The Performance Monitor Meets the Registry

Overview

A part of the registry that we've not discussed yet is HKEY_PERFORMANCE_DATA, the registry's performance hive. This registry hive contains the necessary information to allow an application to successfully interact with and display performance data. Hidden from the Registry Editor, it is contained in a place in the registry that is only accessible

programmatically; otherwise, it's not visible or editable.

That HKEY_PERFORMANCE_DATA does not actually exist is an interesting part of Windows. Windows stores this hive temporarily, mostly in memory. Quick updating of these performance-monitoring counters is necessary to avoid impacting performance. Windows has no need to store, on disk, performance data—this type of information is transient, constantly changing while the system is used.

Although it is somewhat more difficult to access the performance hive than other registry hives, this difficulty can be overcome using the tools provided in the Windows header file, winperf.h, distributed with Visual C++. In addition, in this chapter I'll show you a simple program I've created for browsing HKEY_PERFORMANCE_DATA. PerfMon1 is a program that views the information in HKEY_PERFORMANCE_DATA. Keep in mind that the program as presented in this chapter is only an example and doesn't actually do any useful retrieval of data—you will have to add that functionality.

PerfMon1: A Program to Access HKEY_PERFORMANCE_DATA The PerfMon1 program is a simple console application, displaying its voluminous data using printf() statements. To keep this example as simple as possible, I've forgone any semblance of a user interface. The example program's inability to do any real monitoring is for the same reason—simplicity!

There are two methods to access performance data under Windows. The first, the "standard"

registry interface, is powerful, but does not focus on performance data. The second, the Performance Data Helper (PDH), is newer and actually easier to use. The PDH is oriented toward single counters, rather than groups of counters. PerfMon1 uses the rather standard interface.

Note When you're using PerfMon1, I suggest you use I/O redirection and capture the data into a file. Then edit or browse the file. PerfMon1 might typically print over 50,000 lines of output; watching all of this scroll past on the screen won't be any fun.

The performance data is entirely contained within the HKEY_PERFORMANCE_DATA hive, with the exception of the object and counter names and help information, which are contained in the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows

NT\CurrentVersion\Perflib\009.

Note Are the performance data and HKEY_PERFORMANCE_DATA part of the registry?

Well, that's a good question. It seems obvious that the storage of performance data wasn't part of Microsoft's original conception of the registry.

HKEY_PERFORMANCE_DATA is an example of Microsoft extending the registry functionality and interface to provide special services.

There are only two values in this key: Counter and Help. Both of these values are REG_MULTI_SZ, with many entries in each.

Note Appendix D lists a typical installation's counters and objects. You can use the

information in Appendix D to determine which items are objects and what counters are found in each object.

An Example Portion of PerfMon1 Output First, let's take a look at PerfMon1's output:

PerfMon1 - Check out HKEY_PERFORMANCE_DATA! Version 2002 +---

Index: 10386

Counter: 10388

To make sense of PerfMon1's output, you can look up the object and counter IDs in Appendix D. It'll also help to start off with a good understanding of what counters are. A counter is an item that indicates how many times, or at what rate, a given event happens. For example, the counter named Page Faults/Sec indicates the number of page faults (that is, the number of times the system needed to use virtual memory) that occurred in the previous second. Most, if not all, counters are based on a time interval (that you, the user, may set). A temporary

counter is used, and when the time interval expires, the counter in the registry is updated.

Then, any performance-monitoring application is able to retrieve and display the updated counter.

And a performance object? A performance object is a collection of performance counters used to monitor a specific functionality.

The output begins with the Active Server Pages performance object at index 10386. This object measures various parameters regarding Active Server Pages. Counters in Active Server Pages (see Figure 11.1) include those shown below:

Counter Name

10388 Debugging Requests

10390 Errors during Script Runtime 10392 Errors from ASP Preprocessor 10394 Errors from Script Compilers 10396 Errors/Sec

10398 Request Bytes in Total 10400 Request Bytes out Total 10402 Request Execution Time 10404 Request Wait Time

10406 Requests Disconnected

10408 Requests Executing

10410 Requests Failed Total 10412 Requests Not Authorized 10414 Requests Not Found

10416 Requests Queued

10418 Requests Rejected

10420 Requests Succeeded

10422 Requests Timed Out

10424 Requests Total

10426 Requests/Sec 10428 Script Engines Cached

10430 Session Duration

10432 Sessions Current

10434 Sessions Timed Out

10436 Sessions Total

10438 Templates Cached

10440 Template Cache Hit Rate

10444 Template Notifications

Counter Name

10446 Transactions Aborted

10448 Transactions Committed

10450 Transactions Pending

10452 Transactions Total

10454 Transactions/Sec

Figure 11.1: The Performance Monitor's Add Counters dialog box showing Active Server Pages and some counters

The next object is number 10548, Indexing Service Filter. This object has only three counters:

Counter Name

10550 Total Indexing Speed (MB/hr) 10552 Binding Time (msec)

10554 Indexing Speed (MB/hr)

Moving on in the PerfMon1 report, the next index is number 10524, or in more friendly terms, Indexing Service. This object is a bit different from the Indexing Service Filter, but why? It's because the actual indexing service is different from the indexing service filter. The counters in the Indexing Service performance object are shown here:

Counter Name

10526 Word Lists

10528 Saved Indexes

10530 Index Size (MB)

10532 Files to Be Indexed

10534 Unique Keys

10536 Running Queries

10538 Merge Progress

10540 # Documents Indexed 10542 Total # of Documents

Counter Name 10544 Total # of Queries 10546 Deferred for indexing

The Performance Monitor itself is another example of the MMC (Microsoft Management Console). In Figure 11.2, the Performance Monitor shows the first few counters for the system's CPU usage. In this figure, the bottom lines show various types of usage. The top line graphed shows idle time, which drops whenever the CPU is utilized.

Figure 11.2: The Performance Monitor displaying some CPU usage counters.

Figure 11.2 also shows how you can customize a performance graph. I've customized both the chart title and the title for the vertical axis. Current data values are shown in the chart's data display area directly below the actual chart. The legend, located below the chart, shows the items being displayed and allows modification of the displayed item's attributes, such as color, line style, and width.

A Look at the Program

Now let's take a look at the PerfMon1 program itself. Listing 11.1 contains the main program, PerfMon1.cpp, a very simple program that accesses performance counters and objects stored in the registry. To create PerfMon1, see the instructions for creating a project in Chapter 10.

Note You may download the PerfMon1 code from the Sybex website at www.sybex.com.

Click Catalog, type the name of the book or the reference number from the book's ISBN (2987), and press Enter. From the main page for this book, click Downloads to go to the code.

Listing 11.1: PerfMon1.cpp

// PerfMon1.cpp : Defines the entry point for the console //application.

#define _UNICODE

#include "stdafx.h"

#include <windows.h> // Standard windows header

#include <winperf.h> // Performance monitor definitions

#include <stdio.h> // printf() and other I/O stuff