How to analyze a PAL Active Directory Report?

Sep 19, 2010 at 2:32 AM

I am reading through my first PAL report for a production Domain Controller. First, wow am I imprressed! Thank you. The report is pretty good, but there are about 500 alerts in 18 hours of weekend stats. In many cases, the stats are normal when the top 10% outliers are removed. Some are just barely above yellow threshold. The alerts are in the following areas. How does one determine if the server is good enough, but maybe on the edge? Is the solution a beefier DC or add more DCs? Where can I turn for some help with this?

Logical Disk Read Latency Analysis (Alerts: 80)
NTDS LDAP Bind Time (Alerts: 27)
NTDS DRA Pending Replication Operations (Alerts: 24)
Physical Disk Read Latency Analysis (Alerts: 59)
Memory Leak Detection (Alerts: 48)
Process IO Data Operations/sec (Alerts: 66)
Process IO Other Operations/sec (Alerts: 118)
% Processor Time (Alerts: 89)
Privileged Mode CPU Analysis (Alerts: 26)
High Context Switching (Alerts: 30)

Tony Weil
Univeristy of Michigan

Sep 20, 2010 at 7:43 PM

Each analysis has a description section. It explains why it the analysis exists, what it is looking for (thresholds), and public links to more information. There is no overall analysis because the computer's resources and load can change with time. My organization, Microsoft Premier Field Engineering (PFE) offers a Vital Signs workshop which teaches Windows architecture and the reason many of these thresholds exist. If you are interested, then check with your company to see if you have a Microsoft Premier Support Agreement. If so, then contact your Technical Account Manager (TAM) about the workshop. We can only deliver the workshop to customers with a premier support agreement. If you do not have one, then go to to learn more.

In the near future, I will be creating more content on what to do when you have alerts in each respective analysis.