| Counter | Description | Thresholds |
| Processor: %ProcessorTime_Total Instance | Percentage of elapsed time a CPU is busy executing a non idle thread | High value is a concern only if accompanied by an aggravated System: Processor Queue Length sum greater than 2 X # of CPUs) or growing with % Processor Time greater than 80-90% |
| System: Processor Queue Length | Number of threads in the processor queue. Ready threads only, not threads that are running | Greater than 2 X # of CPUs for 5-10 minutes or with %Total Processor Time of 80%-90%. |
| System: Context Switches/sec | Combined rate at which all CPUs are switched from one thread to the other. Occur when a running thread voluntarily relinquishes the CPU, is preempted by a higher priority thread, or switches between user mode and privileged mode to use an executive or subsystem service. | Must be baselined to determine if excessive context switching occurring |
| Memory: Available Bytes | Amount of physical memory available to processes in bytes | If less than 25% of physical, monitor paging closely |
| Memory: Pages/Sec | Number of memory pages read from disk or written to disk to resolve memory references that were not in memory at time of reference. | Greater than 100 not a problem unless accompanied by Low Available memory or high Disk transfers/sec . |
| Memory: Pages Output/sec | # of pages written to disk to free up space in physical memory. | If this rate is high along with high Pages/sec and low Available memory, system is low on memory. |
| Logical Disk: Transfers/sec (for pagefile disk) | Rate of read and write operations on the disk | Sustained Disk Transfer to the disk where the page file exist, along with low available bytes and high Pages/Sec points to a memory bottleneck. |
| Paging File: %Usage | Percentage of page file in use | If greater than 75% of pagefile in use, consider increasing RAM. |
| Memory: Commit Limit | Amount of Virtual memory that can be committed without extending page file. | Gives insight into if page file is large enough |
| Server: Pool NonPaged Pool Failures | # of times allocations from Non Paged pool have failed | If >1 on a regular basis, not enough system memory |
| Server: Pool Paged Pool Failures | # of times allocations from Paged pool have failed | If >1 on a regular basis, not enough system memory or the page file is too small |
| Counter | Description | Thresholds |
| Logical Disk: Average Disk Queue Length | Average Number of both read and write requests queued | If >2-3 for a single disk and Disk Transfers/sec is high selected disk is bottleneck. For Disk Arrays, divide Avg Disk Queue Length by number of disks in array. If this number >2, then disk subsystem is a bottleneck. |
| Logical Disk: Disk Transfers/sec | Workload being experienced by drive. Rate of read and write operations (I/Os per second) on the selected disk. | >100 consistently for single drive, check Average Disk sec/transfer counter |
| Logical Disk: Average Disk sec/transfer | Time in seconds of average disk transfer | .035 sec indicates selected disk drives response is slow |
| Logical Disk: Disk Bytes/sec | Rate bytes are transferred to or from the disk during read or write ops. | Sum this counter for each drive connected to SCSI controller. If value is greater than 80% of theoretical throughput, disk subsystem is bottleneck. |
| Logical Disk: Split IO/sec | Rate that I/Os to the disk were split into multiple I/Os | If higher than normal, ensure disks are not fragmented |
| Network Interface: Output Queue Length | Length of Output packet Queue | If greater than 3 for 15 minutes or more, NIC is bottleneck |
| Network Segment: %Network Utilization | % of network bandwidth in use on this segment | For Ethernet networks, if value is consistently about 50%-70%, this segment is becoming a bottleneck. |
| Network Interface: Bytes Total/sec | Rate at which all bytes are sent and received on selected interface, including overhead | If consistently close to maximum actual throughput of your network, this interface is a bottleneck. |
| Network Interface: Packets Outbound errors and Received Errors | # of outbound packets that could not be transmitted or received because of network errors | .>1, this nic is experiencing network problems and is a potential bottleneck |
| Redirector: Current Commands | # of requests to the redirector that are currently queued for service | If this number is much larger than the number of network adapter cards installed in the computer, then the network(s) and/or the server(s) being accessed are seriously bottlenecked. |
| Server: Work Item Shortage | # of times STATUS_DATA_NOT_ACCEPTED was returned at receive time | >3 Indicates Win2k has not allocated sufficient InitWorkItems or MaxWorkItems. |