. This information is useful for troubleshooting. If you click View and choose Select Columns, you'll see a dialog box that will let you add columns for summary statistics to the Networking tab. Table 15-2 summarizes the key network statistics available.

Members of the Administrators group and any users to which you specifically grant remote access can connect to systems using Terminal Services or a Remote Desktop Connection. Both techniques allow users to access systems remotely and use the systems as if they were sitting at the keyboard. In the standard configuration, however, remote access is disabled. You can enable the remote access feature by using the System utility in Control Panel. Start the System utility, then click the Remote tab. In the Remote Desktop panel, select Allow Users To Connect Remotely To This Computer, and then click OK.

With Remote Desktop, Windows Server 2003 allows one console session and two remote administration sessions. Most remote sessions are created as console sessions. The reason for this is that the console session provides full functionality for administration. If you log on locally to the console and someone is logged on remotely to the console, you will be prompted to end his or her user session so that you can log on. If you click Yes, the user's session is disconnected, halting all user-started applications without saving application data. If you click No, you will not be allowed to log on. See Chapter 30, for details on how you can use Remote Desktop to configure remote sessions for administration rather than console sessions.

If you configure a server by using Terminal Services, multiple users can log on to a system up to a maximum allowed by licensing. To keep track of sessions once you've configured Terminal Services, you can use the Users tab of Task Manager. As shown in Figure 15-8, the Users tab lists user connections according to the following factors:

Figure 15-8. Use the Users tab to track and manage remote user sessions

The Users tab can help you determine who is logged on and whether that user's status is either Active or Inactive. Right-click an active session and you can choose Send Message to send a console message to the user. This message is displayed on the screen of that user's session.

If you must end a user session, you can do this in one of two ways. Right-clicking the session and choosing Log Off logs the user off using the normal logoff process. This allows application data and system state information to be saved as during a normal logoff. Right-clicking the session and choosing Disconnect forcibly ends a user's session without saving application data or system state information.

You can also connect to an inactive session. Right-click the inactive session, and then choose Connect. When prompted, provide the user's password.

Finally, by default the hot keys used to end a remote control session are Ctrl+* (Ctrl+Shift+8). If you want a session to use different hot keys, right-click the session you want to work with, and then select Remote Control. You can then set the hot keys to end the remote control session.